CN108171082A - A kind of webpage detection method and device - Google Patents
A kind of webpage detection method and device Download PDFInfo
- Publication number
- CN108171082A CN108171082A CN201711278421.0A CN201711278421A CN108171082A CN 108171082 A CN108171082 A CN 108171082A CN 201711278421 A CN201711278421 A CN 201711278421A CN 108171082 A CN108171082 A CN 108171082A
- Authority
- CN
- China
- Prior art keywords
- detected
- webpage
- mark
- url
- sampling data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
Abstract
An embodiment of the present invention provides a kind of webpage detection methods and device, method to include：Original web page is sampled in advance, obtains original sampling data, by original sampling data storage corresponding with the mark of webpage；When being detected to webpage, in pre-stored original sampling data, obtain the corresponding original sampling data of mark of webpage to be detected, and it treats detection webpage and is sampled, obtain present sample data, judge whether the original sampling data and the current sampled data are identical, if identical, determine that webpage to be detected is not tampered with.As it can be seen that comparing original sampling data and present sample data in this programme, compared in existing scheme, the full content of original web page and the full content of webpage to be detected are compared, reduces comparison and takes, improve detection efficient.
Description
Technical field
The present invention relates to field of communication technology, more particularly to a kind of webpage detection method and device.
Background technology
In the Internet, applications, it will usually there is a situation where that attacker distorts webpage, therefore, it is necessary to webpage is visited
It surveys, to judge whether webpage is tampered, reduces the harm for being tampered webpage generation.Existing webpage detecting strategy generally includes：In advance
First the normal webpage being not tampered with is preserved to buffering area, it, please by user after the web access requests for receiving user's transmission
The webpage preserved in the webpage and buffering area of access is asked to be compared.If the webpage preserved in buffering area all asks to visit with user
The webpage asked is different, then it represents that the webpage of user's request has been tampered.
In said program, by user ask access webpage full content and buffering area in preserve webpage full content into
Row comparison, it is time-consuming longer, cause detection efficient relatively low.
Invention content
The embodiment of the present invention is designed to provide a kind of webpage detection method and device, to improve detection efficient.
In order to achieve the above objectives, an embodiment of the present invention provides a kind of webpage detection method, including：
Determine the mark of webpage to be detected；
In pre-stored original sampling data, the corresponding original sampling data of the mark is obtained；
The webpage to be detected is sampled, obtains present sample data；
Judge whether acquired original sampling data and the present sample data are identical；
If the original sampling data is identical with the present sample data, determine that the webpage to be detected is not usurped
Change.
Optionally, the mark for determining webpage to be detected, can include：
The access request that user terminal is sent is received, the uniform resource position mark URL carried in the access request is true
It is set to the mark of webpage to be detected；
Alternatively, every preset time period, the URL of each webpage of storage is determined as net to be detected successively according to preset order
The mark of page.
Optionally, it is described in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained,
It can include：
In pre-stored raw page data length, the corresponding raw page data length of the mark is obtained；
Obtain the corresponding web data length to be detected of the mark；
Judge whether acquired raw page data length and the web data length to be detected are identical；
If identical, in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
Optionally, it is described in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained,
It can include：
In pre-stored detection list item, the detection list item for including the mark is searched；
If found, the original sampling data included in the detection list item found is read；
If do not found, the corresponding original web page of the mark is obtained from backup server, to the original web page
It is sampled, obtains original sampling data.
Optionally, the mark for determining webpage to be detected, including：It reads in the access request that user terminal is sent and carries
URL；If read URL is directed toward dynamic web page, the dynamic serial number in read URL is adjusted to default serial number, it will
URL after adjustment is determined as URL to be detected；
It is described in pre-stored original sampling data, obtain the corresponding original sampling data of the mark, can wrap
It includes：
In pre-stored original sampling data, the corresponding original sampling datas of the URL to be detected are obtained；
The webpage to be detected is sampled, obtains present sample data, can be included：
The corresponding webpages to be detected of the URL to be detected are sampled, obtain present sample data.
Optionally, it is described in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained,
It can include：
In the mark of pre-stored webpage and in the corresponding snoop tag of the mark, obtaining the webpage to be detected
The corresponding snoop tag of mark；
Judge whether acquired snoop tag is not distort label；
If it is label is not distorted, in pre-stored original sampling data, the mark of the webpage to be detected is obtained
Corresponding original sampling data；
The method can also include：
It, will be described to be detected in the case where the acquired original sampling data of judgement is with the present sample data difference
The corresponding snoop tag of mark of webpage is adjusted to distort label.
Optionally, the method can also include：
If the original sampling data is different from the present sample data, from backup server obtain with it is described
Identify corresponding original web page；
The original web page is sent to user terminal.
In order to achieve the above objectives, the embodiment of the present invention additionally provides a kind of webpage detection device, including：
First determining module, for determining the mark of webpage to be detected；
Acquisition module, in pre-stored original sampling data, obtaining the corresponding crude sampling number of the mark
According to；
First sampling module for being sampled to the webpage to be detected, obtains present sample data；
Judgment module, for judging whether acquired original sampling data and the present sample data are identical；If
It is identical, the second determining module is triggered,
Second determining module, for determining that webpage to be detected is not tampered with.
Optionally, first determining module, specifically can be used for：
The access request that user terminal is sent is received, the uniform resource position mark URL carried in the access request is true
It is set to the mark of webpage to be detected；
Alternatively, every preset time period, the URL of each webpage of storage is determined as net to be detected successively according to preset order
The mark of page.
Optionally, the acquisition module, specifically can be used for：
In pre-stored raw page data length, the corresponding raw page data length of the mark is obtained；
Obtain the corresponding web data length to be detected of the mark；
Judge whether acquired raw page data length and the web data length to be detected are identical；
If identical, in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
Optionally, the acquisition module, specifically can be used for：
In pre-stored detection list item, the detection list item for including the mark is searched；
If found, the original sampling data included in the detection list item found is read；
If do not found, the corresponding original web page of the mark is obtained from backup server, to the original web page
It is sampled, obtains original sampling data.
Optionally, first determining module, specifically can be used for：It reads in the access request that user terminal is sent and carries
URL；If read URL is directed toward dynamic web page, the dynamic serial number in read URL is adjusted to default serial number, it will
URL after adjustment is determined as URL to be detected；
The acquisition module, specifically can be used for：In pre-stored original sampling data, obtain described to be detected
The corresponding original sampling datas of URL；
First sampling module, specifically can be used for：The corresponding webpages to be detected of the URL to be detected are adopted
Sample obtains present sample data.
