CN112528115B - Website monitoring method and device - Google Patents
Website monitoring method and device Download PDFInfo
- Publication number
- CN112528115B CN112528115B CN201910877851.7A CN201910877851A CN112528115B CN 112528115 B CN112528115 B CN 112528115B CN 201910877851 A CN201910877851 A CN 201910877851A CN 112528115 B CN112528115 B CN 112528115B
- Authority
- CN
- China
- Prior art keywords
- value
- hash value
- difference
- website
- mean
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Abstract
The invention discloses a website monitoring method and device. The method comprises the following steps: determining a website to be monitored; acquiring a first webpage screenshot of a website to be monitored at a first moment and a second webpage screenshot of the website to be monitored at a second moment, and calculating a first average hash value and a first difference hash value corresponding to the first webpage screenshot, and a second average hash value and a second difference hash value corresponding to the second webpage screenshot; and calculating a difference between the first mean hash value and the second mean hash value and a difference between the first difference hash value and the second difference hash value; when the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. By adopting the scheme, the monitoring of the website can be accurately realized, the abnormal monitoring precision is improved, the bandwidth resource is saved, the implementation mode is simple and feasible, the cost is low, and the method is suitable for large-scale application and implementation.
Description
Technical Field
The invention relates to the technical field of safety, in particular to a website monitoring method and device.
Background
With the continuous development of science and technology and society, the appearance of various websites greatly facilitates the work and life of people. However, current attacks against websites also continue to occur. In order to ensure the operation safety of the website, the monitoring of the website is generally realized by adopting modes such as a crawler, a soft probe, bypass mirror image, network management filtering and the like in the prior art.
However, the inventors have found that in practice the following drawbacks exist in the prior art: the website abnormality monitoring precision of the website monitoring modes such as a crawler, a soft probe, a bypass mirror image, a webmaster filter and the like in the prior art is low, and the method has the defects of high cost and inapplicability to large-scale application and implementation; in addition, a great deal of network bandwidth resources can be consumed aiming at monitoring modes such as crawlers, bypass mirror images and the like, so that the monitoring efficiency is further reduced, and the monitoring cost is improved.
Disclosure of Invention
The present invention has been made in view of the above-mentioned problems, and it is an object of the present invention to provide a website monitoring method and apparatus that overcomes or at least partially solves the above-mentioned problems.
According to one aspect of the present invention, there is provided a website monitoring method, including:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
Acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value;
if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
According to another aspect of the present invention, there is provided a website monitoring apparatus including:
the determining module is suitable for determining websites to be monitored;
the acquisition module is suitable for acquiring a first webpage screenshot of the website to be monitored at a first moment and acquiring a second webpage screenshot of the website to be monitored at a second moment;
the hash calculation module is suitable for calculating a first average value hash value and a first difference value hash value corresponding to the first webpage screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
The difference value calculation module is suitable for calculating the difference value of the first mean value hash value and the second mean value hash value and calculating the difference value of the first difference value hash value and the second difference value hash value respectively;
the abnormality determining module is suitable for determining that the website is normal if the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value; otherwise, determining that the website is abnormal.
According to yet another aspect of the present invention, there is provided a computing device comprising: the device comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete communication with each other through the communication bus;
the memory is used for storing at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the website monitoring method.
According to still another aspect of the present invention, there is provided a computer storage medium having stored therein at least one executable instruction for causing a processor to perform operations corresponding to the website monitoring method described above.
According to the website monitoring method and device provided by the invention, the website to be monitored is determined; acquiring a first webpage screenshot of a website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value; if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the method and the system, the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments are calculated, whether the website is abnormal or not is comprehensively determined through the comparison of the difference value of the two hash values and the corresponding threshold value, so that monitoring of the website is accurately achieved, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation is simple and feasible, the cost is low, and the method and the system are suitable for large-scale application and implementation.
The foregoing description is only an overview of the present invention, and is intended to be implemented in accordance with the teachings of the present invention in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present invention more readily apparent.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to designate like parts throughout the figures. In the drawings:
FIG. 1 illustrates a flow chart of a website monitoring method provided in accordance with one embodiment of the present invention;
FIG. 2 is a flow chart of a method for monitoring a website according to another embodiment of the present invention;
FIG. 3 is a schematic diagram of a website monitoring apparatus according to an embodiment of the present invention;
FIG. 4 illustrates a schematic diagram of a computing device provided in accordance with one embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
Example 1
Fig. 1 shows a flowchart of a method for monitoring a website, which is applied to a device with computing capability, for example, the method may be executed as an application program in a terminal, may be executed as a plug-in a website, may be executed on a server, etc. according to an embodiment of the present invention.
As shown in fig. 1, the method comprises the steps of:
step S110, determining a website to be monitored.
In a specific implementation process, a corresponding website information input entry can be provided for the user, and the user can input website information to be monitored through the website information input entry. The website information specifically refers to website information of a website.
Step S120, a first webpage screenshot of a website to be monitored at a first moment is obtained, and a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot are calculated.
After determining the website to be monitored, web page screenshots of the website to be monitored at different moments can be obtained. Optionally, in a specific implementation process, a corresponding webpage can be opened according to the website information of the website to be detected, and a webpage screenshot corresponding to the website of the website to be detected is periodically intercepted according to a preset intercepting period, so that the obtained webpage screenshot can reflect the webpage display conditions of the website to be monitored at different moments.
The first time in this embodiment may be a historical time earlier than the current time, and the web page image corresponding to the website address of the website to be monitored intercepted at the first time is the first web page screenshot at the first time.
Further, based on the obtained first webpage screenshot, a first mean hash value and a first difference hash value corresponding to the first webpage screenshot are calculated. It should be understood by those skilled in the art that in this embodiment, the mean hash algorithm and the difference hash algorithm are adopted respectively, and the hash value is calculated twice for the same web page screenshot, so as to obtain the mean hash value and the difference hash value for the same web page screenshot. In this step, the average hash value obtained by performing the hash operation on the first web page screenshot by using the average hash algorithm is the first average hash value, and the difference hash value obtained by performing the hash operation on the first web page screenshot by using the difference hash algorithm is the first difference hash value.
Optionally, in order to further improve the calculation accuracy and the calculation efficiency of the first mean hash value and the first difference hash value, in this embodiment, after the first webpage screenshot is obtained, the first webpage screenshot is further preprocessed, and the first mean hash value and the first difference hash value corresponding to the preprocessed first webpage screenshot are calculated. The specific pretreatment method is not limited in this embodiment, and the pretreatment includes: screenshot size normalization processing and/or color simplification processing, etc. For example, after the first screenshot is obtained, in order to quickly remove the high frequency and related detail information, only the bright and dark portions of the structure are reserved, and the obtained first screenshot may be reduced in size (e.g., the first screenshot may be reduced to a size of 8×8), so that the difference caused by the different screenshot sizes and proportions may be further reduced. After the size is reduced, color simplification processing may be performed on the reduced first webpage screenshot, for example, the first webpage screenshot is converted into a picture only including a preset level (e.g., 64 levels) of gray scale, so that the simplified first webpage screenshot only includes a predicted level of multiple colors.
Further optionally, in the process of calculating the first mean hash value and the first difference hash value corresponding to the first webpage screenshot, the following manner may be adopted:
in the calculation process of the first mean value hash value, the gray level average value of the first webpage screenshot can be calculated first, the size relation between each pixel in the first webpage screenshot and the gray level average value of the first webpage screenshot is determined respectively, and the first mean value hash value corresponding to the first webpage screenshot is generated according to the size relation. For example, after preprocessing a first web page screenshot, a picture containing 64 gray levels, which is simplified to 8×8 (64 pixels total), is first calculated, and the gray average value of the 64 pixels is determined, and the magnitude relation between the 64 pixels and the gray average value is determined, wherein when the gray value of the pixel is greater than or equal to the gray average value, the pixel is determined to correspond to 1,; otherwise, it is determined that the pixel corresponds to 0. Thus, the result of the combination of the "1" or "0" corresponding to the 64 pixels is the first mean hash value.
In the calculation process of the first difference hash value, the difference value of the gray values of two adjacent pixels in the first webpage screenshot can be calculated first, and finally the first difference hash value corresponding to the first webpage screenshot is generated according to the difference value calculation result. For example, after preprocessing the first web page screenshot, the first web page screenshot is simplified to 8×8 (64 pixels total) pictures with 64 gray levels, and the difference between gray values of every two adjacent pixels in the 64 pixels is calculated, and if the difference is positive, the difference is recorded as 1; otherwise, it is marked as 0. Thus ultimately generating a first difference hash value from the combination of the plurality of "1" s or "0" s.
Step S130, a second webpage screenshot of the website to be monitored at a second moment is obtained, and a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot are calculated.
In this embodiment, the second time may be later than the first time, for example, the second time may be the current time. And the webpage image corresponding to the website address of the website to be monitored intercepted at the second moment is the second webpage screenshot at the second moment.
Further, based on the obtained second webpage screenshot, a second mean hash value and a second difference hash value corresponding to the second webpage screenshot are calculated. In this step, the average hash value obtained by the hash operation performed on the second webpage screenshot by using the average hash algorithm is the second average hash value, and the difference hash value obtained by the hash operation performed on the second webpage screenshot by using the difference hash algorithm is the second difference hash value.
Optionally, in order to further improve the calculation accuracy and calculation efficiency of the second mean hash value and the second difference hash value, in this embodiment, after the second webpage screenshot is obtained, the second webpage screenshot is further preprocessed, and the second mean hash value and the second difference hash value corresponding to the preprocessed second webpage screenshot are calculated. The specific pretreatment method is not limited in this embodiment, and the pretreatment includes: screenshot size normalization processing and/or color simplification processing, etc. The specific manner of preprocessing is described with reference to the corresponding portion in step S120, and this step is not described herein.
Further optionally, in the process of calculating the second mean hash value and the second difference hash value corresponding to the second webpage screenshot, the following manner may be adopted:
in the calculation process of the second mean hash value, the gray average value of the second webpage screenshot can be calculated first, the size relation between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot is determined, and the first mean hash value corresponding to the second webpage screenshot is generated according to the size relation. For example, after preprocessing the second web page screenshot, for a picture containing 64 gray levels, which is simplified to 8×8 (total 64 pixels), firstly calculating a gray average value of the 64 pixels, and determining a magnitude relation between the 64 pixels and the gray average value, wherein when the gray value of the pixel is greater than or equal to the gray average value, it is determined that the pixel corresponds to 1; otherwise, it is determined that the pixel corresponds to 0. Thus, the result of the combination of the "1" or "0" corresponding to the 64 pixels is the second mean hash value.
In the calculation process of the second difference hash value, the difference value of the gray values of two adjacent pixels in the second webpage screenshot can be calculated first, and finally, a first difference hash value corresponding to the second webpage screenshot is generated according to the difference value calculation result. For example, after preprocessing the second web page screenshot, the second web page screenshot is simplified to 8×8 (64 pixels total) pictures with 64 gray levels, and the difference between gray values of every two adjacent pixels in the 64 pixels is calculated, and if the difference is positive, the difference is recorded as 1; otherwise, it is marked as 0. Thus ultimately generating a second difference hash value from the combination of the plurality of "1" s or "0" s.
The execution order of the step S120 and the step S130 is not limited in this embodiment, for example, the step S130 may be further executed after the step S120 is executed; or, after the first webpage screenshot of the website to be monitored at the first moment and the second webpage screenshot of the website to be monitored at the second moment are obtained, uniformly calculating and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot, and calculating a second mean value hash value and a second difference value hash value corresponding to the second webpage screenshot.
Step S140, calculating the difference between the first mean hash value and the second mean hash value, and calculating the difference between the first difference hash value and the second difference hash value.
After a first average value hash value and a first difference value hash value corresponding to the first webpage screenshot and a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot are obtained, respectively calculating the difference value of the same type hash values of the first webpage screenshot and the second webpage screenshot. Namely, calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value. The difference value between the first mean hash value and the second mean hash value may be the first mean hash value-the second mean hash value, the second mean hash value-the first mean hash value, the second mean hash value-the absolute value of the first mean hash value, or the like; similarly, the difference between the first difference hash value and the second difference hash value may be a first difference hash value-second difference hash value, a second difference hash value-first difference hash value, an absolute value of the second difference hash value-first difference hash value, or the like.
Step S150, if the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In this embodiment, corresponding judgment thresholds are set for the mean hash value and the difference hash value, respectively, where the mean hash value corresponds to the first threshold and the difference hash value corresponds to the second threshold. Alternatively, when the first threshold is 18, the second threshold is 30; when the first threshold is 30, the second threshold is 18. When the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value, the website is indicated to be not tampered maliciously at the first moment and the second moment, and therefore the website is determined to be normal; otherwise, determining that the information tampering of the website is indicated, and determining that the website is abnormal. The implementation adopts a multi-dimensional judgment mode of the difference value of the mean hash value and the difference value of the difference hash value, so that misjudgment on a floating window (easy to cause obvious change of the difference hash value) in a website and normal update (easy to cause obvious change of the mean hash value) of a fixed position of the website can be effectively avoided, and the accuracy of website monitoring is further improved.
Optionally, after determining that the website is abnormal, corresponding alarm information may be further generated and sent to the corresponding target user. In a specific implementation process, after the configuration user configures the website to be monitored, relevant information of the configuration user for the target user to which the alarm information is sent can be further received, for example, a mailbox address, a telephone number, a social software account number and the like of the target user configured by the configuration user can be received, so that after the abnormality of the website is determined, the alarm information can be sent to the target user in a mode of mail sending, short message sending, telephone dialing, social software information sending and the like, and the target user can quickly learn the alarm information.
Further optionally, in order to consider both the website monitoring effect and the system resource, the embodiment may trigger the execution of the above steps according to a preset website monitoring frequency.
Therefore, after determining the website to be monitored, the embodiment further obtains a first webpage screenshot of the website to be monitored at the first moment, and calculates a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; further respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value; if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the method and the device, the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments are calculated, whether the website is abnormal or not is comprehensively determined through the comparison of the difference value of the two hash values and the corresponding threshold value, so that monitoring of the website is accurately achieved, misjudgment of normal updating of a floating window in the website and a fixed position of the website is effectively avoided, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation is simple and feasible, the cost is low, and the method and the device are suitable for large-scale application and implementation.
Example two
Fig. 2 is a flowchart of an embodiment of a website monitoring method according to another embodiment of the present invention, where the method is applied to a corresponding device with computing capability, and may be executed as an application program in a terminal, as a plug-in a website, or on a server side, or the like. The website monitoring method provided in this embodiment is specifically directed to further optimization of the method shown in fig. 1.
As shown in fig. 2, the method includes:
step S210, determining a website to be monitored.
Step S220, a first webpage screenshot of a website to be monitored at a first moment and a second webpage screenshot of the website to be monitored at a second moment are obtained, a first average hash value and a first difference hash value corresponding to the first webpage screenshot are calculated, and a second average hash value and a second difference hash value corresponding to the second webpage screenshot are calculated.
In step S230, a difference between the first mean hash value and the second mean hash value is calculated, and a difference between the first difference hash value and the second difference hash value is calculated.
Step S240, judging whether: the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value; if yes, determining that the website is normal; otherwise, step S250 is further performed.
The specific execution process of steps S210 to S240 in this embodiment may refer to the description of the corresponding parts in the first embodiment, which is not described herein.
In the embodiment, the accuracy of website monitoring under different scenes is further improved, and the scene of frequent and large-area updating of website advertisements is further optimized aiming at enterprise websites. Specifically, when it is determined through steps S210-S240 that the difference between the first mean hash value and the second mean hash value is not currently satisfied and is smaller than the first threshold, and the difference between the first difference hash value and the second difference hash value is smaller than the second threshold, the embodiment further executes step S250.
Step S250, extracting text information in a webpage corresponding to the website to be monitored.
In general, one way of malicious tampering is to replace related text information displayed on a website with malicious pictures. In a specific implementation process, an image recognition algorithm based on an OpenCV architecture may be used to detect text information contained in a website page, and determine whether the website is tampered according to the text information amount.
Step S260, judging whether the data volume of the extracted text information is smaller than the preset data volume; if yes, determining that the website is abnormal; otherwise, determining that the website is normal.
Specifically, when an image recognition algorithm based on an OpenCV architecture is adopted to detect that a large amount of text information is contained in a website page, determining that the website is normal; and an image recognition algorithm based on an OpenCV architecture is adopted to detect that text information contained in a website page is too little, the website is determined to be a suspected problem website, so that website abnormality is determined, corresponding alarm information is generated, and the corresponding alarm information is sent to a corresponding target user.
Therefore, the method and the device comprehensively determine whether the website is abnormal or not by calculating the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments and comparing the difference value of the two hash values with the corresponding threshold value, so that monitoring of the website is accurately realized, misjudgment of normal updating of a floating window in the website and a fixed position of the website is effectively avoided, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation mode is simple and easy, the cost is low, and the method and the device are suitable for large-scale application and implementation; moreover, the method can monitor and protect the attack mode of replacing the related text information displayed by the website with the malicious picture, thereby ensuring the monitoring precision of the website in each scene.
Example III
Fig. 3 is a schematic structural diagram of a website monitoring device according to an embodiment of the present invention. As shown in fig. 3, the apparatus includes: the determination module 31, the acquisition module 32, the hash calculation module 33, the difference calculation module 34, and the abnormality determination module 35.
A determining module 31 adapted to determine a website to be monitored;
the obtaining module 32 is adapted to obtain a first webpage screenshot of the website to be monitored at a first moment, and obtain a second webpage screenshot of the website to be monitored at a second moment;
the hash calculation module 33 is adapted to calculate a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
the difference calculating module 34 is adapted to calculate the difference between the first mean hash value and the second mean hash value, and calculate the difference between the first difference hash value and the second difference hash value, respectively;
the anomaly determination module 35 is adapted to determine that the website is normal if the difference between the first mean hash value and the second mean hash value is smaller than a first threshold value and the difference between the first difference hash value and the second difference hash value is smaller than a second threshold value; otherwise, determining that the website is abnormal.
Optionally, the hash calculation module is further adapted to: preprocessing the first webpage screenshot, and calculating a first mean hash value and a first difference hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second mean hash value and a second difference hash value corresponding to the preprocessed second webpage screenshot.
Optionally, the preprocessing includes: screenshot size normalization processing and/or color simplification processing.
Optionally, the hash calculation module is further adapted to:
calculating the gray level average value of the first webpage screenshot, respectively determining the magnitude relation between each pixel in the first webpage screenshot and the gray level average value of the first webpage screenshot, and generating a first mean value hash value corresponding to the first webpage screenshot according to the magnitude relation; and
and calculating the difference value of gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
Optionally, the hash calculation module is further adapted to:
calculating the gray average value of the second webpage screenshot, respectively determining the magnitude relation between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average value hash value corresponding to the second webpage screenshot according to the magnitude relation; and
And calculating the difference value of gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
Optionally, the apparatus further comprises: the text monitoring module (not shown in the figure) is suitable for extracting text information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, determining that the website is normal.
Optionally, the apparatus further comprises: an alarm generation module (not shown in the figure) adapted to generate corresponding alarm information after the abnormality of the website is determined;
and the sending module is suitable for sending the alarm information to the corresponding target user.
The specific implementation process of each module in this embodiment may refer to the description of the corresponding part in the first embodiment and/or the second embodiment, and this embodiment is not described herein.
Therefore, after determining the website to be monitored, the embodiment further obtains a first webpage screenshot of the website to be monitored at the first moment, and calculates a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; further respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value; if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the method and the device, the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments are calculated, whether the website is abnormal or not is comprehensively determined through the comparison of the difference value of the two hash values and the corresponding threshold value, so that monitoring of the website is accurately achieved, misjudgment of normal updating of a floating window in the website and a fixed position of the website is effectively avoided, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation is simple and feasible, the cost is low, and the method and the device are suitable for large-scale application and implementation.
Example IV
Embodiments of the present invention provide a non-volatile computer storage medium storing at least one executable instruction that may perform the website monitoring method of any of the above method embodiments.
The executable instructions may be particularly useful for causing a processor to:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value;
if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In an alternative embodiment, the executable instructions may be specifically configured to cause a processor to:
Preprocessing the first webpage screenshot, and calculating a first mean hash value and a first difference hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second mean value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
In an alternative embodiment, the preprocessing includes: screenshot size normalization processing and/or color simplification processing.
In an alternative embodiment, the executable instructions may be specifically configured to cause a processor to:
calculating the gray level average value of the first webpage screenshot, respectively determining the magnitude relation between each pixel in the first webpage screenshot and the gray level average value of the first webpage screenshot, and generating a first mean value hash value corresponding to the first webpage screenshot according to the magnitude relation; and
and calculating the difference value of gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the executable instructions may be specifically configured to cause a processor to:
Calculating the gray average value of the second webpage screenshot, respectively determining the magnitude relation between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average value hash value corresponding to the second webpage screenshot according to the magnitude relation; and
and calculating the difference value of gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
In an alternative embodiment, the executable instructions may be specifically configured to cause a processor to:
extracting text information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, determining that the website is normal.
In an alternative embodiment, the executable instructions may be specifically configured to cause a processor to:
and after the abnormality of the website is determined, generating corresponding alarm information, and sending the alarm information to a corresponding target user.
Therefore, after determining the website to be monitored, the embodiment further obtains a first webpage screenshot of the website to be monitored at the first moment, and calculates a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; further respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value; if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the method and the device, the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments are calculated, whether the website is abnormal or not is comprehensively determined through the comparison of the difference value of the two hash values and the corresponding threshold value, so that monitoring of the website is accurately achieved, misjudgment of normal updating of a floating window in the website and a fixed position of the website is effectively avoided, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation is simple and feasible, the cost is low, and the method and the device are suitable for large-scale application and implementation.
Example five
FIG. 4 illustrates a schematic diagram of a computing device, according to one embodiment of the invention, and the invention is not limited to a particular implementation of the computing device.
As shown in fig. 4, the computing device may include: a processor 402, a communication interface (Communications Interface) 404, a memory 406, and a communication bus 408.
Wherein: processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408. A communication interface 404 for communicating with network elements of other devices, such as clients or other servers. The processor 402 is configured to execute the program 410, and may specifically perform the relevant steps in the embodiments of the website monitoring method described above.
In particular, program 410 may include program code including computer-operating instructions.
The processor 402 may be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included by the computing device may be the same type of processor, such as one or more CPUs; but may also be different types of processors such as one or more CPUs and one or more ASICs.
Memory 406 for storing programs 410. Memory 406 may comprise high-speed RAM memory or may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; and
acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot;
respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value;
if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal.
In an alternative embodiment, program 410 may be specifically operative to cause processor 402 to perform the following operations:
Preprocessing the first webpage screenshot, and calculating a first mean hash value and a first difference hash value corresponding to the preprocessed first webpage screenshot;
and preprocessing the second webpage screenshot, and calculating a second mean value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
In an alternative embodiment, the preprocessing includes: screenshot size normalization processing and/or color simplification processing.
In an alternative embodiment, program 410 may be specifically operative to cause processor 402 to perform the following operations:
calculating the gray level average value of the first webpage screenshot, respectively determining the magnitude relation between each pixel in the first webpage screenshot and the gray level average value of the first webpage screenshot, and generating a first mean value hash value corresponding to the first webpage screenshot according to the magnitude relation; and
and calculating the difference value of gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference hash value corresponding to the first webpage screenshot according to the difference value calculation result.
In an alternative embodiment, program 410 may be specifically operative to cause processor 402 to perform the following operations:
Calculating the gray average value of the second webpage screenshot, respectively determining the magnitude relation between each pixel in the second webpage screenshot and the gray average value of the second webpage screenshot, and generating a second average value hash value corresponding to the second webpage screenshot according to the magnitude relation; and
and calculating the difference value of gray values of two adjacent pixels in the second webpage screenshot, and generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result.
In an alternative embodiment, program 410 may be specifically operative to cause processor 402 to perform the following operations:
extracting text information in a webpage corresponding to the website to be monitored;
if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, determining that the website is normal.
In an alternative embodiment, program 410 may be specifically operative to cause processor 402 to perform the following operations:
and after the abnormality of the website is determined, generating corresponding alarm information, and sending the alarm information to a corresponding target user.
Therefore, after determining the website to be monitored, the embodiment further obtains a first webpage screenshot of the website to be monitored at the first moment, and calculates a first mean hash value and a first difference hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; further respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value; if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal; otherwise, determining that the website is abnormal. According to the method and the device, the difference value of the mean hash value and the difference value of the difference hash value of the page screenshot of the same website at different moments are calculated, whether the website is abnormal or not is comprehensively determined through the comparison of the difference value of the two hash values and the corresponding threshold value, so that monitoring of the website is accurately achieved, misjudgment of normal updating of a floating window in the website and a fixed position of the website is effectively avoided, abnormal monitoring precision is improved, bandwidth resources are saved, the implementation is simple and feasible, the cost is low, and the method and the device are suitable for large-scale application and implementation.
The algorithms or displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general-purpose systems may also be used with the teachings herein. The required structure for a construction of such a system is apparent from the description above. In addition, embodiments of the present invention are not directed to any particular programming language. It will be appreciated that the teachings of the present invention described herein may be implemented in a variety of programming languages, and the above description of specific languages is provided for disclosure of enablement and best mode of the present invention.
In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
Similarly, it should be appreciated that in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be construed as reflecting the intention that: i.e., the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.
Those skilled in the art will appreciate that the modules in the apparatus of the embodiments may be adaptively changed and disposed in one or more apparatuses different from the embodiments. The modules or units or components of the embodiments may be combined into one module or unit or component and, furthermore, they may be divided into a plurality of sub-modules or sub-units or sub-components. Any combination of all features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be used in combination, except insofar as at least some of such features and/or processes or units are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Furthermore, those skilled in the art will appreciate that while some embodiments herein include some features but not others included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.
Various component embodiments of the invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the functionality of some or all of the components according to embodiments of the present invention may be implemented in practice using a microprocessor or Digital Signal Processor (DSP). The present invention can also be implemented as an apparatus or device program (e.g., a computer program and a computer program product) for performing a portion or all of the methods described herein. Such a program embodying the present invention may be stored on a computer readable medium, or may have the form of one or more signals. Such signals may be downloaded from an internet website, provided on a carrier signal, or provided in any other form.
It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, third, etc. do not denote any order. These words may be interpreted as names. The steps in the above embodiments should not be construed as limiting the order of execution unless specifically stated.
Claims (9)
1. A method for monitoring a web site, comprising:
determining a website to be monitored;
acquiring a first webpage screenshot of the website to be monitored at a first moment, and calculating a first mean value hash value and a first difference value hash value corresponding to the first webpage screenshot; acquiring a second webpage screenshot of the website to be monitored at a second moment, and calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; calculating the difference value of gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference value hash value corresponding to the first webpage screenshot according to the difference value calculation result; calculating the difference value of gray values of two adjacent pixels in the second webpage screenshot, generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result, and if the difference value is positive, marking as 1; otherwise, it is marked as 0;
respectively calculating the difference value of the first mean value hash value and the second mean value hash value, and calculating the difference value of the first difference value hash value and the second difference value hash value;
if the difference value of the first mean value hash value and the second mean value hash value is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, determining that the website is normal;
When the difference value of the first mean value hash value and the second mean value hash value is not met currently and is smaller than a first threshold value, and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value, extracting text information in a webpage corresponding to the website to be monitored; if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, determining that the website is normal.
2. The method of claim 1, wherein calculating a first mean hash value and a first difference hash value corresponding to the first web page screenshot further comprises: preprocessing the first webpage screenshot, and calculating a first mean hash value and a first difference hash value corresponding to the preprocessed first webpage screenshot;
the calculating a second mean hash value and a second difference hash value corresponding to the second webpage screenshot further includes: and preprocessing the second webpage screenshot, and calculating a second mean value hash value and a second difference value hash value corresponding to the preprocessed second webpage screenshot.
3. The method of claim 2, wherein the preprocessing comprises:
screenshot size normalization processing and/or color simplification processing.
4. The method of any of claims 1-3, wherein the calculating a first mean hash value for the first web page screenshot further comprises:
and calculating the gray level average value of the first webpage screenshot, respectively determining the magnitude relation between each pixel in the first webpage screenshot and the gray level average value of the first webpage screenshot, and generating a first mean value hash value corresponding to the first webpage screenshot according to the magnitude relation.
5. The method of any of claims 1-3, wherein the calculating a second mean hash value for the second screenshot further comprises:
and calculating the gray level average value of the second webpage screenshot, respectively determining the magnitude relation between each pixel in the second webpage screenshot and the gray level average value of the second webpage screenshot, and generating a second average value hash value corresponding to the second webpage screenshot according to the magnitude relation.
6. A method according to any one of claims 1-3, wherein after said determining a website anomaly, the method further comprises: generating corresponding alarm information and sending the alarm information to corresponding target users.
7. A website monitoring apparatus, comprising:
The determining module is suitable for determining websites to be monitored;
the acquisition module is suitable for acquiring a first webpage screenshot of the website to be monitored at a first moment and acquiring a second webpage screenshot of the website to be monitored at a second moment;
the hash calculation module is suitable for calculating a first average value hash value and a first difference value hash value corresponding to the first webpage screenshot; calculating a second average value hash value and a second difference value hash value corresponding to the second webpage screenshot; calculating the difference value of gray values of two adjacent pixels in the first webpage screenshot, and generating a first difference value hash value corresponding to the first webpage screenshot according to the difference value calculation result; calculating the difference value of gray values of two adjacent pixels in the second webpage screenshot, generating a second difference hash value corresponding to the second webpage screenshot according to the difference value calculation result, and if the difference value is positive, marking as 1; otherwise, it is marked as 0;
the difference value calculation module is suitable for calculating the difference value of the first mean value hash value and the second mean value hash value and calculating the difference value of the first difference value hash value and the second difference value hash value respectively;
the abnormality determining module is suitable for determining that the website is normal if the difference value between the first mean value hash value and the second mean value hash value is smaller than a first threshold value and the difference value between the first difference value hash value and the second difference value hash value is smaller than a second threshold value; and extracting text information in a webpage corresponding to the website to be monitored when the difference value of the first mean value hash value and the second mean value hash value is not met currently and is smaller than a first threshold value and the difference value of the first difference value hash value and the second difference value hash value is smaller than a second threshold value; if the data volume of the extracted text information is smaller than the preset data volume, determining that the website is abnormal; otherwise, determining that the website is normal.
8. A computing device, comprising: the device comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete communication with each other through the communication bus;
the memory is configured to store at least one executable instruction, where the executable instruction causes the processor to perform operations corresponding to the website monitoring method as set forth in any one of claims 1 to 6.
9. A computer storage medium having stored therein at least one executable instruction for causing a processor to perform operations corresponding to the website monitoring method of any one of claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910877851.7A CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910877851.7A CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112528115A CN112528115A (en) | 2021-03-19 |
| CN112528115B true CN112528115B (en) | 2023-04-25 |
Family
ID=74974760
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910877851.7A Active CN112528115B (en) | 2019-09-17 | 2019-09-17 | Website monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112528115B (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3293661A1 (en) * | 2016-09-08 | 2018-03-14 | AO Kaspersky Lab | System and method for detecting anomalous elements of web pages |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050132205A1 (en) * | 2003-12-12 | 2005-06-16 | International Business Machines Corporation | Apparatus, methods and computer programs for identifying matching resources within a data processing network |
| CN108446227A (en) * | 2018-03-12 | 2018-08-24 | 广东睿江云计算股份有限公司 | A kind of virtual machine browser compatibility test method based on selenium |
| CN108809943B (en) * | 2018-05-14 | 2021-05-14 | 苏州闻道网络科技股份有限公司 | Website monitoring method and device |
| CN108846422B (en) * | 2018-05-28 | 2021-08-31 | 中国人民公安大学 | Account number association method and system across social networks |
| CN109325348B (en) * | 2018-09-13 | 2021-06-15 | 江苏通付盾信息安全技术有限公司 | Application security analysis method and device, computing equipment and computer storage medium |
-
2019
- 2019-09-17 CN CN201910877851.7A patent/CN112528115B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3293661A1 (en) * | 2016-09-08 | 2018-03-14 | AO Kaspersky Lab | System and method for detecting anomalous elements of web pages |
Non-Patent Citations (1)
| Title |
|---|
| 杨柳静等.应用交互式网络流模型的高速网络异常行为检测与控制.《西安交通大学学报》.2012,第46卷(第6期),第58-65页. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112528115A (en) | 2021-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108880921B (en) | Webpage monitoring method and device, storage medium and server | |
| CN111917740A (en) | Abnormal flow alarm log detection method, device, equipment and medium | |
| CN108491866B (en) | Pornographic picture identification method, electronic device and readable storage medium | |
| CN108563930A (en) | A kind of method, apparatus, medium and the system of confidential document addition watermark | |
| CN112511517B (en) | Mail detection method, device, equipment and medium | |
| CN103226688B (en) | The authentication method of the anti-tamper and anti-counterfeiting of a kind of Quick Response Code | |
| CN110545232A (en) | group message prompting method, group message prompting device, data processing method, data processing device, electronic equipment and storage equipment | |
| CN108809943B (en) | Website monitoring method and device | |
| CN111835769A (en) | Malicious traffic detection method, device, equipment and medium based on VGG neural network | |
| US20230418943A1 (en) | Method and device for image-based malware detection, and artificial intelligence-based endpoint detection and response system using same | |
| CN110855649A (en) | Method and device for detecting abnormal process in server | |
| CN116403083A (en) | Image processing method and device, electronic equipment and storage medium | |
| CN112069033B (en) | Page monitoring method and device, electronic equipment and storage medium | |
| CN112528115B (en) | Website monitoring method and device | |
| CN111967064A (en) | Webpage tamper-proofing method and system | |
| CN111782991A (en) | Method, device, equipment and storage medium for detecting abnormal hidden link of website | |
| CN113127878A (en) | Risk assessment method and device for threat event | |
| CN111310832A (en) | Picture duplicate checking method and system | |
| CN113411332B (en) | CORS vulnerability detection method, device, equipment and medium | |
| CN113888760B (en) | Method, device, equipment and medium for monitoring violation information based on software application | |
| CN106708605B (en) | Method and device for detecting resource leakage | |
| CN116263831A (en) | Webpage data tampering detection method and device, computing equipment and storage medium | |
| CN113628192A (en) | Image blur detection method, device, apparatus, storage medium, and program product | |
| US8631457B1 (en) | Method and apparatus for monitoring text-based communications to secure a computer | |
| CN113127855A (en) | Safety protection system and method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |