CN117768201A - Popup interception detection method, popup interception detection system, electronic equipment and storage medium - Google Patents

Abstract

The invention discloses a popup interception detection method, a popup interception detection system, electronic equipment and a storage medium, wherein the method comprises the following steps: generating a popup dictionary, wherein the popup dictionary comprises keywords and excluded words for intercepting popup and weight values corresponding to the words; detecting and collecting bullet window effective information; comparing the collected popup window effective information with keywords and exclusion words in a popup window dictionary, finding out matching words, respectively calculating the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values thereof, and obtaining a decision of whether interception is needed or not according to preset interception conditions; and carrying out interception according to the interception decision. The method and the device have the advantages that the problem of infinite enlargement of the feature library or the dictionary library is reduced by utilizing the combination mode of the keywords and the exclusion words, and the decision comparison speed is remarkably improved. Meanwhile, weight proportion calculation is added, hit rate and accuracy of bullet window interception are guaranteed, and misoperation is reduced. And the method does not depend on a network, and ensures high efficiency and high accuracy.

Description

Popup interception detection method, popup interception detection system, electronic equipment and storage medium

Technical Field

The present invention relates to the field of network security technologies, and in particular, to a method and system for detecting interception of a popup window, an electronic device, and a storage medium.

Background

With the increasing popularity of the internet, people use various systems, and some illegal network stations or malicious horse hanging viruses are pushed and spread through popup windows. The popup window cannot directly invade or cause property loss, but once a user mispoints, an attacker can obtain the account number and the password of the system/user so as to prepare for subsequent attacks. For individuals, money is stolen directly from the user, or his identity is stolen, which may lead to further financial losses. For enterprises, telnet service, POP3 service, mySQL service and the like can be logged in, and successful login can lead to high-risk events such as user information leakage, file sharing, mail leakage or incapability of normally sending mails. Malicious and illegal advertisements can further guide or acquire personal information, so that information leakage or property loss is caused. It is imperative to intercept some malicious popups.

At present, common popup window detection modes include: (1) intercepting based on popup attribute information or icons. The disadvantages of this approach are: the feature library needs to be updated regularly, and as the feature library is increasingly larger, the detection efficiency and timeliness are seriously affected, and meanwhile, the popup window or icon false alarm rate is higher. (2) intercept based on a popup URL or process. The disadvantages of this approach are: a large amount of URL or process information needs to be collected and maintained in real time, and when the library log increases, the detection efficiency is low. (3) implementing interception based on distributed detection of the network. The disadvantages of this approach are: the network bandwidth resource is occupied, data needs to be sent to the detection center first, then the detection result is returned, and blocking is easy to be caused when the data volume is large.

It can be seen that the existing popup window detection method still has obvious defects and drawbacks. Therefore, a new popup interception detection method, system, electronic equipment and storage medium are required to be created, so that the method can effectively improve interception accuracy and reduce false interception by generating a popup dictionary in advance, setting key words and exclusion words in the popup dictionary, combining weights of the words, and increasing calculation of weight proportion.

Disclosure of Invention

In view of the above, embodiments of the present invention provide a method for detecting interception of a popup window, which at least partially solves the problems existing in the prior art.

In a first aspect, an embodiment of the present invention provides a method for detecting interception of a popup window, where the method includes the following steps:

generating a popup dictionary, wherein the popup dictionary comprises keywords and excluded words for intercepting popup and weight values corresponding to the words;

detecting and collecting effective information of the popup window;

comparing the collected popup window effective information with keywords and exclusion words in the popup window dictionary, finding out matching words, respectively calculating the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values, and obtaining a decision of whether interception is needed or not according to preset interception conditions;

and carrying out interception according to the interception decision.

According to a specific implementation manner of the embodiment of the invention, the keywords, the exclusion words and the weight values thereof in the popup dictionary are added, deleted or modified through configuration parameters.

According to a specific implementation manner of the embodiment of the invention, the effective information of the popup window is detected and collected, wherein the effective information comprises popup window titles and popup window contents.

According to a specific implementation manner of the embodiment of the invention, the preset interception conditions are as follows: if the weight sum of the matched keywords is larger than the weight sum of the matched exclusion words, a decision that interception is needed is obtained.

In a second aspect, an embodiment of the present invention provides a popup interception detection system, including:

the popup dictionary generating module is configured to generate a popup dictionary, wherein the popup dictionary comprises keywords and excluded words for intercepting popup and weight values corresponding to the words;

the popup information mining module is configured to detect and collect effective information of popup;

the interception decision module is configured to compare the acquired popup effective information with the keywords and the exclusion words in the popup dictionary, find the matching words, respectively calculate the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values thereof, and then obtain a decision whether interception is needed or not according to preset interception conditions;

and the interception module is configured for implementing interception according to the interception decision.

According to a specific implementation manner of the embodiment of the invention, the system further comprises:

and the popup dictionary configuration module is configured for adding, deleting or modifying the keywords, the exclusion words and the weight values thereof in the popup dictionary through configuration parameters.

In a third aspect, embodiments of the present disclosure further provide an electronic device, including:

at least one processor; the method comprises the steps of,

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor, which when executed by the at least one processor, cause the at least one processor to perform the method of detection of a pop-up window as described in the first aspect or any implementation of the first aspect.

In a fourth aspect, the presently disclosed embodiments also provide a non-transitory computer-readable storage medium storing computer instructions that, when executed by at least one processor, cause the at least one processor to perform the method of bullet window interception detection in any one of the implementations of the first aspect or the first aspect.

In a fifth aspect, embodiments of the present disclosure also provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of detection of pop-up interception in any one of the implementations of the first aspect or the first aspect.

According to the popup window interception detection method, through the popup window dictionary rules of the keywords and the excluded words which are designated in advance, the problem of infinite enlargement of the feature library or the dictionary library can be reduced by combining the keywords and the excluded words, so that the volume of the popup window dictionary library is relatively fixed, frequent updating and maintenance are not needed, and the comparison speed in decision making can be remarkably improved. And by increasing the calculation of the weight proportion, the hit rate and accuracy of the bullet window interception can be further ensured, and the false interception is reduced.

The popup interception detection method does not need to depend on a network, reduces the consumption of data receiving and sending time and the delay of popup interception, abandons the network broadcasting type inquiry of a distributed type depending network, changes personalized small and precise positioning inquiry, and ensures high efficiency and high accuracy.

Drawings

The foregoing is merely an overview of the present invention, and the present invention is further described in detail below with reference to the accompanying drawings and detailed description.

FIG. 1 is a schematic diagram of an overall flow of a method for detecting a pop-up window interception according to an embodiment of the present invention;

FIG. 2 is a logic flow diagram of detecting and collecting effective information of a popup window in a popup window interception detection method according to an embodiment of the present invention;

FIG. 3 is a logic flow diagram of analysis and decision of popup information in a popup interception detection method according to an embodiment of the present invention;

FIG. 4 is a block diagram of a pop-up interception detection system according to an embodiment of the present invention; and

fig. 5 is a schematic diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

Embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

Other advantages and effects of the present disclosure will become readily apparent to those skilled in the art from the following disclosure, which describes embodiments of the present disclosure by way of specific examples. It will be apparent that the described embodiments are merely some, but not all embodiments of the present disclosure. The disclosure may be embodied or practiced in other different specific embodiments, and details within the subject specification may be modified or changed from various points of view and applications without departing from the spirit of the disclosure. It should be noted that the following embodiments and features in the embodiments may be combined with each other without conflict. All other embodiments, which can be made by one of ordinary skill in the art without inventive effort, based on the embodiments in this disclosure are intended to be within the scope of this disclosure.

Fig. 1 is a schematic overall flow chart of a method for detecting interception of a popup window according to this embodiment. As shown in fig. 1, an embodiment of the present invention provides a method for detecting interception of a popup window, including the following steps:

s1, generating a popup dictionary.

And storing the popup dictionary, namely storing popup keywords and the excluded word information to be intercepted into a file to form the popup dictionary.

The popup dictionary comprises keywords and exclusion words for intercepting popups and weight values corresponding to the words.

The keywords refer to identifying information such as words, domain names, special characters and the like contained in the popup windows needing to be intercepted. The exclusion word refers to the identification information of words, domain names, special characters and the like contained in the bullet window which needs to be intercepted.

S2, detecting and collecting effective information of the popup window.

For this step, the specific procedure is as shown in figure 2,

s2.1, whether the popup window pops up or not is detected by the circulating detection system.

If the spring is not popped up, a new round of detection is entered; if a popup is detected, S2.2 is entered.

S2.2, extracting key effective information such as popup titles, contents and the like.

And S2.3, storing the extracted effective information to a local disk.

S2.4, the extracted effective information is transmitted to a decision module, and the program for mining the popup information is ended.

And then, entering S3, comparing the acquired popup effective information with the keywords and the exclusion words in the popup dictionary, finding out the matching words, respectively calculating the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values, and obtaining a decision of whether interception is needed or not according to preset interception conditions.

For this step, the specific procedure is as shown in figure 3,

s3.1, circularly detecting whether the information of the mining module is received.

If not, entering the next round of detection; if received, go to S3.2.

S3.2, reading effective information stored by the mining module on the local disk.

And S3.3, using the effective information to match the key words and exclude word information in the popup dictionary, and storing which words are matched.

S3.4, respectively calculating the weight sum of the keywords and the weight sum of the excluded words according to the weight values of the matched words.

The specific weight formula is as follows:

M＝i _m1 +i _m2 +…+i _mx

N＝j _n1 +j _n2 +…+j _ny

wherein: m is the weight sum of the matched keywords, i is the weight value corresponding to the matched keywords, M1 and M2 … … mx respectively represent the matched keywords, and x is the number of the matched keywords.

N is the weight sum of the matched excluded words, j is the weight value corresponding to the matched excluded words, N1 and N2 … … ny respectively represent the matched excluded words, and y is the number of the matched excluded words.

S3.5, judging whether the keyword weight sum is larger than the exclusion word weight sum or not.

If M > N, making an interception decision, and entering S3.6; if not, the next round of detection is entered.

S3.6, sending an interception notification to the interception module, and ending the interception decision program.

And then, S4, according to the interception decision, the popup interception is implemented.

And the keywords, the exclusion words and the weight values thereof in the popup dictionary can be added, deleted or modified through configuration parameters.

According to the popup window interception detection method, by adopting the popup window dictionary library configured by the keywords and the excluded words and adding weight calculation, the problems that the conventional popup window detection feature library or dictionary library is large in size, slow in detection, and high in false interception rate, the feature library or dictionary library needs to be frequently updated can be effectively solved, the accuracy and the effectiveness of popup window detection are guaranteed with low cost and high efficiency, false alarm is reduced, and the environmental protection capability of the whole system is improved.

Fig. 4 shows a popup interception detection system 30 provided in this embodiment, which includes a popup dictionary generating module 301, a popup information mining module 302, an interception decision module 303, and an interception module 304.

The popup dictionary generating module 301 is configured to generate a popup dictionary, where the popup dictionary includes keywords and excluded words that intercept popup, and weight values corresponding to the words;

the popup information mining module 302 is configured to detect and collect valid information of a popup;

the interception decision module 303 is configured to compare the collected popup window effective information with the keywords and the exclusion words in the popup window dictionary, find a matching word, respectively calculate a matching keyword weight sum and a matching exclusion word weight sum according to the found matching word and the corresponding weight value thereof, and obtain a decision whether interception is required according to a preset interception condition;

the interception module 304 is configured to implement interception according to an interception decision.

Also, the pop-up intercept detection system 30 further includes a pop-up dictionary configuration module 300.

The popup dictionary configuration module 300 is configured to implement addition, deletion or modification of keywords, exclusion words and weight values thereof in the popup dictionary through configuration parameters.

Referring to fig. 5, the present embodiment also provides an electronic device 40, which includes:

at least one processor; the method comprises the steps of,

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the popup intercept detection method of the foregoing method embodiments.

The disclosed embodiments also provide a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the popup intercept detection method in the foregoing method embodiments.

The disclosed embodiments also provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of pop-up interception detection in the foregoing method embodiments.

Referring now to fig. 5, a schematic diagram of an electronic device 40 suitable for use in implementing embodiments of the present disclosure is shown. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 5 is merely an example and should not be construed to limit the functionality and scope of use of the disclosed embodiments.

As shown in fig. 5, the electronic device 40 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 401, which may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 402 or a program loaded from a storage means 408 into a Random Access Memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 40 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other by a bus 404. An input/output (I/O) interface 405 is also connected to bus 404.

In general, the following devices may be connected to the I/O interface 405: input devices 406 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; an output device 407 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 408 including, for example, magnetic tape, hard disk, etc.; and a communication device 409. The communication means 409 may allow the electronic device 40 to communicate with other devices wirelessly or by wire to exchange data. While an electronic device 40 having various means is shown in the figures, it should be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via communications device 409, or from storage 408, or from ROM 402. The above-described functions defined in the methods of the embodiments of the present disclosure are performed when the computer program is executed by the processing device 401.

It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device.

The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring at least two internet protocol addresses; sending a node evaluation request comprising the at least two internet protocol addresses to node evaluation equipment, wherein the node evaluation equipment selects an internet protocol address from the at least two internet protocol addresses and returns the internet protocol address; receiving an Internet protocol address returned by the node evaluation equipment; wherein the acquired internet protocol address indicates an edge node in the content distribution network.

Alternatively, the computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: receiving a node evaluation request comprising at least two internet protocol addresses; selecting an internet protocol address from the at least two internet protocol addresses; returning the selected internet protocol address; wherein the received internet protocol address indicates an edge node in the content distribution network.

Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units involved in the embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. The name of the unit does not in any way constitute a limitation of the unit itself, for example the first acquisition unit may also be described as "unit acquiring at least two internet protocol addresses".

It should be understood that portions of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.

The foregoing is merely specific embodiments of the disclosure, but the protection scope of the disclosure is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the disclosure are intended to be covered by the protection scope of the disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.

Claims (8)

1. A method for detecting interception of a popup window, comprising the steps of:

generating a popup dictionary, wherein the popup dictionary comprises keywords and excluded words for intercepting popup and weight values corresponding to the words;

detecting and collecting effective information of the popup window;

comparing the collected popup window effective information with keywords and exclusion words in the popup window dictionary, finding out matching words, respectively calculating the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values, and obtaining a decision of whether interception is needed or not according to preset interception conditions;

and carrying out interception according to the interception decision.

2. The method for detecting the interception of the popup window according to claim 1, wherein the keyword, the exclusion word and the weight value thereof in the popup window dictionary are added, deleted or modified by configuration parameters.

3. The method of claim 2, wherein detecting and collecting valid information for a popup includes popup header and popup content.

4. The popup interception detection method according to claim 3, wherein the preset interception condition is: if the weight sum of the matched keywords is larger than the weight sum of the matched exclusion words, a decision that interception is needed is obtained.

5. A pop-up intercept detection system, the system comprising:

the popup dictionary generating module is configured to generate a popup dictionary, wherein the popup dictionary comprises keywords and excluded words for intercepting popup and weight values corresponding to the words;

the popup information mining module is configured to detect and collect effective information of popup;

the interception decision module is configured to compare the acquired popup effective information with the keywords and the exclusion words in the popup dictionary, find the matching words, respectively calculate the weight sum of the matching keywords and the weight sum of the matching exclusion words according to the found matching words and the corresponding weight values thereof, and then obtain a decision whether interception is needed or not according to preset interception conditions;

and the interception module is configured for implementing interception according to the interception decision.

6. The pop-up window intercept detection system of claim 5, further comprising:

and the popup dictionary configuration module is configured for adding, deleting or modifying the keywords, the exclusion words and the weight values thereof in the popup dictionary through configuration parameters.

7. An electronic device, comprising:

at least one processor; the method comprises the steps of,

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor, which when executed by the at least one processor, cause the at least one processor to perform the popup intercept detection method of any of claims 1 to 4.

8. A non-transitory computer-readable storage medium storing computer instructions that, when executed by at least one processor, cause the at least one processor to perform the popup intercept detection method of any of claims 1 to 4.