Optionally, the acquisition module, specifically can be used for：
In the mark of pre-stored webpage and in the corresponding snoop tag of the mark, obtaining the webpage to be detected
The corresponding snoop tag of mark；Judge whether acquired snoop tag is not distort label；If it is not distorting label,
In pre-stored original sampling data, the corresponding original sampling data of mark of the webpage to be detected is obtained；
Described device can also include：
Module is adjusted, in the acquired original sampling data of the judgement situation different from the present sample data
Under, the corresponding snoop tag of mark of the webpage to be detected is adjusted to distort label.
Optionally, described device can also include：
Feedback module, in the acquired original sampling data of the judgement situation different from the present sample data
Under, it is obtained and the corresponding original web page of the mark from backup server；The original web page is sent to user terminal.
In order to achieve the above objectives, the embodiment of the present invention additionally provides a kind of electronic equipment, including processor, communication interface,
Memory and communication bus, wherein, processor, communication interface, memory completes mutual communication by communication bus；
Memory, for storing computer program；
Processor during for performing the program stored on memory, realizes any of the above-described kind of webpage detection method.
In order to achieve the above objectives, the embodiment of the present invention additionally provides a kind of computer readable storage medium, the computer
Readable storage medium storing program for executing memory contains computer program, and the computer program realizes any of the above-described kind of webpage when being executed by processor
Detection method.
Using illustrated embodiment of the present invention, original web page i.e. normal webpage are sampled in advance, obtain original adopt
Sample data, by original sampling data storage corresponding with the mark of webpage.When needing to detect webpage, prestoring
Original sampling data in, obtain the corresponding original sampling data of mark of webpage to be detected；And it treats detection webpage to carry out
Sampling, obtains present sample data.Judge whether acquired original sampling data and present sample data are identical.If phase
Together, determine that webpage to be detected is not tampered with.If it is different, determine that webpage to be detected has been tampered.As it can be seen that in a first aspect, we
Original sampling data and present sample data are compared in case, it, will be in the whole of original web page compared in existing scheme
Hold and compared with the full content of webpage to be detected, reduce comparison and take, improve detection efficient；Second aspect, we
In case it is pre-stored be normal webpage sampled data, and the full content of improper webpage, in this way, reducing storage resource
Occupancy.
Certainly, implement any of the products of the present invention or method it is not absolutely required at the same reach all the above excellent
Point.
Description of the drawings
In order to illustrate more clearly about the embodiment of the present invention or technical scheme of the prior art, to embodiment or will show below
There is attached drawing needed in technology description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of invention, for those of ordinary skill in the art, without creative efforts, can be with
Other attached drawings are obtained according to these attached drawings.
Fig. 1 is the first flow diagram of webpage detection method provided in an embodiment of the present invention；
Fig. 2 is second of flow diagram of webpage detection method provided in an embodiment of the present invention；
Fig. 3 is a kind of application scenarios schematic diagram of the embodiment of the present invention；
Fig. 4 is a kind of structure diagram of webpage detection device provided in an embodiment of the present invention；
Fig. 5 is the structure diagram of a kind of electronic equipment provided in an embodiment of the present invention.
Specific embodiment
Below in conjunction with the attached drawing in the embodiment of the present invention, the technical solution in the embodiment of the present invention is carried out clear, complete
Site preparation describes, it is clear that described embodiment is only part of the embodiment of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, those of ordinary skill in the art are obtained every other without making creative work
Embodiment shall fall within the protection scope of the present invention.
In order to solve the above-mentioned technical problem, an embodiment of the present invention provides a kind of webpage detection method, device and electronics to set
It is standby.This method and device can be applied to server or applied to the network equipments between server and user terminal, etc.
Deng not limiting specifically.
For the convenience of description, in the following contents, illustrated using the network equipment as executive agent.First below to this hair
A kind of webpage detection method that bright embodiment provides is described in detail.
The first flow diagram of Fig. 1 for webpage detection method provided in an embodiment of the present invention, the webpage detection method
Specifically include following steps：
S101：Determine the mark of webpage to be detected.
As a kind of embodiment, the network equipment can be after the access request for receiving user terminal transmission, according to this
Access request determines the mark of webpage to be detected.
As another embodiment, the network equipment can be every preset time period, successively will storage according to preset order
The mark of each webpage be determined as the mark of webpage to be detected.
For example, which can be uniform resource locator (English：Uniform Resource Locator, letter
Claim：URL).URL can be carried in the access request that user terminal is sent, the network equipment determines the URL carried in access request
URL for webpage to be detected.
Alternatively, can also be every preset time period, according to preset order successively, the network equipment is by each webpage of storage
URL is determined as the URL of webpage to be detected.
Alternatively, other can also be capable of mark of the information as webpage of unique mark webpage by the network equipment, specifically not
Limit, for the convenience of description, in the following contents by webpage be identified as URL for illustrate.
In present embodiment, the network equipment reads the URL carried in the access request that user terminal is sent.If the URL
The webpage of direction is static Web page, then the network equipment is directly using read URL as URL to be detected.If what the URL was directed toward
Webpage is dynamic web page, then the dynamic serial number in read URL is adjusted to default serial number by the network equipment, and will be after adjustment
URL is determined as URL to be detected.
In general, in the URL of dynamic web page "" below comprising multiple id, such as：http://xxx.xx x.com/
xxx/xxx/xxx.yyyId=1；http://xxx.xxx.com/xxx/xxx/xxx.yyyId=10；http://
xxx.xxx.com/xxx/xxx/xxx.yyyId=5；These three URL represent same dynamic web page, are wrapped in the dynamic web page
Containing the different URL of multiple id.
In the present embodiment, which is known as dynamic serial number, a dynamic serial number can be preset, it is assumed that default sequence
Number for 1, then using the URL of id=1 as URL to be detected.
S102：In pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
In the network equipment or the other equipment being connect with network device communications, it is previously stored with the original of multiple webpages
Sampled data.
Specifically, the network equipment or the other equipment that is connect with network device communications can in advance to original web page into
Row sampling, obtains original sampling data, and stores obtained original sampling data is corresponding with the URL of the webpage.The present embodiment
In " original web page " be the webpage that is not tampered with, the data sampled to original web page are known as " crude sampling number
According to ".
In this way, the network equipment is using the URL obtained in S101 as URL to be detected.In pre-stored URL and corresponding original
In beginning sampled data, the network equipment obtains the corresponding original sampling datas of the URL to be detected.
In the present embodiment, sampling rule is preset, sampling interval number of words, sampling length etc. are included in sampling rule.
Original web page is sampled and subsequent content in treat detection webpage sample, adopted according to the sampling rule
Sample.
As described above, in S101, if the URL read in access request is directed toward dynamic web page, the network equipment will
Dynamic serial number in read URL is adjusted to default serial number, and the URL after adjustment is determined as URL to be detected.
Assuming that default serial number 1, then when the network equipment prestores URL and corresponding original sampling data, for dynamic
Multiple URL that webpage includes can only sample 1 corresponding URL of the serial number original web pages being directed toward, obtain crude sampling number
According to.
As a kind of embodiment, S102 can include：The network equipment in pre-stored raw page data length,
It obtains and identifies corresponding raw page data length and the corresponding web data length to be detected of mark.The network equipment judges institute
Whether the raw page data length of acquisition and web data length to be detected are identical.If identical, the network equipment is advance
In the original sampling data of storage, obtain and identify corresponding original sampling data.
In the network equipment or the other equipment being connect with network device communications, it is previously stored with the original of multiple webpages
Web data length." web data length " in the present embodiment refers to the total length of webpage total data, " raw page data
Length " refers to the total length of total data in the webpage being not tampered with.
Specifically, the network equipment can obtain the data length of original web page in advance, it, will as raw page data length
Obtained raw page data length storage corresponding with webpage URL.In this way, the network equipment is using the URL determined in S101 as treating
URL is detected, in pre-stored URL and corresponding raw page data length, obtains the corresponding original nets of the URL to be detected
Page data length.
In addition, the network equipment obtains the corresponding web data length to be detected of URL to be detected, which is to work as
It is inscribed when preceding, server is supplied to the webpage of user.
As a kind of embodiment, two class servers can be set, one kind is publisher server, and one kind is backup services
Device：Publisher server is the server for providing ordinary user service, and the webpage which provides has the wind being tampered
Danger.Backup server may be considered safe server, and the risk being tampered is not present in the webpage stored in backup server,
Ordinary user cannot access backup server.It is after publisher server often issues new webpage, the new web storage is standby to this
In part server.
In this way, the network equipment (executive agent) can obtain webpage to be detected from publisher server, from backup server
Middle acquisition original web page.
The network equipment can read web data length to be detected from publisher server, and the web data to be detected is long
Degree is compared with the raw page data length.If the two is different, the network equipment determines the corresponding nets to be detected of the URL
Page is tampered, and no longer performs subsequent step.If the two is identical, the network equipment performs subsequent step again, to carry out subsequent probe.
As a kind of embodiment, can in the network equipment or the equipment being connect with network device communications storage detection
List item, comprising URL and corresponding original sampling data in the detection list item, alternatively, can also be included in the detection list item original
Data length.
In present embodiment, S102 can include：The network equipment is searched in pre-stored detection list item comprising described
The detection list item of mark.If found, the network equipment reads the original sampling data included in the detection list item found.Such as
Fruit does not find, and the network equipment obtains the corresponding original web page of the mark from backup server, to the original web page into
Row sampling, obtains original sampling data.
The network equipment samples the original web page with the other equipment that the network equipment is connected, and obtains original
After sampled data, obtained original sampling data and the URL to be detected can be stored as a new detection list item；Alternatively,
A new detection can be stored as by obtained original sampling data, the data length of the original web page, with the URL to be detected
List item.
In the present embodiment, the network equipment can be updated the detection list item of storage according to predetermined period.Than
Such as, it is primary to the detection entry updating of storage per hour；Alternatively, the original web page that can also be stored in backup server is by more
After new, network equipment detection list item corresponding to the webpage being updated is updated.To detect list item update mode there are many,
It does not limit specifically.
Detection list item, which is updated, can include increasing or replacing.For example, for stored detection list item
For, the URL included in these list items can be directed to, the corresponding original web pages of these URL, network are searched in backup server
Equipment re-starts sampling with the other equipment that the network equipment is connected to these original web pages, and resampling is obtained
Original sampling data replace detection list item in original sampling data.
And if having newly increased original web page in backup server, newly-increased original web page is sampled, by what is obtained
Original sampling data is corresponding with the URL of newly-increased original web page to be stored as a detection list item, this is equivalent to increase detection list item.
S103：It treats detection webpage to be sampled, obtains present sample data.
For example, the network equipment can obtain webpage to be detected from above-mentioned publisher server, and utilization is preset
Sampling rule, samples the webpage to be detected, obtains present sample data.
As described above, in S101, it, will if the URL that the network equipment is read in access request is directed toward dynamic web page
Dynamic serial number in read URL is adjusted to default serial number, and the URL after adjustment is determined as URL to be detected.And in S102
The original sampling data that the network equipment obtains also is the sampled data of the corresponding original web pages of URL after adjustment.
Corresponding, also webpage to be detected corresponding to the URL after adjustment samples the network equipment in S103, is worked as
Preceding sampled data.
Continue above-mentioned example, it is assumed that default serial number 1, when prestoring URL and corresponding original sampling data, for dynamic
Multiple URL that state webpage includes only sample 1 corresponding URL of the serial number original web pages being directed toward, obtain crude sampling number
According to.
Correspondingly, the network equipment only samples 1 corresponding URL of the serial number webpages to be detected being directed toward in S103, obtain
To present sample data.In this way, original sampling data is identical for the dynamic serial number in corresponding URL with present sample data
's.
In existing scheme, for dynamic web page, the web page contents that multiple URL that dynamic web page is included are directed toward all preserve
To buffering area, a large amount of storage resources are occupied；And in present embodiment, the sampled data of a URL in dynamic web page is only preserved, greatly
The big occupancy for reducing storage resource.
In addition, in existing scheme, for each URL that dynamic web page includes, all by whole original contents of the URL and entirely
Portion's Current Content is compared, and comparison takes longer；And in present embodiment, only for a URL in dynamic web page, by this
The original sampling data of URL is compared with present sample data, is greatly reduced comparison and is taken, improves detection efficient.
S104：Judge whether acquired original sampling data and the present sample data are identical；If identical, perform
S105：Determine that webpage to be detected is not tampered with；If it is different, perform S106：Determine that webpage to be detected is tampered.
If the network equipment performs the embodiment of the present invention after the access request for receiving user terminal transmission, in S104
In the case of judging that result is identical, the network equipment can feed back the corresponding webpages to be detected of the URL carried in access request
To user terminal.In the case where S104 judges result for difference, the network equipment can correspond to the URL carried in access request
Original web page feed back to user.
Such as in a kind of above-mentioned embodiment, the network equipment (executive agent) obtains net to be detected from publisher server
Page, obtains original web page from backup server.That is, in the case that S104 judgement results are identical, from issuing service
The corresponding webpages to be detected of the URL are obtained in device and feed back to user.In the case where S104 judges result for difference, from backup
The corresponding original web pages of the URL are obtained in server, and the original web page is sent to user terminal.
The other equipment being connected as a kind of embodiment, the network equipment or with the network equipment can be directed to URL
Corresponding snoop tag is stored, which includes distorting label and do not distort two kinds of label.
Before S102, the network equipment can first obtain the corresponding snoop tags of URL to be detected.If acquired detection
Labeled as label is distorted, then the network equipment determines that the corresponding webpages to be detected of the URL are tampered, and no longer performs S102-S104.Such as
Snoop tag acquired in fruit is does not distort label, and the network equipment performs S102-S104 again, to carry out subsequent probe.It is it can be seen that right
URL carries out snoop tag, can further improve detection efficient.
