CN112528115A - Website monitoring method and device - Google Patents
Website monitoring method and device Download PDFInfo
- Publication number
- CN112528115A CN112528115A CN201910877851.7A CN201910877851A CN112528115A CN 112528115 A CN112528115 A CN 112528115A CN 201910877851 A CN201910877851 A CN 201910877851A CN 112528115 A CN112528115 A CN 112528115A
- Authority
- CN
- China
- Prior art keywords
- value
- hash value
- difference
- website
- screenshot
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Hardware Design (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a website monitoring method and device. The method comprises the following steps: determining a website to be monitored; acquiring a first webpage screenshot of a website to be monitored at a first moment and a second webpage screenshot of a website to be monitored at a second moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot and a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; calculating the difference value between the first average hash value and the second average hash value and the difference value between the first difference hash value and the second difference hash value; when the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. By adopting the scheme, the monitoring of the website can be accurately realized, the abnormal monitoring precision is improved, the bandwidth resource is saved, the implementation mode is simple and easy, the cost is low, and the method and the device are suitable for large-scale application and implementation.
Description
Technical Field
The invention relates to the technical field of safety, in particular to a website monitoring method and device.
Background
With the continuous development of science and technology and society, the appearance of various websites greatly facilitates the work and life of people. However, attacks directed to websites are currently occurring. In order to ensure the operation safety of the website, in the prior art, the website is usually monitored by using crawlers, soft probes, bypass mirrors, network management filtering and the like.
However, in the implementation process, the inventor finds that the following defects exist in the prior art: in the prior art, the website abnormity monitoring precision of website monitoring modes such as crawler, soft probe, bypass mirror image, network management filtering and the like is low, and the method has the defects of high cost and unsuitability for large-scale application and implementation; moreover, aiming at monitoring modes such as a crawler and a bypass mirror image, a large amount of network bandwidth resources can be consumed, the monitoring efficiency is further reduced, and the monitoring cost is improved.
Disclosure of Invention
In view of the above, the present invention is proposed to provide a website monitoring method and apparatus that overcomes or at least partially solves the above problems.
According to an aspect of the present invention, there is provided a website monitoring method, including:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value between the first average value hash value and the second average value hash value, and calculating the difference value between the first difference value hash value and the second difference value hash value;
if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
According to another aspect of the present invention, there is provided a website monitoring apparatus, including:
the determining module is suitable for determining a website to be monitored;
the acquisition module is suitable for acquiring a first webpage screenshot of the website to be monitored at a first moment and acquiring a second webpage screenshot of the website to be monitored at a second moment;
the hash calculation module is suitable for calculating a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
the difference value calculation module is suitable for calculating the difference value between the first average value hash value and the second average value hash value and calculating the difference value between the first difference value hash value and the second difference value hash value;
the abnormality determining module is suitable for determining that the website is normal if the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value; otherwise, determining that the website is abnormal.
According to yet another aspect of the present invention, there is provided a computing device comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is used for storing at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the website monitoring method.
According to still another aspect of the present invention, there is provided a computer storage medium having at least one executable instruction stored therein, where the executable instruction causes a processor to perform operations corresponding to the website monitoring method.
According to the website monitoring method and device provided by the invention, the website to be monitored is determined; acquiring a first webpage screenshot of a website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; respectively calculating the difference value between the first average value hash value and the second average value hash value, and calculating the difference value between the first difference value hash value and the second difference value hash value; if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the scheme, the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments are calculated, and whether the website is abnormal or not is comprehensively determined by comparing the difference value of the two types of hash values with the corresponding threshold value, so that the website is accurately monitored, the abnormal monitoring precision is improved, the bandwidth resource is saved, the implementation mode is simple and easy, the cost is low, and the method and the device are suitable for large-scale application and implementation.
The foregoing description is only an overview of the technical solutions of the present invention, and the embodiments of the present invention are described below in order to make the technical means of the present invention more clearly understood and to make the above and other objects, features, and advantages of the present invention more clearly understandable.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
FIG. 1 is a flow chart illustrating a website monitoring method according to an embodiment of the invention;
FIG. 2 is a flow chart illustrating a website monitoring method according to another embodiment of the invention;
FIG. 3 is a schematic structural diagram of a website monitoring device according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
Example one
Fig. 1 shows a flowchart of a website monitoring method according to an embodiment of the present invention, which is applied in a device with computing capability, for example, the method may be executed as an application program in a terminal, as a plug-in a website, on a server side, or the like.
As shown in fig. 1, the method comprises the steps of:
step S110, determining a website to be monitored.
In a specific implementation process, a corresponding website information input entry can be provided for a user, and the user can input website information to be monitored through the website information input entry. The website information specifically refers to website address information of a website.
Step S120, a first web screenshot of the website to be monitored at a first time is obtained, and a first mean hash value and a first difference hash value corresponding to the first web screenshot are calculated.
After determining the website to be monitored, the web page screenshots of the website to be monitored at different times can be obtained. Optionally, in a specific implementation process, a corresponding web page may be opened according to website information of a website to be detected, and a web screenshot corresponding to the website of the website to be detected is periodically intercepted according to a preset interception period, where the acquired web screenshot may reflect a web page display condition of the website to be monitored at different times.
The first time in this embodiment may be a historical time earlier than the current time, and the webpage image corresponding to the website of the website to be monitored captured at the first time is the first webpage screenshot at the first time.
Further, based on the obtained first webpage screenshot, a first mean hash value and a first difference hash value corresponding to the first webpage screenshot are calculated. It should be understood by those skilled in the art that, in the present embodiment, the mean hash algorithm and the difference hash algorithm are respectively adopted, and the hash value is calculated twice for the same screenshot, so as to obtain the mean hash value and the difference hash value for the same screenshot. In this step, a mean hash value obtained by performing a hash operation on the first web screenshot by using a mean hash algorithm is a first mean hash value, and a difference hash value obtained by performing a hash operation on the first web screenshot by using a difference hash algorithm is a first difference hash value.
Optionally, in order to further improve the calculation accuracy and calculation efficiency of the first mean hash value and the first difference hash value, in this embodiment, after the first web screenshot is obtained, the first web screenshot is further preprocessed, and the first mean hash value and the first difference hash value corresponding to the preprocessed first web screenshot are calculated. In this embodiment, a specific pretreatment method is not limited, and if the pretreatment method includes: and (3) screenshot size normalization processing, color simplification processing and the like. For example, after the first screenshot is obtained, in order to quickly remove the high frequency and related detail information and only keep the structural shading part, the size of the obtained first screenshot may be reduced (for example, the size of the first screenshot may be reduced to 8 × 8), so that the difference caused by the difference in the screenshot size and the ratio can be further reduced. After the first webpage screenshot is reduced in size, a color reduction process may be performed on the reduced first webpage screenshot, for example, the first webpage screenshot is converted into a picture only including a preset level (e.g., 64 levels) of gray scale, so that the reduced first webpage screenshot includes only a predetermined number of colors.
Further optionally, in the process of calculating the first mean hash value and the first difference hash value corresponding to the first web screenshot, the following method may be adopted:
in the process of calculating the first average hash value, the gray average value of the first webpage screenshot can be calculated first, the size relationship between each pixel in the first webpage screenshot and the gray average value of the first webpage screenshot is determined respectively, and the first average hash value corresponding to the first webpage screenshot is generated according to the size relationship. For example, after the first screenshot is preprocessed, the first screenshot is simplified to 8 × 8 (64 pixels in total) pictures containing 64 levels of gray levels, the average gray level of the 64 pixels is calculated first, and the size relationship between the 64 pixels and the average gray level is determined respectively, wherein when the gray level of a pixel is greater than or equal to the average gray level, the pixel is determined to correspond to 1; otherwise, it is determined that the pixel corresponds to 0. Thus, the result of combining "1" or "0" corresponding to the 64 pixels is the first mean hash value.
In the calculation process of the first difference hash value, the difference of the gray values of two adjacent pixels in the first webpage screenshot can be calculated first, and finally the first difference hash value corresponding to the first webpage screenshot is generated according to the difference calculation result. For example, after the first screenshot is preprocessed, the first screenshot is simplified into 8 × 8 (64 pixels in total) pictures containing 64 levels of gray scale, a difference value of the gray scale values of every two adjacent pixels in the 64 pixels is calculated, and if the difference value is positive, the difference value is marked as 1; otherwise, it is noted as 0. Thereby finally generating a first difference hash value from the combination of the plurality of "1" s or "0" s.
Step S130, a second web screenshot of the website to be monitored at a second time is obtained, and a second mean hash value and a second difference hash value corresponding to the second web screenshot are calculated.
In this embodiment, the second time may be later than the first time, for example, the second time may be a current time. And the webpage image corresponding to the website address of the website to be monitored, which is captured at the second moment, is the second webpage screenshot at the second moment.
Further, based on the obtained second webpage screenshot, a second mean hash value and a second difference hash value corresponding to the second webpage screenshot are calculated. In this step, the mean hash value obtained by the hash operation performed on the second web screenshot by the mean hash algorithm is the second mean hash value, and the difference hash value obtained by the hash operation performed on the second web screenshot by the difference hash algorithm is the second difference hash value.
Optionally, in order to further improve the calculation accuracy and calculation efficiency of the second mean hash value and the second difference hash value, in this embodiment, after the second web screenshot is obtained, the second web screenshot is further preprocessed, and the second mean hash value and the second difference hash value corresponding to the preprocessed second web screenshot are calculated. In this embodiment, a specific pretreatment method is not limited, and if the pretreatment method includes: and (3) screenshot size normalization processing, color simplification processing and the like. The specific manner of the preprocessing is described with reference to the corresponding part in step S120, and this step is not described herein again.
Further optionally, in the process of calculating the second mean hash value and the second difference hash value corresponding to the second web screenshot, the following method may be adopted:
in the process of calculating the second average hash value, the grayscale average value of the second webpage screenshot can be calculated first, the size relationship between each pixel in the second webpage screenshot and the grayscale average value of the second webpage screenshot is determined respectively, and the first average hash value corresponding to the second webpage screenshot is generated according to the size relationship. For example, after preprocessing the second screenshot, the second screenshot is simplified to 8 × 8 (64 pixels in total) of pictures containing 64 levels of gray levels, and then the average gray level of the 64 pixels is calculated first, and the size relationship between the 64 pixels and the average gray level is determined, wherein when the gray level of a pixel is greater than or equal to the average gray level, the pixel is determined to correspond to 1; otherwise, it is determined that the pixel corresponds to 0. Thus, the result of the combination of "1" or "0" corresponding to the 64 pixels is the second mean hash value.
In the process of calculating the second difference hash value, the difference between the gray values of two adjacent pixels in the second webpage screenshot can be calculated first, and finally the first difference hash value corresponding to the second webpage screenshot is generated according to the difference calculation result. For example, after the second screenshot is preprocessed, the second screenshot is simplified into 8 × 8 (64 pixels in total) pictures containing 64 levels of gray scale, a difference value of the gray scale values of every two adjacent pixels in the 64 pixels is calculated, and if the difference value is positive, the difference value is marked as 1; otherwise, it is noted as 0. Thereby finally generating a second difference hash value from the combination of the plurality of "1" s or "0" s.
In this embodiment, the execution sequence of the steps S120 and S130 is not limited, for example, the step S130 may be further executed after the step S120 is executed; or, after a first webpage screenshot of the website to be monitored at a first moment and a second webpage screenshot of the website to be monitored at a second moment are obtained, a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot are calculated and calculated in a unified manner, and a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot are calculated and calculated.
Step S140, respectively calculating a difference between the first mean hash value and the second mean hash value, and calculating a difference between the first difference hash value and the second difference hash value.
After a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot and a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot are obtained, the difference value of the same type hash values of the first webpage screenshot and the second webpage screenshot is calculated respectively. Namely, the difference between the first average hash value and the second average hash value is calculated, and the difference between the first difference hash value and the second difference hash value is calculated. The difference between the first mean hash value and the second mean hash value may be from the first mean hash value to the second mean hash value, or from the second mean hash value to the first mean hash value, or from the second mean hash value to the absolute value of the first mean hash value, or the like; similarly, the difference between the first difference hash value and the second difference hash value may be from the first difference hash value to the second difference hash value, or from the second difference hash value to the first difference hash value, or from the second difference hash value to the absolute value of the first difference hash value, and so on.
Step S150, if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In this embodiment, corresponding determination thresholds are set for the mean hash value and the difference hash value, respectively, where the mean hash value corresponds to the first threshold, and the difference hash value corresponds to the second threshold. Optionally, when the first threshold is 18, the second threshold is 30; when the first threshold value is 30, the second threshold value is 18. When the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value, the website is indicated that the webpage is not maliciously tampered at the first moment and the second moment, and therefore the website is determined to be normal; otherwise, the information tampering of the website is determined to be indicated, and therefore the abnormality of the website is determined. The implementation adopts a multi-dimensional judgment mode of the difference value of the mean hash value and the difference value of the difference hash value, so that misjudgment of a floating window (easily causing obvious change of the difference hash value) in a website and normal updating of a website fixing position (easily causing obvious change of the mean hash value) can be effectively avoided, and the accuracy of website monitoring is further improved.
Optionally, after determining that the website is abnormal, further generating corresponding warning information, and sending the warning information to a corresponding target user. In a specific implementation process, after a configuration user configures a website to be monitored, relevant information of the configuration user for a target user to which alarm information is sent can be further received, for example, a mailbox address, a telephone number, a social software account and the like of the target user configured by the configuration user can be received, so that after the website is determined to be abnormal, the alarm information can be sent to the target user in a mail sending mode, a short message sending mode, a telephone dialing mode, a social software information sending mode and the like, and the target user can quickly acquire the alarm information.
Further optionally, in order to consider both the website monitoring effect and the system resources, the embodiment may trigger the execution of the above steps according to a preset website monitoring frequency.
Therefore, in the embodiment, after the website to be monitored is determined, the first webpage screenshot of the website to be monitored at the first moment is further obtained, and the first mean hash value and the first difference hash value corresponding to the first webpage screenshot are calculated; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; further calculating the difference value between the first average hash value and the second average hash value, and calculating the difference value between the first difference hash value and the second difference hash value; if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. The method and the device for monitoring the website comprehensively determine whether the website is abnormal or not by calculating the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments and comparing the difference value of the two types of hash values with the corresponding threshold value, thereby accurately monitoring the website, effectively avoiding misjudgment of normal updating of a floating window and a website fixing position in the website, improving the abnormal monitoring precision, saving bandwidth resources, having simple and easy implementation mode and low cost, and being suitable for large-scale application and implementation.
Example two
Fig. 2 is a flowchart illustrating an embodiment of a website monitoring method according to another embodiment of the present invention, where the method is applied to a corresponding device with computing capability, such as an application program in a terminal, a plug-in a website, a server, and so on. The website monitoring method provided by this embodiment is specifically directed to further optimization of the method shown in fig. 1.
As shown in fig. 2, the method includes:
step S210, determining a website to be monitored.
Step S220, a first web page screenshot of the website to be monitored at a first time and a second web page screenshot of the website to be monitored at a second time are obtained, a first mean hash value and a first difference hash value corresponding to the first web page screenshot are calculated, and a second mean hash value and a second difference hash value corresponding to the second web page screenshot are calculated.
Step S230, respectively calculating a difference between the first mean hash value and the second mean hash value, and calculating a difference between the first difference hash value and the second difference hash value.
Step S240, determining whether: the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value; if so, determining that the website is normal; otherwise, step S250 is further performed.
In this embodiment, the specific execution process of steps S210 to S240 may refer to the description of the corresponding parts in the first embodiment, which is not described herein again.
In the embodiment, the accuracy of website monitoring in different scenes is further improved, and the scenes of frequently and largely updating website advertisements are further optimized for enterprise websites. Specifically, in the present embodiment, through steps S210 to S240, when it is determined that the difference between the first mean hash value and the second mean hash value is not satisfied at present and is smaller than the first threshold, and the difference between the first difference hash value and the second difference hash value is smaller than the second threshold, step S250 is further performed.
Step S250, extracting text information in a webpage corresponding to the website to be monitored.
In general, a malicious tampering method is to replace relevant text information displayed on a website with a malicious picture. In a specific implementation process, an image recognition algorithm based on the OpenCV architecture may be used to detect text information contained in a web page, and determine whether the web page is tampered according to the amount of text information.
Step S260, judging whether the data volume of the extracted text information is smaller than a preset data volume; if yes, determining that the website is abnormal; otherwise, the website is determined to be normal.
Specifically, when an image recognition algorithm based on an OpenCV framework is adopted to detect that a website page contains a large amount of character information, the website is determined to be normal; and if the image recognition algorithm based on the OpenCV framework is adopted to detect that the text information contained in the website page is too little, determining that the website is a suspected problem website, thereby determining that the website is abnormal, generating corresponding alarm information, and sending the corresponding alarm information to a corresponding target user.
Therefore, the method and the device can be used for comprehensively determining whether the website is abnormal or not by calculating the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments and comparing the difference value of the two types of hash values with the corresponding threshold value, thereby accurately monitoring the website, effectively avoiding misjudgment on normal updating of a floating window and a website fixing position in the website, improving the abnormal monitoring precision, saving bandwidth resources, having simple and feasible implementation mode and low cost, and being suitable for large-scale application and implementation; in addition, the method can be used for monitoring and protecting the attack mode of replacing the relevant text information displayed by the website with the malicious picture, so that the monitoring precision of the website in each scene is guaranteed.
EXAMPLE III
Fig. 3 is a schematic structural diagram illustrating a website monitoring apparatus according to an embodiment of the present invention. As shown in fig. 3, the apparatus includes: a determination module 31, an acquisition module 32, a hash calculation module 33, a difference calculation module 34, and an anomaly determination module 35.
A determination module 31 adapted to determine a website to be monitored;
the acquisition module 32 is adapted to acquire a first webpage screenshot of the website to be monitored at a first time and acquire a second webpage screenshot of the website to be monitored at a second time;
the hash calculation module 33 is adapted to calculate a first mean hash value and a first difference hash value corresponding to the first web screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
a difference calculation module 34 adapted to calculate a difference between the first mean hash value and the second mean hash value, and calculate a difference between the first difference hash value and the second difference hash value, respectively;
the anomaly determination module 35 is adapted to determine that the website is normal if a difference between the first mean hash value and the second mean hash value is smaller than a first threshold, and a difference between the first difference hash value and the second difference hash value is smaller than a second threshold; otherwise, determining that the website is abnormal.
Optionally, the hash calculation module is further adapted to: preprocessing the first webpage screenshot, and calculating a first average value hash value and a first difference value hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second average value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
Optionally, the preprocessing includes: a screen shot size normalization process and/or a color reduction process.
Optionally, the hash calculation module is further adapted to:
calculating the gray average value of the first webpage screenshot, respectively determining the size relationship between each pixel in the first webpage screenshot and the gray average value of the first webpage screenshot, and generating a first average hash value corresponding to the first webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
Optionally, the hash calculation module is further adapted to:
calculating the gray average value of the second webpage screenshot, respectively determining the size relationship between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average hash value corresponding to the second webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
Optionally, the apparatus further comprises: a text monitoring module (not shown in the figure) adapted to extract text information in a web page corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, the website is determined to be normal.
Optionally, the apparatus further comprises: an alarm generating module (not shown in the figure) adapted to generate corresponding alarm information after the website abnormality is determined;
and the sending module is suitable for sending the alarm information to a corresponding target user.
In this embodiment, the specific implementation process of each module may refer to the description of the corresponding part in the first embodiment and/or the second embodiment, which is not described herein again.
Therefore, in the embodiment, after the website to be monitored is determined, the first webpage screenshot of the website to be monitored at the first moment is further obtained, and the first mean hash value and the first difference hash value corresponding to the first webpage screenshot are calculated; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; further calculating the difference value between the first average hash value and the second average hash value, and calculating the difference value between the first difference hash value and the second difference hash value; if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. The method and the device for monitoring the website comprehensively determine whether the website is abnormal or not by calculating the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments and comparing the difference value of the two types of hash values with the corresponding threshold value, thereby accurately monitoring the website, effectively avoiding misjudgment of normal updating of a floating window and a website fixing position in the website, improving the abnormal monitoring precision, saving bandwidth resources, having simple and easy implementation mode and low cost, and being suitable for large-scale application and implementation.
Example four
The embodiment of the invention provides a nonvolatile computer storage medium, wherein at least one executable instruction is stored in the computer storage medium, and the computer executable instruction can execute the website monitoring method in any method embodiment.
The executable instructions may be specifically configured to cause the processor to:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value between the first average value hash value and the second average value hash value, and calculating the difference value between the first difference value hash value and the second difference value hash value;
if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In an alternative embodiment, the executable instructions may be specifically configured to cause the processor to:
preprocessing the first webpage screenshot, and calculating a first average value hash value and a first difference value hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second average value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
In an alternative embodiment, the pre-processing comprises: a screen shot size normalization process and/or a color reduction process.
In an alternative embodiment, the executable instructions may be specifically configured to cause the processor to:
calculating the gray average value of the first webpage screenshot, respectively determining the size relationship between each pixel in the first webpage screenshot and the gray average value of the first webpage screenshot, and generating a first average hash value corresponding to the first webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the executable instructions may be specifically configured to cause the processor to:
calculating the gray average value of the second webpage screenshot, respectively determining the size relationship between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average hash value corresponding to the second webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the executable instructions may be specifically configured to cause the processor to:
extracting character information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, the website is determined to be normal.
In an alternative embodiment, the executable instructions may be specifically configured to cause the processor to:
and generating corresponding alarm information after the abnormality of the website is determined, and sending the alarm information to a corresponding target user.
Therefore, in the embodiment, after the website to be monitored is determined, the first webpage screenshot of the website to be monitored at the first moment is further obtained, and the first mean hash value and the first difference hash value corresponding to the first webpage screenshot are calculated; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; further calculating the difference value between the first average hash value and the second average hash value, and calculating the difference value between the first difference hash value and the second difference hash value; if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. The method and the device for monitoring the website comprehensively determine whether the website is abnormal or not by calculating the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments and comparing the difference value of the two types of hash values with the corresponding threshold value, thereby accurately monitoring the website, effectively avoiding misjudgment of normal updating of a floating window and a website fixing position in the website, improving the abnormal monitoring precision, saving bandwidth resources, having simple and easy implementation mode and low cost, and being suitable for large-scale application and implementation.
EXAMPLE five
Fig. 4 is a schematic structural diagram of a computing device according to an embodiment of the present invention, and the specific embodiment of the present invention does not limit the specific implementation of the computing device.
As shown in fig. 4, the computing device may include: a processor (processor)402, a Communications Interface 404, a memory 406, and a Communications bus 408.
Wherein: the processor 402, communication interface 404, and memory 406 communicate with each other via a communication bus 408. A communication interface 404 for communicating with network elements of other devices, such as clients or other servers. The processor 402, configured to execute the program 410, may specifically perform the relevant steps in the foregoing embodiments of the website monitoring method.
In particular, program 410 may include program code comprising computer operating instructions.
The processor 402 may be a central processing unit CPU or an application Specific Integrated circuit asic or one or more Integrated circuits configured to implement embodiments of the present invention. The computing device includes one or more processors, which may be the same type of processor, such as one or more CPUs; or may be different types of processors such as one or more CPUs and one or more ASICs.
And a memory 406 for storing a program 410. Memory 406 may comprise high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
The program 410 may specifically be configured to cause the processor 402 to perform the following operations:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value between the first average value hash value and the second average value hash value, and calculating the difference value between the first difference value hash value and the second difference value hash value;
if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In an alternative embodiment, the program 410 may be specifically configured to cause the processor 402 to perform the following operations:
preprocessing the first webpage screenshot, and calculating a first average value hash value and a first difference value hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second average value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
In an alternative embodiment, the pre-processing comprises: a screen shot size normalization process and/or a color reduction process.
In an alternative embodiment, the program 410 may be specifically configured to cause the processor 402 to perform the following operations:
calculating the gray average value of the first webpage screenshot, respectively determining the size relationship between each pixel in the first webpage screenshot and the gray average value of the first webpage screenshot, and generating a first average hash value corresponding to the first webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the program 410 may be specifically configured to cause the processor 402 to perform the following operations:
calculating the gray average value of the second webpage screenshot, respectively determining the size relationship between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average hash value corresponding to the second webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the program 410 may be specifically configured to cause the processor 402 to perform the following operations:
extracting character information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, the website is determined to be normal.
In an alternative embodiment, the program 410 may be specifically configured to cause the processor 402 to perform the following operations:
and generating corresponding alarm information after the abnormality of the website is determined, and sending the alarm information to a corresponding target user.
Therefore, in the embodiment, after the website to be monitored is determined, the first webpage screenshot of the website to be monitored at the first moment is further obtained, and the first mean hash value and the first difference hash value corresponding to the first webpage screenshot are calculated; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot; further calculating the difference value between the first average hash value and the second average hash value, and calculating the difference value between the first difference hash value and the second difference hash value; if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. The method and the device for monitoring the website comprehensively determine whether the website is abnormal or not by calculating the difference value of the mean hash values and the difference value of the difference hash values of the page screenshots of the same website at different moments and comparing the difference value of the two types of hash values with the corresponding threshold value, thereby accurately monitoring the website, effectively avoiding misjudgment of normal updating of a floating window and a website fixing position in the website, improving the abnormal monitoring precision, saving bandwidth resources, having simple and easy implementation mode and low cost, and being suitable for large-scale application and implementation.
The algorithms or displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems may also be used with the teachings herein. The required structure for constructing such a system will be apparent from the description above. In addition, embodiments of the present invention are not directed to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any descriptions of specific languages are provided above to disclose the best mode of the invention.
In the description provided herein, numerous specific details are set forth. It is understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the invention and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that: that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.
Those skilled in the art will appreciate that the modules in the device in an embodiment may be adaptively changed and disposed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or elements of any method or apparatus so disclosed, may be combined in any combination, except combinations where at least some of such features and/or processes or elements are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Furthermore, those skilled in the art will appreciate that while some embodiments herein include some features included in other embodiments, rather than other features, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.
The various component embodiments of the invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or Digital Signal Processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components according to embodiments of the present invention. The present invention may also be embodied as apparatus or device programs (e.g., computer programs and computer program products) for performing a portion or all of the methods described herein. Such programs implementing the present invention may be stored on computer-readable media or may be in the form of one or more signals. Such a signal may be downloaded from an internet website or provided on a carrier signal or in any other form.
It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names. The steps in the above embodiments should not be construed as limiting the order of execution unless specified otherwise.
Claims (10)
1. A website monitoring method, comprising:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value between the first average value hash value and the second average value hash value, and calculating the difference value between the first difference value hash value and the second difference value hash value;
if the difference value between the first average hash value and the second average hash value is smaller than a first threshold value, and the difference value between the first difference hash value and the second difference hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
2. The method of claim 1, wherein calculating the first mean hash value and the first difference hash value corresponding to the first screenshot further comprises: preprocessing the first webpage screenshot, and calculating a first average value hash value and a first difference value hash value corresponding to the preprocessed first webpage screenshot;
the calculating a second mean hash value and a second difference hash value corresponding to the second web screenshot further includes: and preprocessing the second webpage screenshot, and calculating a second average value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
3. The method of claim 2, wherein the pre-processing comprises:
a screen shot size normalization process and/or a color reduction process.
4. The method of any of claims 1-3, wherein calculating the first mean hash value and the first difference hash value for the first screenshot further comprises:
calculating the gray average value of the first webpage screenshot, respectively determining the size relationship between each pixel in the first webpage screenshot and the gray average value of the first webpage screenshot, and generating a first average hash value corresponding to the first webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
5. The method of any of claims 1-3, wherein calculating the second mean hash value and the second difference hash value for the second web screenshot further comprises:
calculating the gray average value of the second webpage screenshot, respectively determining the size relationship between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average hash value corresponding to the second webpage screenshot according to the size relationship; and
and calculating the difference value of the gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
6. The method of claim 1, further comprising:
extracting character information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, the website is determined to be normal.
7. The method of any of claims 1-3, wherein after the determining the web site is anomalous, the method further comprises: and generating corresponding alarm information and sending the alarm information to a corresponding target user.
8. A website monitoring device, comprising:
the determining module is suitable for determining a website to be monitored;
the acquisition module is suitable for acquiring a first webpage screenshot of the website to be monitored at a first moment and acquiring a second webpage screenshot of the website to be monitored at a second moment;
the hash calculation module is suitable for calculating a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
the difference value calculation module is suitable for calculating the difference value between the first average value hash value and the second average value hash value and calculating the difference value between the first difference value hash value and the second difference value hash value;
the abnormality determining module is suitable for determining that the website is normal if the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value; otherwise, determining that the website is abnormal.
9. A computing device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is used for storing at least one executable instruction, and the executable instruction causes the processor to execute the operation corresponding to the website monitoring method according to any one of claims 1-7.
10. A computer storage medium having stored therein at least one executable instruction for causing a processor to perform operations corresponding to the website monitoring method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910877851.7A CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910877851.7A CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112528115A true CN112528115A (en) | 2021-03-19 |
| CN112528115B CN112528115B (en) | 2023-04-25 |
Family
ID=74974760
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910877851.7A Active CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112528115B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050132205A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Apparatus, methods and computer programs for identifying matching resources within a data processing network |
| EP3293661A1 (en) * | 2016-09-08 | 2018-03-14 | AO Kaspersky Lab | System and method for detecting anomalous elements of web pages |
| CN108446227A (en) * | 2018-03-12 | 2018-08-24 | 广东睿江云计算股份有限公司 | A kind of virtual machine browser compatibility test method based on selenium |
| CN108809943A (en) * | 2018-05-14 | 2018-11-13 | 苏州闻道网络科技股份有限公司 | Web publishing method and its device |
| CN108846422A (en) * | 2018-05-28 | 2018-11-20 | 中国人民公安大学 | Account relating method and system across social networks |
| CN109325348A (en) * | 2018-09-13 | 2019-02-12 | 江苏通付盾信息安全技术有限公司 | Application safe analysis method, calculates equipment and computer storage medium at device |
-
2019
- 2019-09-17 CN CN201910877851.7A patent/CN112528115B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050132205A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Apparatus, methods and computer programs for identifying matching resources within a data processing network |
| EP3293661A1 (en) * | 2016-09-08 | 2018-03-14 | AO Kaspersky Lab | System and method for detecting anomalous elements of web pages |
| CN108446227A (en) * | 2018-03-12 | 2018-08-24 | 广东睿江云计算股份有限公司 | A kind of virtual machine browser compatibility test method based on selenium |
| CN108809943A (en) * | 2018-05-14 | 2018-11-13 | 苏州闻道网络科技股份有限公司 | Web publishing method and its device |
| CN108846422A (en) * | 2018-05-28 | 2018-11-20 | 中国人民公安大学 | Account relating method and system across social networks |
| CN109325348A (en) * | 2018-09-13 | 2019-02-12 | 江苏通付盾信息安全技术有限公司 | Application safe analysis method, calculates equipment and computer storage medium at device |
Non-Patent Citations (1)
| Title |
|---|
| 杨柳静等: "应用交互式网络流模型的高速网络异常行为检测与控制" * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112528115B (en) | 2023-04-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111917740A (en) | Abnormal flow alarm log detection method, device, equipment and medium | |
| CN108491866B (en) | Pornographic picture identification method, electronic device and readable storage medium | |
| CN112949767B (en) | Sample image increment, image detection model training and image detection method | |
| CN108563930A (en) | A kind of method, apparatus, medium and the system of confidential document addition watermark | |
| CN103226688B (en) | The authentication method of the anti-tamper and anti-counterfeiting of a kind of Quick Response Code | |
| CN108809943B (en) | Website monitoring method and device | |
| CN113792791A (en) | Processing method and device for visual model | |
| CN116403083A (en) | Image processing method and device, electronic equipment and storage medium | |
| CN110913209B (en) | Camera shielding detection method and device, electronic equipment and monitoring system | |
| CN113643260A (en) | Method, apparatus, device, medium and product for detecting image quality | |
| CN112528115B (en) | Website monitoring method and device | |
| CN106708605B (en) | Method and device for detecting resource leakage | |
| CN115131315A (en) | Image change detection method, device, equipment and storage medium | |
| CN113628192A (en) | Image blur detection method, device, apparatus, storage medium, and program product | |
| US9898444B1 (en) | Image comparison for user interface testing | |
| CN114093006A (en) | Training method, device and equipment of living human face detection model and storage medium | |
| CN116939171B (en) | Power transmission line monitoring method, device and computer equipment | |
| CN113411332B (en) | CORS vulnerability detection method, device, equipment and medium | |
| CN113034337B (en) | Image detection method and related device | |
| CN115542100B (en) | Insulator fault detection method, device, equipment and medium | |
| CN113643257B (en) | Image noise detection method, device, equipment, storage medium and program product | |
| US10699381B2 (en) | Text enhancement using a binary image generated with a grid-based grayscale-conversion filter | |
| CN109166085B (en) | Image restoration method and device | |
| CN114511535A (en) | White screen detection method and device, electronic equipment, medium and product | |
| CN117169806A (en) | Method, device, equipment and medium for detecting display defect of broken code screen ammeter |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |