CN112507270A - Website tampering alarm method based on title escape in cloud protection and related device - Google Patents

Website tampering alarm method based on title escape in cloud protection and related device Download PDF

Info

Publication number
CN112507270A
CN112507270A CN202011444913.4A CN202011444913A CN112507270A CN 112507270 A CN112507270 A CN 112507270A CN 202011444913 A CN202011444913 A CN 202011444913A CN 112507270 A CN112507270 A CN 112507270A
Authority
CN
China
Prior art keywords
title
escape
website
alarm
current
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202011444913.4A
Other languages
Chinese (zh)
Inventor
蔡建科
范渊
杨勃
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
DBAPPSecurity Co Ltd
Hangzhou Dbappsecurity Technology Co Ltd
Original Assignee
Hangzhou Dbappsecurity Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Dbappsecurity Technology Co Ltd filed Critical Hangzhou Dbappsecurity Technology Co Ltd
Priority to CN202011444913.4A priority Critical patent/CN112507270A/en
Publication of CN112507270A publication Critical patent/CN112507270A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/95Retrieval from the web
    • G06F16/958Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/95Retrieval from the web
    • G06F16/951Indexing; Web crawling techniques

Abstract

The application discloses a website tampering warning method based on title escape in cloud protection, which comprises the following steps: when a target website responds to an access request, the cloud protection equipment records a title in response content of the target website to obtain a current title; judging whether the current title is the same as a pre-stored historical title or not; if not, recording the frequency according to the current title to obtain the title escape frequency; and performing alarm processing according to the title escape times and a preset alarm strategy. When the target website responds to the access request, the corresponding current title is recorded and judged with the recorded historical title so as to determine the problem of title escape and further perform alarm processing instead of detecting the webpage for alarm, thereby avoiding more influence on the website. The application also discloses a website tampering warning device based on the escape of the titles in the cloud protection, a server and a computer readable storage medium, and the beneficial effects are achieved.

Description

Website tampering alarm method based on title escape in cloud protection and related device
Technical Field
The application relates to the technical field of computers, in particular to a website tampering warning method, a website tampering warning device, a server and a computer readable storage medium based on title escape in cloud protection.
Background
With the continuous development of information technology, website technology in the internet is applied more and more, and the problem of webpage security is also paid more and more attention. The web page is tampered and damaged due to the attack, and meanwhile, certain social negative effects are caused. By 6 months in 2018, 27677 cumulative website tampering events occurred in 2018, including 576 government websites, as shown by the cnert data. From this, it can be seen that tamper resistance is a very important security technology in website technology.
In the related art, a web page detection program is generally adopted, and the integrity of the web page content is judged by comparing web page crawling codes of a website for 2 times, so that tampering is detected. However, the error rate, the false alarm rate and the missing report rate are very high due to various reasons such as network fluctuation, and the continuous crawling of the website may affect the normal operation of the website. The tamper-proof effect is low, and the performance of the webpage website is greatly influenced.
Therefore, how to reduce the influence of the web page tampering alarm on the normal operation of the website is a key issue that is focused on by those skilled in the art.
Disclosure of Invention
The application aims to provide a website tampering warning method, a website tampering warning device, a server and a computer readable storage medium based on title escape in cloud protection.
In order to solve the technical problem, the application provides a website tampering warning method based on title escape in cloud protection, which comprises the following steps:
when a target website responds to an access request, the cloud protection equipment records a title in response content of the target website to obtain a current title;
judging whether the current title is the same as a pre-stored historical title or not;
if not, recording the frequency according to the current title to obtain the title escape frequency;
and performing alarm processing according to the title escape times and a preset alarm strategy.
Optionally, the method further includes:
and carrying out strategy configuration according to the received escape threshold value to obtain the alarm strategy.
Optionally, the method further includes:
and when the current title is the same as the historical title, sending a title error-free message.
Optionally, performing alarm processing according to the number of title escapes and a preset alarm policy, including:
judging whether the title escape times are larger than an escape threshold of the alarm strategy;
and if so, sending an alarm message.
Optionally, the method further includes:
and when the current title is different from the pre-stored historical title, performing log recording on the current title.
The application also provides a website tampering warning device based on title escape in cloud protection, includes:
the title recording module is used for recording the title in the response content of the target website to obtain the current title when the target website responds to the access request;
the title judging module is used for judging whether the current title is the same as a pre-stored historical title or not;
the escape recording module is used for recording the frequency according to the current title to obtain the title escape frequency when the current title is different from the pre-stored historical title;
and the alarm processing module is used for carrying out alarm processing according to the title escape times and a preset alarm strategy.
Optionally, the method further includes:
and the strategy configuration module is used for carrying out strategy configuration according to the received escape threshold value to obtain the alarm strategy.
Optionally, the method further includes:
and the error-free judging module is used for sending a title error-free message when the current title is the same as the historical title.
The present application further provides a server, comprising:
a memory for storing a computer program;
and the processor is used for realizing the steps of the website tampering warning method when the computer program is executed.
The present application also provides a computer-readable storage medium having stored thereon a computer program which, when being executed by a processor, implements the steps of the website tampering warning method as described above.
The application provides a website tampering warning method based on title escape in cloud protection, which comprises the following steps: when a target website responds to an access request, the cloud protection equipment records a title in response content of the target website to obtain a current title; judging whether the current title is the same as a pre-stored historical title or not; if not, recording the frequency according to the current title to obtain the title escape frequency; and performing alarm processing according to the title escape times and a preset alarm strategy.
The method comprises the steps of acquiring a current title in response content of a target website when the target website corresponds to an access request, and then performing title escape judgment through the current title instead of acquiring the content of the target website in an active access mode, so that more performance influence on the target website is avoided, meanwhile, due to the stability of the title, the false alarm rate of alarm operation is reduced, and the detection accuracy is improved.
The application also provides a website tampering warning device, a server and a computer readable storage medium based on the escape of the titles in the cloud protection, which have the beneficial effects, and are not described in detail herein.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
Fig. 1 is a flowchart of a website tampering warning method based on topic escape in cloud protection according to an embodiment of the present application;
fig. 2 is a schematic structural diagram of a website tampering warning device based on topic escape in cloud protection according to an embodiment of the present application.
Detailed Description
The core of the application is to provide a website tampering warning method, a website tampering warning device, a server and a computer readable storage medium based on title escape in cloud protection, when a target website responds to an access request, a corresponding current title is recorded and judged with a recorded historical title so as to determine the title escape problem, warning processing is further performed, instead of detecting a webpage for warning, and more influence on the website is avoided.
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
In the related art, a web page detection program is generally adopted, and the integrity of the web page content is judged by comparing web page crawling codes of a website for 2 times, so that tampering is detected. However, the error rate, the false alarm rate and the missing report rate are very high due to various reasons such as network fluctuation, and the continuous crawling of the website may affect the normal operation of the website. The tamper-proof effect is low, and the performance of the webpage website is greatly influenced.
Therefore, the website tampering warning method based on the escape of the title in the cloud protection is provided, the current title in the response content of the target website is obtained when the target website corresponds to the access request, then the title escape judgment is carried out through the current title instead of the content of the target website obtained in an active access mode, so that more performance influences on the target website are avoided, meanwhile, due to the stability of the title, the false alarm rate of warning operation is reduced, and the detection accuracy is improved.
An embodiment of the website tampering warning method based on topic escape in cloud protection is described below.
Referring to fig. 1, fig. 1 is a flowchart of a website tampering alarm method based on topic escape in cloud protection according to an embodiment of the present application.
In this embodiment, the method may include:
s101, when the target website responds to the access request, the cloud protection equipment records a title in response content of the target website to obtain a current title;
the method comprises the steps that when the target website responds to the access request, the cloud protection equipment records the title in the response content of the target website to obtain the current title.
The cloud protection device is a device in the cloud protection system and is used for performing corresponding maintenance operation on network devices such as websites and servers accessed into the cloud protection system so as to improve the security of the websites. The cloud protection system provides security protection capability for a private cloud or a large network, provides a platform for integrated security protection such as security detection, protection, analysis and operation for a private cloud platform, and can preset a threshold value for title escape.
Therefore, the target website in this embodiment is a website set in the cloud protection system. On the basis, when corresponding traffic access occurs to the target website, the target website can be captured by the cloud protection device. Therefore, in this embodiment, the relevant data of the target website can be obtained without continuously making a request to the target website.
Further, in this step, mainly when the target website receives the access request and responds to the access request, the cloud protection device in this embodiment acquires the title of the web page from the response data of the target website as the current title.
S102, judging whether the current title is the same as a pre-stored historical title or not;
on the basis of S101, this step is intended to determine whether the current title is the same as the pre-stored history title.
Therefore, in this step, on the basis of the previous step, after the current title is obtained, the current title and the pre-stored historical title are judged so as to determine whether the title escapes, that is, the webpage content is tampered.
The pre-stored history titles refer to history titles stored in advance. The history title is typically the correct title for the target web site.
S103, if not, recording the frequency according to the current title to obtain the title escape frequency;
on the basis of S102, in this step, when the current title is not the same as the historical title, the number of times of title escape is obtained by performing the number-of-times recording according to the current title. That is, the number of times of webpage tampering problems of the target website is recorded.
When a situation occurs in which the contents of the current title and the history title are not the same, that is, when a title escapes, the following situation may be included. 1. The title comparison is changed; 2. title content discovery sensitive keywords; 3. the header contains Unicode encoded information.
Further, this embodiment may further include:
when the current title is the same as the historical title, a title error free message is sent.
It can be seen that the main idea in this alternative is to send a title error free message when the current title is the same as the historical title. That is, in the case where there is no problem with the title, that is, in the case where the web page has not been tampered with, the title error-free message is transmitted.
And S104, performing alarm processing according to the title escape times and a preset alarm strategy.
And performing alarm processing according to the title escape times and a preset alarm strategy on the basis of S103. The preset alarm strategy is mainly to perform alarm processing of different degrees under the condition of different title escape times.
The alarm policy may be set according to experience of a technician, or may be set according to an operating environment of the target website, or may be set according to a risk state of the network.
Further, this embodiment may further include:
and when the current title is different from the pre-stored historical title, logging the current title.
It can be seen that in the alternative, the current title is logged when title escape occurs. The method and the device have the advantages that log recording is carried out on the webpage tampering condition, so that the webpage tampering problem can be analyzed, and the network protection effect of the cloud protection device is further improved.
Further, in order to improve the configurability of the alarm processing, the method may include:
judging whether the title escape times are larger than an escape threshold of an alarm strategy or not;
and if so, sending an alarm message.
It can be seen that the present alternative scheme mainly explains how to perform alarm processing. In the alternative scheme, whether the escape times of the title is greater than the escape threshold of the warning strategy is judged; and if so, sending an alarm message. That is, when the number of title escapes is greater than a preset number, an alarm message is transmitted. The configurability and autonomy of alarming are improved.
In summary, in the embodiment, when the target website corresponds to the access request, the current title in the response content of the target website is acquired, and then the title escape judgment is performed through the current title, instead of acquiring the content of the target website in an active access manner, so that more performance impacts on the target website are avoided, and meanwhile, due to the stability of the title, the false alarm rate of the alarm operation is reduced, and the accuracy of detection is improved.
The website tampering warning method based on topic escape in cloud protection provided by the present application is further described below by a specific embodiment.
In this embodiment, the method may include:
step 1, establishing a uniform cloud protection platform for accessing a website needing cloud protection, wherein a threshold value for title escape can be set on the platform, such as 1-time escape alarm or x-time escape alarm;
step 2, the cloud protection platform records the title in the webpage response content accessed by the cloud protection site;
step 3, recording the titles in the response contents of the same webpage accessed subsequently by the cloud protection site and comparing the titles with the previous title contents;
step 4, when the comparison result is not changed, no processing is carried out;
step 5, when the title escapes due to change, recording the information into a platform website report if the title does not reach a threshold value; if the preset title escape threshold condition is met, pushing the tampering alarm data to a message server;
and 6, after receiving the tampered alarm data, the message server judges according to an alarm time period and an alarm mode which are set in advance by the alarm contact person, and if the alarm time period is within the time period, the message server calls interfaces such as short messages, mails and telephones according to different alarm modes to alarm the alarm contact person.
As can be seen, in the embodiment, when the target website corresponds to the access request, the current title in the response content of the target website is obtained, and then the title escape judgment is performed through the current title, instead of obtaining the content of the target website in an active access manner, so that more performance influences on the target website are avoided, and meanwhile, due to the stability of the title, the false alarm rate of the alarm operation is reduced, and the accuracy of the detection is improved.
In the following, the website tampering warning device based on the escape of the title in the cloud protection provided by the embodiment of the present application is introduced, and the website tampering warning device based on the escape of the title in the cloud protection described below and the website tampering warning method based on the escape of the title in the cloud protection described above may be referred to in a corresponding manner.
Referring to fig. 2, fig. 2 is a schematic structural diagram of a website tampering warning device based on title escape in cloud protection according to an embodiment of the present application.
In this embodiment, the apparatus may include:
the title recording module 100 is configured to record a title in response content of the target website to obtain a current title when the target website responds to the access request;
a title judging module 200, configured to judge whether a current title is the same as a pre-stored historical title;
the escape recording module 300 is configured to record the number of times according to the current title when the current title is different from a pre-stored historical title, so as to obtain the number of times of title escape;
and an alarm processing module 400, configured to perform alarm processing according to the number of title escapes and a preset alarm policy.
Optionally, the apparatus may further include:
and the strategy configuration module is used for carrying out strategy configuration according to the received escape threshold value to obtain an alarm strategy.
Optionally, the apparatus may further include:
and the error-free judging module is used for sending the title error-free message when the current title is the same as the historical title.
An embodiment of the present application further provides a server, including:
a memory for storing a computer program;
a processor, configured to implement the steps of the website tampering warning method according to the above embodiments when the computer program is executed.
The embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the website tampering warning method according to the above embodiment are implemented.
The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
The website tampering warning method, the website tampering warning device, the server and the computer readable storage medium based on the escape of the titles in the cloud protection are described in detail above. The principles and embodiments of the present application are explained herein using specific examples, which are provided only to help understand the method and the core idea of the present application. It should be noted that, for those skilled in the art, it is possible to make several improvements and modifications to the present application without departing from the principle of the present application, and such improvements and modifications also fall within the scope of the claims of the present application.

Claims (10)

1. A website tampering warning method based on title escape in cloud protection is characterized by comprising the following steps:
when a target website responds to an access request, the cloud protection equipment records a title in response content of the target website to obtain a current title;
judging whether the current title is the same as a pre-stored historical title or not;
if not, recording the frequency according to the current title to obtain the title escape frequency;
and performing alarm processing according to the title escape times and a preset alarm strategy.
2. The website tampering warning method according to claim 1, further comprising:
and carrying out strategy configuration according to the received escape threshold value to obtain the alarm strategy.
3. The website tampering warning method according to claim 1, further comprising:
and when the current title is the same as the historical title, sending a title error-free message.
4. The website tampering alarm method according to claim 1, wherein performing alarm processing according to the title escape times and a preset alarm policy comprises:
judging whether the title escape times are larger than an escape threshold of the alarm strategy;
and if so, sending an alarm message.
5. The website tampering warning method according to claim 1, further comprising:
and when the current title is different from the pre-stored historical title, performing log recording on the current title.
6. A website tampering warning device based on title escape in cloud protection is characterized by comprising:
the title recording module is used for recording the title in the response content of the target website to obtain the current title when the target website responds to the access request;
the title judging module is used for judging whether the current title is the same as a pre-stored historical title or not;
the escape recording module is used for recording the frequency according to the current title to obtain the title escape frequency when the current title is different from the pre-stored historical title;
and the alarm processing module is used for carrying out alarm processing according to the title escape times and a preset alarm strategy.
7. The website tamper warning device according to claim 6, further comprising:
and the strategy configuration module is used for carrying out strategy configuration according to the received escape threshold value to obtain the alarm strategy.
8. The website tamper warning device according to claim 6, further comprising:
and the error-free judging module is used for sending a title error-free message when the current title is the same as the historical title.
9. A server, comprising:
a memory for storing a computer program;
a processor for implementing the steps of the website tamper alerting method of any one of claims 1 to 5 when executing the computer program.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium has stored thereon a computer program which, when being executed by a processor, realizes the steps of the website tamper alert method according to any one of claims 1 to 5.
CN202011444913.4A 2020-12-11 2020-12-11 Website tampering alarm method based on title escape in cloud protection and related device Pending CN112507270A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011444913.4A CN112507270A (en) 2020-12-11 2020-12-11 Website tampering alarm method based on title escape in cloud protection and related device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011444913.4A CN112507270A (en) 2020-12-11 2020-12-11 Website tampering alarm method based on title escape in cloud protection and related device

Publications (1)

Publication Number Publication Date
CN112507270A true CN112507270A (en) 2021-03-16

Family

ID=74971109

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011444913.4A Pending CN112507270A (en) 2020-12-11 2020-12-11 Website tampering alarm method based on title escape in cloud protection and related device

Country Status (1)

Country Link
CN (1) CN112507270A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115333920A (en) * 2022-08-12 2022-11-11 北京天融信网络安全技术有限公司 Alarm testing method and device, electronic equipment and computer readable storage medium
CN115333920B (en) * 2022-08-12 2024-04-23 北京天融信网络安全技术有限公司 Alarm test method, alarm test device, electronic equipment and computer readable storage medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110167108A1 (en) * 2008-07-11 2011-07-07 Xueli Chen Web page tamper-froof device, method and system
CN102436564A (en) * 2011-12-30 2012-05-02 奇智软件(北京)有限公司 Method and device for identifying falsified webpage
CN111159775A (en) * 2019-12-11 2020-05-15 中移(杭州)信息技术有限公司 Webpage tampering detection method, system and device and computer readable storage medium
WO2020151173A1 (en) * 2019-01-25 2020-07-30 深信服科技股份有限公司 Webpage tampering detection method and related apparatus

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110167108A1 (en) * 2008-07-11 2011-07-07 Xueli Chen Web page tamper-froof device, method and system
CN102436564A (en) * 2011-12-30 2012-05-02 奇智软件(北京)有限公司 Method and device for identifying falsified webpage
WO2020151173A1 (en) * 2019-01-25 2020-07-30 深信服科技股份有限公司 Webpage tampering detection method and related apparatus
CN111159775A (en) * 2019-12-11 2020-05-15 中移(杭州)信息技术有限公司 Webpage tampering detection method, system and device and computer readable storage medium

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115333920A (en) * 2022-08-12 2022-11-11 北京天融信网络安全技术有限公司 Alarm testing method and device, electronic equipment and computer readable storage medium
CN115333920B (en) * 2022-08-12 2024-04-23 北京天融信网络安全技术有限公司 Alarm test method, alarm test device, electronic equipment and computer readable storage medium

Similar Documents

Publication Publication Date Title
CN108268354B (en) Data security monitoring method, background server, terminal and system
CN109164786B (en) Abnormal behavior detection method, device and equipment based on time-dependent baseline
US20050273673A1 (en) Systems and methods for minimizing security logs
CN107438079A (en) A kind of detection method of the unknown abnormal behaviour in website
CN113839935B (en) Network situation awareness method, device and system
CN112787992A (en) Method, device, equipment and medium for detecting and protecting sensitive data
CN103856471A (en) Cross-site scripting attack monitoring system and method
CN108259202A (en) A kind of CA monitoring and pre-alarming methods and CA monitoring and warning systems
CN111835777A (en) Abnormal flow detection method, device, equipment and medium
CN114006723A (en) Network security prediction method, device and system based on threat intelligence
CN110602030A (en) Network intrusion blocking method, server and computer readable medium
CN113315785B (en) Alarm reduction method, device, equipment and computer readable storage medium
KR20150064331A (en) Device for monitoring web server and analysing malicious code
CN117201273A (en) Automatic analysis and noise reduction method and device for safety alarm and server
CN116305290A (en) System log security detection method and device, electronic equipment and storage medium
CN112507270A (en) Website tampering alarm method based on title escape in cloud protection and related device
CN109040080B (en) File tampering processing method and device, cloud service platform and storage medium
CN113132316A (en) Web attack detection method and device, electronic equipment and storage medium
CN116248381A (en) Alarm aggregation method and device, electronic equipment and storage medium
CN114024709A (en) Defense method, XSS vulnerability searching method, flow detection equipment and storage medium
CN115706669A (en) Network security situation prediction method and system
JP6330280B2 (en) Alert output device, alert output method, and alert output program
CN112073426A (en) Website scanning detection method, system and equipment in cloud protection environment
CN111694566A (en) Modular intelligent station building system
CN111600841B (en) Comprehensive safety monitoring method and system for Web site

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20210316

RJ01 Rejection of invention patent application after publication