In the present embodiment, in the case where S104 judges result for difference, the network equipment is corresponding by URL to be detected
Snoop tag is adjusted to distort label.In addition, the network equipment can after the corresponding webpages to be detected of URL to be detected are repaired,
The corresponding snoop tags of URL will be detected again to be adjusted to not distort label.
Using embodiment illustrated in fig. 1 of the present invention, in a first aspect, by original sampling data and present sample data in this programme
It is compared, compared in existing scheme, the full content of original web page and the full content of webpage to be detected is compared,
Reduce comparison to take, improve detection efficient；Second aspect, in this programme it is pre-stored be normal webpage hits
According to, and the full content of improper webpage, in this way, reducing the occupancy of storage resource.
Fig. 2 is second of flow diagram of webpage detection method provided in an embodiment of the present invention, specifically includes following step
Suddenly：
S201：The access request that user terminal is sent is received, according to the URL carried in the access request, determines to wait to visit
Survey URL.
As a kind of embodiment, the network equipment reads the URL carried in the access request that user terminal is sent.It if should
The webpage that URL is directed toward is static Web page, then the network equipment is directly using read URL as URL to be detected.If the URL refers to
To webpage for dynamic web page, then the dynamic serial number in read URL is adjusted to default serial number by the network equipment, after adjustment
URL be determined as URL to be detected.
In general, in the URL of dynamic web page "" below comprising multiple id, such as：http://xxx.xx x.com/
xxx/xxx/xxx.yyyId=1；http://xxx.xxx.com/xxx/xxx/xxx.yyyId=10；http://
xxx.xxx.com/xxx/xxx/xxx.yyyId=5；These three URL represent same dynamic web page, are wrapped in the dynamic web page
Containing the different URL of multiple id.
In the present embodiment, which is known as dynamic serial number, a dynamic serial number can be preset, it is assumed that default sequence
Number for 1, then using the URL of id=1 as URL to be detected.
S202：In pre-stored detection list item, the detection list item for including URL to be detected is searched.If found, hold
Row S203-S209 if do not found, performs S210-S215.
In Fig. 2 embodiments, detection table is stored in the network equipment or the other equipment being connect with network device communications
.It detects and the corresponding snoop tags of URL and URL, raw page data length and original sampling data is included in list item.It should
Snoop tag includes distorting label and does not distort two kinds of label.
S203：Whether the snoop tag for judging to include in the detection list item found is not distort label, if so, performing
S204, if not, performing S216：Determine that the corresponding webpages to be detected of URL to be detected are tampered.
S204：Read the raw page data length included in the detection list item found.
S205：Obtain the corresponding web data length to be detected of URL to be detected.
As a kind of embodiment, two class servers can be set, one kind is publisher server, and one kind is backup services
Device：Publisher server is the server for providing ordinary user service, and the webpage which provides has the wind being tampered
Danger.Backup server may be considered safe server, and the risk being tampered is not present in the webpage stored in backup server,
Ordinary user cannot access backup server.It is after publisher server often issues new webpage, the new web storage is standby to this
In part server.
In this way, the network equipment (executive agent) can obtain webpage to be detected from publisher server, from backup server
Middle acquisition original web page.
For example, the network equipment can obtain webpage to be detected from publisher server, and then the network equipment determines this
Web data length to be detected.Alternatively, can be stored with the web data length of webpage to be detected in publisher server, network is set
It is standby that web data length to be detected can be directly obtained from publisher server.
S206：Judge the raw page data length included in the detection list item found and the webpage number to be detected obtained
It is whether identical according to length, if identical, S207 is performed, if it is different, performing S216：Determine that URL to be detected is corresponding to be detected
Webpage is tampered.
S207：Read the original sampling data included in the detection list item found.
As described above, in S201, it, will if the URL that the network equipment is read in access request is directed toward dynamic web page
Dynamic serial number in read URL is adjusted to default serial number, and the URL after adjustment is determined as URL to be detected.
For example, it is assumed that default serial number 1, then the network equipment or the other equipment being connected with the network equipment are deposited in advance
During storage detection list item, for multiple URL that dynamic web page includes, can only to the original web page that 1 corresponding URL of serial number is directed toward into
Row sampling, obtains original sampling data, which is added to detection list item.
S208：Webpage to be detected corresponding to URL to be detected samples, and obtains present sample data.
As described above, in S201, it, will if the URL that the network equipment is read in access request is directed toward dynamic web page
Dynamic serial number in read URL is adjusted to default serial number, and the URL after adjustment is determined as URL to be detected.And in S207
The original sampling data that the network equipment is read also is the sampled data of the corresponding original web pages of URL after adjustment.
Corresponding, also webpage to be detected corresponding to the URL after adjustment samples the network equipment in S208, is worked as
Preceding sampled data.
Continue above-mentioned example, it is assumed that default serial number 1, then when prestoring URL and corresponding original sampling data, for
Multiple URL that dynamic web page includes only sample 1 corresponding URL of the serial number original web pages being directed toward, obtain crude sampling number
According to.
Correspondingly, the network equipment only samples 1 corresponding URL of the serial number webpages to be detected being directed toward in S208, obtain
To present sample data.In this way, original sampling data is identical for the dynamic serial number in corresponding URL with present sample data
's.
S209：Judge whether acquired original sampling data and the present sample data are identical, if identical, perform
S217：Determine that the corresponding webpages to be detected of URL to be detected are not tampered with, if it is different, performing S216：Determine URL pairs to be detected
The webpage to be detected answered is tampered.
If not finding the detection list item comprising URL to be detected in S202, S210-S215 is performed.
S210：The corresponding original web pages of URL to be detected are obtained from backup server, determine that the raw page data is long
Degree.
S211：Obtain the corresponding web data length to be detected of URL to be detected.
As described above, the network equipment can obtain webpage to be detected from publisher server, then the network equipment determines this
Web data length to be detected.Alternatively, can be stored with the web data length of webpage to be detected in publisher server, network is set
It is standby that web data length to be detected can be directly obtained from publisher server.
S212：Judge determined by the raw page data length with acquisition web data length to be detected whether phase
Together, it is if identical, S213 is performed, if it is different, performing S216：Determine that the corresponding webpages to be detected of URL to be detected are tampered.
S213：The corresponding original web page of being obtained from backup server, URL to be detected is sampled, is obtained original
Sampled data.
S214：Webpage to be detected corresponding to URL to be detected samples, and obtains present sample data.
S215：Judge whether acquired original sampling data and the present sample data are identical, if identical, perform
S217：Determine that the corresponding webpages to be detected of URL to be detected are not tampered with, if it is different, performing S216：Determine URL pairs to be detected
The webpage to be detected answered is tampered.
In Fig. 2 embodiments, the network equipment can be updated the detection list item of storage according to predetermined period.For example,
It is primary to the detection entry updating of storage per hour.Alternatively, the original web page that can also be stored in backup server is updated
Afterwards, network equipment detection list item corresponding to the webpage being updated is updated.To detect list item update mode there are many, tool
Body does not limit.
Detection list item, which is updated, can include increasing or replacing.For example, for stored detection list item
For, the network equipment can be directed to the URL included in these list items, and it is corresponding original that these URL are searched in backup server
Webpage re-starts sampling to these original web pages, and the original sampling data that resampling is obtained is replaced in detection list item
Original sampling data.
And if having newly increased original web page in backup server, the network equipment samples newly-increased original web page,
By obtained original sampling data it is corresponding with the URL of newly-increased original web page be stored as one detection list item, this equivalent to increase
Detect list item.
A specific embodiment is introduced with reference to Fig. 2 and Fig. 3, as shown in figure 3, in the network equipment (executive agent)
Web application guard systems are provided with, also referred to as：Website application layer intrusion prevention system (English：Web Application
Firewall, referred to as：WAF systems), the embodiment of the present invention can be performed by WAF systems.
The network equipment is communicated to connect with publisher server (or claiming publication web server) and backup server.Publication clothes
Device be engaged in as to the server of ordinary user's offer service, the webpage which provides has the risk being tampered.Backup clothes
Business device may be considered safe server, and the risk being tampered, ordinary user is not present in the webpage stored in backup server
Backup server cannot be accessed.After publisher server often issues new webpage, the web storage of the new publication to the backup is taken
It is engaged in device.
In this way, the network equipment (executive agent) can obtain webpage to be detected from publisher server, the network equipment passes through
Private network can obtain original web page from backup server.
The network equipment can obtain anti-tamper web page listings, and multiple URL are included in the list.The network equipment is from backup services
The corresponding original web pages of this multiple URL are searched in device, using default sampling rule, the original web page found is sampled,
Obtain more parts of original sampling datas.If the original web page that URL is directed toward for dynamic web page, the network equipment can will be in URL it is dynamic
State serial number is adjusted to default serial number, it is assumed that default serial number 1, the URL after being adjusted, after then the network equipment is to adjustment
The original web page that URL is directed toward is sampled, and obtains original sampling data.
The network equipment obtains the corresponding raw page data length of this multiple URL, respectively by each URL and corresponding original
Sampled data, raw page data length are stored as a detection list item.It detects in list item also comprising the corresponding detection marks of URL
Note, which includes distorting label and does not distort two kinds of label, and under original state, snoop tag is not distort label, after
Continue if it is determined that webpage is tampered, then the snoop tag in the corresponding detection list item of the webpage is adjusted to distort mark by the network equipment
Note.
Detection list item can store in the network device, which can be divided into two classes, dynamic web page detection list item
List item is detected with static Web page.Wherein, the webpage that the URL included in dynamic web page detection list item is directed toward is dynamic web page, static
The webpage that the URL included in webpage detection list item is directed toward is static Web page.Classify to detection list item, list item can be improved and looked into
Look for efficiency.The structure of two classes detection list item can be identical.
The structure of detection list item can be divided into three-level, and first order list item is properly termed as file extension list item.File extent
Name list item can be a structure of arrays extFile_Array [], and the structure of each single item element can be in array：
| Web file-name extension names | ListPtr |
Wherein, " web file extensions " column storage file extension name, such as .htm.；" ListPtr " column is one
Pointer, the pointer are directed toward second level list item.
Second level list item is properly termed as alphabetical list item, and alphabetical list item can be a structure of arrays letter_hash_
Array [], array index can be the ASCII character of the first letter of file extension, the knot of each single item element in the array
Structure can be：
| Array index corresponds to letter | ClPtr |
Wherein, " array index corresponds to letter " column storage is the corresponding letter of array index ASCII character.Such as " a "
ASCII character is 65, then in letter list item letter_hash_array [65], " array index corresponds to letter " column storage is
Alphabetical ' a '
ClPtr：For a pointer, which is directed toward third level list item.
Third level list item is properly termed as matching list item, and matching list item can be a structure of arrays match_Array [], should
The structure of each single item element can be in array：
Wherein, the URL matched in list item can be opposite URL.For example, URL general formats are：“http://
xxx.xxx.com/xxx/xxx/xxx.yyyParameter list "；URL in matching list item can not include " http://
Xxx.xxx.com/ " only includes " xxx/xxx/xxx.yyyParameter list ".
Raw_strList represents the corresponding original sampling datas of URL, and raw_page_len represents the corresponding original nets of URL
Page data length.Sampling interval value and sampling length belong to the content in the sampling rule of setting.For example, it is assumed that sampling
Spacing value is 10, then it represents that is sampled at interval of 10 bytes, sampling length 3, then it represents that 3 words are read in primary sampling
Section.
MatchTime can represent the interval duration being updated to the detection list item.Snoop tag includes distorting label
And two kinds of label is not distorted, it can be change_state==1 to distort label, and it can be change_state not distort label
==0.
As shown in figure 3, user can be with accessing network equipment by used terminal.
Assuming that the network equipment receives the access request of user terminal transmission, the URL carried in the access request is usurped to be anti-
Change the URL in web page listings.In this case, the network equipment starts WAF systems.If the URL is the URL of static Web page,
The network equipment directly using the URL as URL to be detected, searches the detection list item for including URL to be detected in static instrumentation list item.
As described above, the URL in matching list item is opposite URL.Therefore, the URL in read access request, extraction should
A part in URL, that is, only include " xxx/xxx/xxx.yyyA part for parameter list " is as URL to be detected.
If URL to be detected be dynamic web page URL, the network equipment by the URL to be detected "" behind id value tune
Whole is default serial number 1, and using the URL after adjustment as URL to be detected, URL to be detected is searched in dynamic instrumentation list item.
The network equipment reads snoop tag in the detection list item found.If snoop tag is change_state
==1, then the network equipment can directly determine that the corresponding webpages to be detected of URL to be detected are tampered.In this case, network is set
It is standby that the corresponding original web pages of URL to be detected can be obtained from backup server, which is fed back into user.
If snoop tag is change_state==0, the network equipment continues to read in the detection list item found
Raw page data length.The corresponding webpages to be detected of URL to be detected are obtained from publisher server, and determine that this is to be detected
Web data length.
The network equipment judges whether the raw page data length and the web data length to be detected are identical.If no
Together, then it can determine that the corresponding webpages to be detected of URL to be detected are tampered.In this case, the network equipment can take from backup
The corresponding original web pages of URL to be detected are obtained in business device, which is fed back into user.If raw page data length
Identical with web data length to be detected, then using above-mentioned sampling rule, the network equipment is treated to what is obtained from publisher server
Detection webpage is sampled.
As described above, if the URL that is carried in access request is directed toward dynamic web page, the network equipment is by the dynamic in the URL
Serial number is adjusted to default serial number 1, the URL after being adjusted, using the URL after adjustment as URL to be detected.Therefore, network here
Equipment samples the webpages to be detected being directed toward of the URL after adjustment, obtains present sample data.
The network equipment continue read find detection list item in original sampling data, judge the original sampling data with
Whether present sample data are identical.If identical, the network equipment determines that the corresponding webpages to be detected of URL to be detected are not usurped
Change, the webpage to be detected obtained from publisher server is fed back into user.If it is different, then the network equipment determine it is to be detected
The corresponding webpages to be detected of URL are tampered, and the original web page obtained from backup server is fed back to user.
And if the network equipment does not find the detection list item comprising URL to be detected, the network equipment is from backup server
The corresponding original web pages of URL to be detected are obtained, determine the raw page data length.The network equipment is obtained from publisher server
The corresponding webpage to be detected of URL to be detected, and determine the web data length to be detected.
The network equipment judges whether the raw page data length and the web data length to be detected are identical.It is if original
Web data length is different from web data length to be detected, then the network equipment can determine that URL to be detected is corresponding to be detected
Webpage is tampered.In this case, the original web page obtained from backup server can be fed back to user by the network equipment.Such as
Fruit raw page data length is identical with web data length to be detected, then the network equipment is using above-mentioned sampling rule, to from hair
The webpage to be detected obtained in cloth server is sampled.
As described above, if the URL that is carried in access request is directed toward dynamic web page, the network equipment is by the dynamic in the URL
Serial number is adjusted to default serial number 1, the URL after being adjusted, using the URL after adjustment as URL to be detected.Therefore, network here
Equipment samples the webpages to be detected being directed toward of the URL after adjustment, obtains present sample data.
The network equipment samples the original web page obtained from backup server using above-mentioned sampling rule.As above
Described, if the URL carried in access request is directed toward dynamic web page, the dynamic serial number in the URL is adjusted to pre- by the network equipment
If serial number 1, the URL after being adjusted, using the URL after adjustment as URL to be detected.Therefore after the network equipment is to adjustment here
The original web page that URL is directed toward is sampled, and obtains original sampling data.
The network equipment judges whether the original sampling data is identical with present sample data.If identical, the network equipment
It determines that the corresponding webpages to be detected of URL to be detected are not tampered with, the webpage to be detected obtained from publisher server is fed back to
User.If it is different, then the network equipment determines that the corresponding webpages to be detected of URL to be detected are tampered, it will be from backup server
The original web page of acquisition feeds back to user.
Corresponding with above method embodiment, the embodiment of the present invention also provides a kind of webpage detection device, as shown in figure 4,
Including：
First determining module 401, for determining the mark of webpage to be detected；
Acquisition module 402, in pre-stored original sampling data, obtaining the corresponding crude sampling of the mark
Data；
First sampling module 403 for being sampled to the webpage to be detected, obtains present sample data；
Judgment module 404, for judging whether acquired original sampling data and the present sample data are identical；Such as
Fruit is identical, triggers the second determining module,
Second determining module 405, for determining that webpage to be detected is not tampered with.
As a kind of embodiment, the first determining module 401 specifically can be used for：
The access request that user terminal is sent is received, the uniform resource position mark URL carried in the access request is true
It is set to the mark of webpage to be detected；
Alternatively, every preset time period, the URL of each webpage of storage is determined as net to be detected successively according to preset order
The mark of page.
As a kind of embodiment, acquisition module 402 specifically can be used for：
In pre-stored raw page data length, the corresponding raw page data length of the mark is obtained；
Obtain the corresponding web data length to be detected of the mark；
Judge whether acquired raw page data length and the web data length to be detected are identical；
If identical, in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
As a kind of embodiment, acquisition module 402 specifically can be used for：
In pre-stored detection list item, the detection list item for including the mark is searched；
If found, the original sampling data included in the detection list item found is read；
If do not found, the corresponding original web page of the mark is obtained from backup server, to the original web page
It is sampled, obtains original sampling data.
As a kind of embodiment, the first determining module 401 specifically can be used for：Read the access that user terminal is sent
The URL carried in request；If read URL is directed toward dynamic web page, the dynamic serial number in read URL is adjusted to pre-
If serial number, the URL after adjustment is determined as URL to be detected；
Acquisition module 402, specifically can be used for：In pre-stored original sampling data, the URL to be detected is obtained
Corresponding original sampling data；
First sampling module 403, specifically can be used for：The corresponding webpages to be detected of the URL to be detected are sampled,
Obtain present sample data.
As a kind of embodiment, acquisition module 402 specifically can be used for：
In the mark of pre-stored webpage and in the corresponding snoop tag of the mark, obtaining the webpage to be detected
The corresponding snoop tag of mark；Judge whether acquired snoop tag is not distort label；If it is not distorting label,
In pre-stored original sampling data, the corresponding original sampling data of mark of the webpage to be detected is obtained；
Described device can also include：
Module (not shown) is adjusted, in the acquired original sampling data of judgement and the present sample data
In the case of difference, the corresponding snoop tag of mark of the webpage to be detected is adjusted to distort label.
As a kind of embodiment, described device can also include：
Feedback module (not shown), in the acquired original sampling data of judgement and the present sample data
In the case of difference, obtained and the corresponding original web page of the mark from backup server；The original is sent to user terminal
Beginning webpage.
Using embodiment illustrated in fig. 4 of the present invention, in a first aspect, by original sampling data and present sample data in this programme
It is compared, compared in existing scheme, the full content of original web page and the full content of webpage to be detected is compared,
Reduce comparison to take, improve detection efficient；Second aspect, in this programme it is pre-stored be normal webpage hits
According to, and the full content of improper webpage, in this way, reducing the occupancy of storage resource.
The embodiment of the present invention additionally provides a kind of electronic equipment, as shown in figure 5, including processor 501, communication interface 502,
Memory 503 and communication bus 504, wherein, processor 501, communication interface 502, memory 503 is complete by communication bus 504
Into mutual communication,
Memory 503, for storing computer program；
Processor 501 during for performing the program stored on memory 503, realizes any of the above-described kind of webpage detection side
Method.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (English：Peripheral
Component Interconnect, referred to as：PCI) bus or expanding the industrial standard structure (English：Extended Industry
Standard Architecture, referred to as：EISA) bus etc..The communication bus can be divided into address bus, data/address bus, control
Bus processed etc..It for ease of representing, is only represented in figure with a thick line, it is not intended that an only bus or a type of total
Line.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory can include random access memory (English：Random Access Memory, referred to as：RAM), also may be used
To include nonvolatile memory (English：Non-Volatile Memory, referred to as：NVM), a for example, at least disk storage
Device.Optionally, memory can also be at least one storage device for being located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (English：Central Processing
Unit, referred to as：CPU), network processing unit (English：Network Processor, referred to as：NP) etc.；It can also be digital signal
Processor (English：Digital Signal Processing, referred to as：DSP), application-specific integrated circuit (English：Application
Specific Integrated Circuit, referred to as：ASIC), field programmable gate array (English：Field-
Programmable Gate Array, referred to as：FPGA) either other programmable logic device, discrete gate or transistor logic
Device, discrete hardware components.
The embodiment of the present invention also provides a kind of computer readable storage medium, the computer readable storage medium memory storage
There is computer program, the computer program realizes any of the above-described kind of webpage detection method when being executed by processor.
It should be noted that herein, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any this practical relationship or sequence.Moreover, term " comprising ", "comprising" or its any other variant are intended to
Non-exclusive inclusion, so that process, method, article or equipment including a series of elements not only will including those
Element, but also including other elements that are not explicitly listed or further include as this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
Also there are other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is described using relevant mode, identical similar portion between each embodiment
Point just to refer each other, and the highlights of each of the examples are difference from other examples.Especially for Fig. 4 institutes
Webpage detection device embodiment, electronic equipment embodiment shown in fig. 5 and the above computer readable storage medium storing program for executing shown is implemented
For example, since it is substantially similar to the webpage detection method embodiment shown in Fig. 1-3, so description is fairly simple, it is related
Part illustrates referring to the part of the webpage detection method embodiment shown in Fig. 1-3.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the scope of the present invention.It is all
Any modification, equivalent replacement, improvement and so within the spirit and principles in the present invention, are all contained in protection scope of the present invention
It is interior.
Claims (14)
1. a kind of webpage detection method, which is characterized in that the method includes：
Determine the mark of webpage to be detected；
In pre-stored original sampling data, the corresponding original sampling data of the mark is obtained；
The webpage to be detected is sampled, obtains present sample data；
Judge whether acquired original sampling data and the present sample data are identical；
If the original sampling data is identical with the present sample data, determine that the webpage to be detected is not tampered with.
2. according to the method described in claim 1, it is characterized in that, it is described determine webpage to be detected mark, including：
The access request that user terminal is sent is received, the uniform resource position mark URL carried in the access request is determined as
The mark of webpage to be detected；
Alternatively, every preset time period, the URL of each webpage of storage is determined as webpage to be detected successively according to preset order
Mark.
3. according to the method described in claim 1, it is characterized in that, described in pre-stored original sampling data, acquisition
It is described to identify corresponding original sampling data, including：
In pre-stored raw page data length, the corresponding raw page data length of the mark is obtained；
Obtain the corresponding web data length to be detected of the mark；
Judge whether acquired raw page data length and the web data length to be detected are identical；
If identical, in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
4. the method according to claim 1 or 3, which is characterized in that it is described in pre-stored original sampling data, it obtains
The corresponding original sampling data of the mark is taken, including：
In pre-stored detection list item, the detection list item for including the mark is searched；
If found, the original sampling data included in the detection list item found is read；
If do not found, the corresponding original web page of the mark is obtained from backup server, the original web page is carried out
Sampling, obtains original sampling data.
5. according to the method described in claim 1, it is characterized in that, it is described determine webpage to be detected mark, including：
Read the URL carried in the access request that user terminal is sent；
If read URL is directed toward dynamic web page, the dynamic serial number in read URL is adjusted to default serial number, will be adjusted
URL after whole is determined as URL to be detected；
It is described to obtain the corresponding original sampling data of the mark in pre-stored original sampling data, including：
In pre-stored original sampling data, the corresponding original sampling datas of the URL to be detected are obtained；
The webpage to be detected is sampled, obtains present sample data, including：
The corresponding webpages to be detected of the URL to be detected are sampled, obtain present sample data.
6. the method according to claim 1 or 3, which is characterized in that it is described in pre-stored original sampling data, it obtains
The corresponding original sampling data of the mark is taken, including：
In the mark of pre-stored webpage and in the corresponding snoop tag of the mark, obtaining the mark of the webpage to be detected
Know corresponding snoop tag；
Judge whether acquired snoop tag is not distort label；
If it is label is not distorted, in pre-stored original sampling data, the mark for obtaining the webpage to be detected corresponds to
Original sampling data；
The method further includes：
In the case where the acquired original sampling data of judgement is with the present sample data difference, by the webpage to be detected
The corresponding snoop tag of mark be adjusted to distort label.
7. the method according to claim 1 or 4, which is characterized in that the method further includes：
If the original sampling data is different from the present sample data, obtained and the mark from backup server
Corresponding original web page；
The original web page is sent to user terminal.
8. a kind of webpage detection device, which is characterized in that including：
First determining module, for determining the mark of webpage to be detected；
Acquisition module, in pre-stored original sampling data, obtaining the corresponding original sampling data of the mark；
First sampling module for being sampled to the webpage to be detected, obtains present sample data；
Judgment module, for judging whether acquired original sampling data and the present sample data are identical；If identical,
The second determining module is triggered,
Second determining module, for determining that webpage to be detected is not tampered with.
9. device according to claim 8, which is characterized in that first determining module is specifically used for：
The access request that user terminal is sent is received, the uniform resource position mark URL carried in the access request is determined as
The mark of webpage to be detected；
Alternatively, every preset time period, the URL of each webpage of storage is determined as webpage to be detected successively according to preset order
Mark.
10. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
In pre-stored raw page data length, the corresponding raw page data length of the mark is obtained；
Obtain the corresponding web data length to be detected of the mark；
Judge whether acquired raw page data length and the web data length to be detected are identical；
If identical, in pre-stored original sampling data, the corresponding original sampling data of the mark is obtained.
11. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
In pre-stored detection list item, the detection list item for including the mark is searched；
If found, the original sampling data included in the detection list item found is read；
If do not found, the corresponding original web page of the mark is obtained from backup server, the original web page is carried out
Sampling, obtains original sampling data.
12. device according to claim 8, which is characterized in that first determining module is specifically used for：Read user
The URL carried in the access request that terminal is sent；It, will be dynamic in read URL if read URL is directed toward dynamic web page
State serial number is adjusted to default serial number, and the URL after adjustment is determined as URL to be detected；
The acquisition module, is specifically used for：In pre-stored original sampling data, it is corresponding to obtain the URL to be detected
Original sampling data；
First sampling module, is specifically used for：The corresponding webpages to be detected of the URL to be detected are sampled, are worked as
Preceding sampled data.
13. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
In the mark of pre-stored webpage and in the corresponding snoop tag of the mark, obtaining the mark of the webpage to be detected
Know corresponding snoop tag；Judge whether acquired snoop tag is not distort label；If it is label is not distorted, advance
In the original sampling data of storage, the corresponding original sampling data of mark of the webpage to be detected is obtained；
Described device further includes：
Module is adjusted, it, will in the case of in the acquired original sampling data of judgement with the present sample data difference
The corresponding snoop tag of mark of the webpage to be detected is adjusted to distort label.
14. the device according to claim 8 or 11, which is characterized in that described device further includes：
Feedback module, in the case of in the acquired original sampling data of judgement with the present sample data difference, from
It is obtained and the corresponding original web page of the mark in backup server；The original web page is sent to user terminal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711278421.0A CN108171082B (en) | 2017-12-06 | 2017-12-06 | Webpage detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711278421.0A CN108171082B (en) | 2017-12-06 | 2017-12-06 | Webpage detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108171082A true CN108171082A (en) | 2018-06-15 |
| CN108171082B CN108171082B (en) | 2021-04-30 |
Family
ID=62525426
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711278421.0A Active CN108171082B (en) | 2017-12-06 | 2017-12-06 | Webpage detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108171082B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113348655A (en) * | 2019-04-11 | 2021-09-03 | 深圳市欢太科技有限公司 | Anti-hijacking method and device for browser, electronic equipment and storage medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6029245A (en) * | 1997-03-25 | 2000-02-22 | International Business Machines Corporation | Dynamic assignment of security parameters to web pages |
| CN101350043A (en) * | 2007-07-17 | 2009-01-21 | 华为技术有限公司 | Method and apparatus for detecting consistency of digital content |
| CN102111267A (en) * | 2009-12-28 | 2011-06-29 | 北京安码科技有限公司 | Website safety protection method based on digital signature and system adopting same |
| CN102624713A (en) * | 2012-02-29 | 2012-08-01 | 深信服网络科技（深圳）有限公司 | Website tampering identification method and website tampering identification device |
| CN102710652A (en) * | 2012-06-12 | 2012-10-03 | 北京星网锐捷网络技术有限公司 | Web application intrusion prevention method and device as well as network equipment and network system |
| CN103685307A (en) * | 2013-12-25 | 2014-03-26 | 北京奇虎科技有限公司 | Method, system, client and server for detecting phishing fraud webpage based on feature library |
| CN103716315A (en) * | 2013-12-24 | 2014-04-09 | 上海天存信息技术有限公司 | Method and device for detecting web page tampering |
| CN103902889A (en) * | 2012-12-26 | 2014-07-02 | 腾讯科技（深圳）有限公司 | Malicious message cloud detection method and server |
| CN104766014A (en) * | 2015-04-30 | 2015-07-08 | 安一恒通（北京）科技有限公司 | Method and system used for detecting malicious website |
| CN106953874A (en) * | 2017-04-21 | 2017-07-14 | 深圳市科力锐科技有限公司 | Website falsification-proof method and device |
-
2017
- 2017-12-06 CN CN201711278421.0A patent/CN108171082B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6029245A (en) * | 1997-03-25 | 2000-02-22 | International Business Machines Corporation | Dynamic assignment of security parameters to web pages |
| CN101350043A (en) * | 2007-07-17 | 2009-01-21 | 华为技术有限公司 | Method and apparatus for detecting consistency of digital content |
| CN102111267A (en) * | 2009-12-28 | 2011-06-29 | 北京安码科技有限公司 | Website safety protection method based on digital signature and system adopting same |
| CN102624713A (en) * | 2012-02-29 | 2012-08-01 | 深信服网络科技（深圳）有限公司 | Website tampering identification method and website tampering identification device |
| CN102710652A (en) * | 2012-06-12 | 2012-10-03 | 北京星网锐捷网络技术有限公司 | Web application intrusion prevention method and device as well as network equipment and network system |
| CN103902889A (en) * | 2012-12-26 | 2014-07-02 | 腾讯科技（深圳）有限公司 | Malicious message cloud detection method and server |
| CN103716315A (en) * | 2013-12-24 | 2014-04-09 | 上海天存信息技术有限公司 | Method and device for detecting web page tampering |
| CN103685307A (en) * | 2013-12-25 | 2014-03-26 | 北京奇虎科技有限公司 | Method, system, client and server for detecting phishing fraud webpage based on feature library |
| CN104766014A (en) * | 2015-04-30 | 2015-07-08 | 安一恒通（北京）科技有限公司 | Method and system used for detecting malicious website |
| CN106953874A (en) * | 2017-04-21 | 2017-07-14 | 深圳市科力锐科技有限公司 | Website falsification-proof method and device |
Non-Patent Citations (1)
| Title |
|---|
| 岳涛: "基于多特征的恶意网页检测研究", 《中国优秀硕士学位论文全文数据库 信息科技辑》 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113348655A (en) * | 2019-04-11 | 2021-09-03 | 深圳市欢太科技有限公司 | Anti-hijacking method and device for browser, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108171082B (en) | 2021-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9954886B2 (en) | Method and apparatus for detecting website security | |
| US9883002B2 (en) | Method and system for accessing website | |
| CN108304410B (en) | Method and device for detecting abnormal access page and data analysis method | |
| US6910077B2 (en) | System and method for identifying cloaked web servers | |
| CN102957664B (en) | A kind of method and device identifying fishing website | |
| CN103237094B (en) | A kind of method and device identifying user | |
| CN107239701B (en) | Method and device for identifying malicious website | |
| CN102833258A (en) | Website access method and system | |
| CN110572390A (en) | Method, device, computer equipment and storage medium for detecting domain name hijacking | |
| GB2555801A (en) | Identifying fraudulent and malicious websites, domain and subdomain names | |
| CN109688205B (en) | Webpage resource interception method and device | |
| CN105631340B (en) | A kind of method and device of XSS Hole Detection | |
| CN110120971B (en) | Gray scale publishing method and device and electronic equipment | |
| CN104065736B (en) | A kind of URL reorientation methods, apparatus and system | |
| US20210383059A1 (en) | Attribution Of Link Selection By A User | |
| US11423099B2 (en) | Classification apparatus, classification method, and classification program | |
| CN103618742A (en) | Method and system for acquiring sub domain names and webmaster permission verification method | |
| CN108171082A (en) | A kind of webpage detection method and device | |
| KR101803225B1 (en) | System and Method for detecting malicious websites at high speed based multi-server, multi-docker | |
| US20170201532A1 (en) | Black market collection method for tracing distributors of mobile malware | |
| CN108460116B (en) | Search method, search device, computer equipment, storage medium and search system | |
| CN102917053A (en) | Method, device and system for judging uniform resource locator rewriting of webpage | |
| CN114629875A (en) | Active detection domain name brand protection method and device | |
| CN108573155B (en) | Method and device for detecting vulnerability influence range, electronic equipment and storage medium | |
| CN104239455B (en) | The acquisition methods and device of a kind of search result |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |