WO2014059934A1 - Method and apparatus for detecting hidden content of web page - Google Patents

Method and apparatus for detecting hidden content of web page Download PDF

Info

Publication number
WO2014059934A1
WO2014059934A1 PCT/CN2013/085367 CN2013085367W WO2014059934A1 WO 2014059934 A1 WO2014059934 A1 WO 2014059934A1 CN 2013085367 W CN2013085367 W CN 2013085367W WO 2014059934 A1 WO2014059934 A1 WO 2014059934A1
Authority
WO
WIPO (PCT)
Prior art keywords
web page
layout
hidden
description information
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2013/085367
Other languages
French (fr)
Inventor
Yongjian LI
Jiwen ZHOU
Yang Yu
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Publication of WO2014059934A1 publication Critical patent/WO2014059934A1/en
Priority to US14/688,314 priority Critical patent/US9979746B2/en
Anticipated expiration legal-status Critical
Priority to US15/959,693 priority patent/US10333972B2/en
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to communication technologies, more particularly to, a method and apparatus for detecting hidden content of a web page.
  • HTML Hypertext Markup Language
  • the hacker may configure in the HTML, configure in a Cascading Style Sheet (CSS) file via a CSS selector, or configure property settings of a web page node via JavaScript which is a programming language.
  • CSS Cascading Style Sheet
  • the HTML, CSS and JavaScript commonly used by the hacker are collected, general text string characteristics are extracted, and the general text string characteristics are used to detect the hidden chain in the web page.
  • JavaScript codes of the web page are executed by using an open source JavaScript engine, if it is found that executed codes has a function of hiding external links, it is determined that the page is hung with the hidden chain.
  • various hidden link codes may be generated by combining the HTML, CSS, and JavaScript, and the JavaScript as a front programming language may encrypt malicious code, so that it is easy to bypass the static detection.
  • the hidden codes encrypted by the JavaScript may be detected by using the dynamic detection, but no processing is performed for the CSS and HTML, so that the web page with the hidden content added by using a deformation HTML + CSS mode cannot be recognized. Therefore, accuracy rate of detecting the hidden content by using each of the two detection modes is not high.
  • the examples of the present invention provide a method and apparatus for detecting hidden content of a web page, so as to improve accuracy rate of detecting the hidden content of the web page.
  • a method for detecting hidden content of a web page includes:
  • An apparatus for detecting hidden content of a web page includes:
  • a loading unit configured to load a web page and to generate description information of a web page and generate layout information of the web page
  • a comparing unit configured to compare the description information of the web page with the layout information of the web page according to a preconfigured rule, and further to determine whether all tag nodes comprised in the description information of the web page are contained in the layout information of the web page;
  • a content determining unit configured to determine at least one tag node, which being comprised in the description information of the web page and not being contained in the layout information of the web page, as hidden content.
  • the purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content.
  • the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
  • Figure 1 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention.
  • Figure 2 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention.
  • Figure 3 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
  • Figure 4 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
  • Figure 5 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
  • the phrase "at least one of A, B, and C" should be construed to mean a logical (A or B or C), using a non-exclusive logical OR. It should be understood that one or more steps within a method may be executed in different order (or concurrently) without altering the principles of the present disclosure.
  • module may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC); an electronic circuit; a combinational logic circuit; a field programmable gate array (FPGA); a processor (shared, dedicated, or group) that executes code; other suitable hardware components that provide the described functionality; or a combination of some or all of the above, such as in a system-on-chip.
  • ASIC Application Specific Integrated Circuit
  • FPGA field programmable gate array
  • processor shared, dedicated, or group
  • the term module may include memory (shared, dedicated, or group) that stores code executed by the processor.
  • code may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, and/or objects.
  • shared means that some or all code from multiple modules may be executed using a single (shared) processor. In addition, some or all code from multiple modules may be stored by a single (shared) memory.
  • group means that some or all code from a single module may be executed using a group of processors. In addition, some or all code from a single module may be stored using a group of memories.
  • the systems and methods described herein may be implemented by one or more computer programs executed by one or more processors.
  • the computer programs include processor-executable instructions that are stored on a non-transitory tangible computer readable medium.
  • the computer programs may also include stored data.
  • Non-limiting examples of the non-transitory tangible computer readable medium are nonvolatile memory, magnetic storage, and optical storage.
  • this disclosure in one aspect, relates to method and apparatus for detecting hidden content of a web page.
  • Examples of mobile terminals that can be used in accordance with various embodiments include, but are not limited to, a tablet PC (including, but not limited to, Apple iPad and other touch-screen devices running Apple iOS, Microsoft Surface and other touch- screen devices running the Windows operating system, and tablet devices running the Android operating system), a mobile phone, a smartphone (including, but not limited to, an Apple iPhone, a Windows Phone and other smartphones running Windows Mobile or Pocket PC operating systems, and smartphones running the Android operating system, the Blackberry operating system, or the Symbian operating system), an e-reader (including, but not limited to, Amazon Kindle and Barnes & Noble Nook), a laptop computer (including, but not limited to, computers running Apple Mac operating system, Windows operating system, Android operating system and/or Google Chrome operating system), or an on- vehicle device running any of the above-mentioned operating systems or any other operating systems, all of which are well known to one skilled in the art.
  • a tablet PC including, but not limited to, Apple iPad and other touch-screen devices running Apple iOS, Microsoft Surface and other
  • Figure 1 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention. As shown in Figure 1, the method includes the following processing.
  • the web page is loaded by using a layout engine, and before loading the web page by using the layout engine, a user-agent character string of the layout engine is configured as a search engine.
  • a Uniform / Universal Resource Locator (URL) is loaded by using the layout engine, returned HTML codes are parsed, and other elements in a page corresponding to the returned HTML codes are loaded.
  • the other elements may be CSS, JavaScript and etc., which is not limited in the examples of the present invention.
  • the layout engine is an open-source browser layout engine, e.g. a webkit, the description information of the web page is a Document Object Model (DOM) tree; the layout information of the web page is a render tree.
  • the layout engine is a tool for configuring the layout of the web page and is not limited to the webkit according to various examples.
  • the description information and the layout information are not limited to the DOM tree and the render tree respectively.
  • the web page is loaded by using the webkit, and the DOM tree and the render tree are generated.
  • the description information of the web page is compared with the layout information of the web page, and it is determined whether all tag nodes included in the description information of the web page are included in the layout information of the web page. If not all tag nodes included in the description information of the web page are included in the layout information of the web page, processing at 103 is performed.
  • the layout engine is the webkit
  • the description information of the web page is the DOM tree
  • the layout information of the web page is the render tree
  • the DOM tree is compared with the render tree and it is determined whether all tag nodes included in the DOM tree are included in the render tree. Further, the description information of the web page is compared with the layout information of the web page, after the description information of the web page and the layout information of the web page are generated and a preset delay time period expires.
  • the preset delay time period may be configured according to time period needed for e.g. loading the web page, such as 5 second, which is not limited in the examples of the present application.
  • At 103 at least one tag node included in the description information of the web page and not contained in the layout information of the web page is determined as hidden content.
  • the layout engine is the webkit
  • the description information of the web page is the DOM tree and the layout information of the web page is the render tree
  • if not all tag nodes of the DOM tree are included in the render tree at least one tag node included in the DOM tree and not contained in the render tree is determined as the hidden content.
  • the purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content.
  • the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus the method for detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
  • the examples of the present invention also provide a solution for identify a hidden chain.
  • the hidden content are tag nodes having a function of pointing to a
  • the tag node having the function of pointing to the URL may be: a ⁇ a> tag node.
  • the introduction of the ⁇ a> tag node are as following.
  • ⁇ a> tag may define an anchor, and the anchor generally has the following two usages.
  • the layout engine is the webkit
  • the description information of the web page is the DOM tree
  • the layout information of the web page is the render tree
  • the solutions are described.
  • a dom tree and a render tree are constructed in a memory.
  • the dom tree is used to describe information of a HTML page.
  • the render tree is used to describe the layout of the HTML page, i.e. how to display the dom tree on the screen.
  • the webkit determines whether each node of the dom tree is in a hidden state according to a result of parsing the CSS and JavaScript. If the node of the dom tree is in the hidden state, the node is not added to the render tree when constructing the render tree.
  • the procedure includes the following processing.
  • a URL is input.
  • the User- Agent of the webkit is configured as a common search engine.
  • the URL is visited. Specifically, the URL is loaded by using the webkit, a returned HTML code is parsed, and other elements of a web page, e.g. CSS, JavaScript are loaded. A time period is taken to wait for the execution of the JavaScript, e.g. the time period may be 5 second. The time period may be configured flexibly according to various examples.
  • a dom tree and a render tree are generated.
  • processing at 208 is performed; if there is no a tag node in the hidden nodes of the dom tree, processing at 206 is performed.
  • HTML, CSS, JavaScript are taken as examples and are used to limit the scope of the present invention.
  • Examples of the present application also provide an apparatus for detecting hidden content of a web page.
  • the apparatus may be located in a terminal device, e.g. a PC, a mobile terminal and etc.
  • FIG 3 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
  • the apparatus includes a loading unit 301, a comparing unit 302 and a content determining unit 303.
  • the loading unit 301 is to generate description information of a web page and layout information of the web page, by loading the web page.
  • the comparing unit 302 is to compare the description information of the web page with the layout information of the web page, and determine whether all tag nodes included in the description information of the web page are included in the layout information of the web page.
  • the content determining unit 303 is to determine at least one tag node included in the description information of the web page and not contained in the layout information of the web page as hidden content, when the comparing unit determines that not all tag nodes included in the description information of the web page are included in the layout information of the web page.
  • the purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content. According to the above example, the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus the method for detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
  • the comparing unit is to, after generating the description information of the web page and the layout information of the web page and a preset delay time period expires, compare the description information of the web page with the layout information of the web page, determine whether all tag nodes included in the description information of the web page are included in the layout information of the web page.
  • the loading unit 301 is further to load the web page by using the webkit.
  • the apparatus further comprises a loading controlling unit 401.
  • the loading controlling unit 401 is to, before loading the web page by using the layout engine, configure a user-agent of the layout engine as a search engine.
  • the loading unit 301 is to load a URL by using the layout engine, parse returned HTML codes, and load other elements in a page corresponding to the returned HTML codes.
  • the other elements include CSS, JavaScript and etc., which is not limited in the example of the present application.
  • the load unit 301 is to load the web page by using a webkit and generate a dom tree and a render tree.
  • the comparing unit 302 is to compare the DOM tree with the render tree, determine whether all tag nodes included in the DOM tree are included in the render tree.
  • the content determining unit 303 is to determine at least one tag node included in the DOM tree and not contained in the render tree as the hidden content, when the comparing unit 302 determines that not all tag nodes included in the DOM tree are included in the render tree.
  • the layout engine is a tool for configuring the layout of the web page and is not limited in webkit according to various examples.
  • the description information and the layout information are not limited to the DOM tree and the render tree respectively.
  • the apparatus includes a content determining sub-unit 501.
  • the content determining sub-unit 501 is to determining that the web page is hung with a hidden chain, if the hidden content are tag nodes having a function of pointing to a URL and the tag node having the function of pointing to the URL points to an external link.
  • Machine-readable instructions used in the examples disclosed herein may be stored in storage medium readable by multiple processors, such as hard drive, CD-ROM, DVD, compact disk, floppy disk, magnetic tape drive, RAM, ROM or other proper storage device. Or, at least part of the machine-readable instructions may be substituted by specific -purpose hardware, such as custom integrated circuits, gate array, FPGA, PLD and specific -purpose computers and so on.
  • a machine-readable storage medium is also provided, which is to store instructions to cause a machine to execute a method as described herein.
  • a system or apparatus having a storage medium that stores machine-readable program codes for implementing functions of any of the above examples and that may make the system or the apparatus (or CPU or MPU) read and execute the program codes stored in the storage medium.
  • the program codes read from the storage medium may implement any one of the above examples, thus the program codes and the storage medium storing the program codes are part of the technical scheme.
  • the storage medium for providing the program codes may include floppy disk, hard drive, magneto-optical disk, compact disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tape drive, Flash card, ROM and so on.
  • the program code may be downloaded from a server computer via a communication network.
  • program codes implemented from a storage medium are written in storage in an extension board inserted in the computer or in storage in an extension unit connected to the computer.
  • a CPU in the extension board or the extension unit executes at least part of the operations according to the instructions based on the program codes to realize a technical scheme of any of the above examples.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Information Transfer Between Computers (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

According to an example, a web page is loaded and description information of the web page and layout information of the web page are generated, the description information of the web page is compared with the layout information of the web page, whether all tag nodes comprised in the description information of the web page are comprised in the layout information of the web page is determined, and it is determined at least one tag node, which being comprised in the description information of the web page and not contained in the layout information of the web page, as hidden content.

Description

Method and Apparatus for Detecting Hidden Content of Web
Page
Field of the Invention
The present invention relates to communication technologies, more particularly to, a method and apparatus for detecting hidden content of a web page.
Background of the Invention
Currently, when hanging a hidden chain which is also called a black chain, a hacker always configures an attribute of a Hypertext Markup Language (HTML) tag as display: none, by using many modes. For example, the hacker may configure in the HTML, configure in a Cascading Style Sheet (CSS) file via a CSS selector, or configure property settings of a web page node via JavaScript which is a programming language.
When hanging the hidden chain, the hacker modifies page content of a normal website. Hidden links pointing to other websites are added in a normal web page, and thus the number of external links of a target website is improved. The external link is a link pointing to a Uniform/Universal Resource Locator (URL) under a nonlocal domain name. The hung hidden chain is hidden content of the web page. Traditional detection modes are as follows.
In a static detection mode, the HTML, CSS and JavaScript commonly used by the hacker are collected, general text string characteristics are extracted, and the general text string characteristics are used to detect the hidden chain in the web page.
In a dynamic detection mode, JavaScript codes of the web page are executed by using an open source JavaScript engine, if it is found that executed codes has a function of hiding external links, it is determined that the page is hung with the hidden chain.
Because various hidden link codes may be generated by combining the HTML, CSS, and JavaScript, and the JavaScript as a front programming language may encrypt malicious code, so that it is easy to bypass the static detection. The hidden codes encrypted by the JavaScript may be detected by using the dynamic detection, but no processing is performed for the CSS and HTML, so that the web page with the hidden content added by using a deformation HTML + CSS mode cannot be recognized. Therefore, accuracy rate of detecting the hidden content by using each of the two detection modes is not high.
Summary of the Invention
The examples of the present invention provide a method and apparatus for detecting hidden content of a web page, so as to improve accuracy rate of detecting the hidden content of the web page.
A method for detecting hidden content of a web page includes:
loading a web page;
generating description information of the web page and generating layout information of the web page;
comparing the description information of the web page with the layout information of the web page according to a preconfigured rule;
determining whether all tag nodes comprised in the description information of the web page are contained in the layout information of the web page; and
determining at least one tag node, which being comprised in the description information of the web page and not being contained in the layout information of the web page, as hidden content.
An apparatus for detecting hidden content of a web page includes:
a loading unit, configured to load a web page and to generate description information of a web page and generate layout information of the web page;
a comparing unit, configured to compare the description information of the web page with the layout information of the web page according to a preconfigured rule, and further to determine whether all tag nodes comprised in the description information of the web page are contained in the layout information of the web page; and
a content determining unit, configured to determine at least one tag node, which being comprised in the description information of the web page and not being contained in the layout information of the web page, as hidden content.
The purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content. According to the examples of the present application, the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
Brief Description of the Drawings
Figure 1 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention.
Figure 2 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention.
Figure 3 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
Figure 4 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
Figure 5 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention.
Detailed Description of the Invention
The examples of the present application provide the following technical solutions.
The following description is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of the disclosure can be implemented in a variety of forms. Therefore, while this disclosure includes particular examples, the true scope of the disclosure should not be so limited since other modifications will become apparent upon a study of the drawings, the specification, and the following claims. For purposes of clarity, the same reference numbers will be used in the drawings to identify similar elements.
The terms used in this specification generally have their ordinary meanings in the art, within the context of the disclosure, and in the specific context where each term is used. Certain terms that are used to describe the disclosure are discussed below, or elsewhere in the specification, to provide additional guidance to the practitioner regarding the description of the disclosure. The use of examples anywhere in this specification, including examples of any terms discussed herein, is illustrative only, and in no way limits the scope and meaning of the disclosure or of any exemplified term. Likewise, the disclosure is not limited to various embodiments given in this specification.
Reference throughout this specification to "one embodiment," "an embodiment," "specific embodiment," or the like in the singular or plural means that one or more particular features, structures, or characteristics described in connection with an embodiment is included in at least one embodiment of the present disclosure. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment," "in a specific embodiment," or the like in the singular or plural in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. As used in the description herein and throughout the claims that follow, the meaning of "a", "an", and "the" includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein and throughout the claims that follow, the meaning of "in" includes "in" and "on" unless the context clearly dictates otherwise.
As used herein, the terms "comprising," "including," "having," "containing," "involving," and the like are to be understood to be open-ended, i.e., to mean including but not limited to.
As used herein, the phrase "at least one of A, B, and C" should be construed to mean a logical (A or B or C), using a non-exclusive logical OR. It should be understood that one or more steps within a method may be executed in different order (or concurrently) without altering the principles of the present disclosure.
As used herein, the term "module" may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC); an electronic circuit; a combinational logic circuit; a field programmable gate array (FPGA); a processor (shared, dedicated, or group) that executes code; other suitable hardware components that provide the described functionality; or a combination of some or all of the above, such as in a system-on-chip. The term module may include memory (shared, dedicated, or group) that stores code executed by the processor.
The term "code", as used herein, may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, and/or objects. The term "shared", as used herein, means that some or all code from multiple modules may be executed using a single (shared) processor. In addition, some or all code from multiple modules may be stored by a single (shared) memory. The term "group", as used herein, means that some or all code from a single module may be executed using a group of processors. In addition, some or all code from a single module may be stored using a group of memories.
The systems and methods described herein may be implemented by one or more computer programs executed by one or more processors. The computer programs include processor-executable instructions that are stored on a non-transitory tangible computer readable medium. The computer programs may also include stored data. Non-limiting examples of the non-transitory tangible computer readable medium are nonvolatile memory, magnetic storage, and optical storage.
The description will be made as to the various embodiments in conjunction with the accompanying drawings in FIGS. 1-5. It should be understood that specific embodiments described herein are merely intended to explain the present disclosure, but not intended to limit the present disclosure. In accordance with the purposes of this disclosure, as embodied and broadly described herein, this disclosure, in one aspect, relates to method and apparatus for detecting hidden content of a web page.
Examples of mobile terminals that can be used in accordance with various embodiments include, but are not limited to, a tablet PC (including, but not limited to, Apple iPad and other touch-screen devices running Apple iOS, Microsoft Surface and other touch- screen devices running the Windows operating system, and tablet devices running the Android operating system), a mobile phone, a smartphone (including, but not limited to, an Apple iPhone, a Windows Phone and other smartphones running Windows Mobile or Pocket PC operating systems, and smartphones running the Android operating system, the Blackberry operating system, or the Symbian operating system), an e-reader (including, but not limited to, Amazon Kindle and Barnes & Noble Nook), a laptop computer (including, but not limited to, computers running Apple Mac operating system, Windows operating system, Android operating system and/or Google Chrome operating system), or an on- vehicle device running any of the above-mentioned operating systems or any other operating systems, all of which are well known to one skilled in the art.
Figure 1 is a schematic flowchart illustrating a method for detecting hidden content of a web page according to various examples of the present invention. As shown in Figure 1, the method includes the following processing.
At 101, by loading a web page, description information of the web page and layout information of the web page are generated.
According to an example, the web page is loaded by using a layout engine, and before loading the web page by using the layout engine, a user-agent character string of the layout engine is configured as a search engine.
Currently, many hackers determine whether a web page is visited by a common user or by a search engine crawler according to the user- agent. The hacker only returns a page with Search Engine Optimization (SEO) to the search engine crawler, and returns normal content to the common user. It is different for network managers to detect abnormal states of the web site. According to the example, when the user-agent of the layout engine is configured as the search engine, the above problem is solved, and accuracy of detecting the hidden content of the web page is further improved.
When the web page is loaded by using the layout engine, a Uniform / Universal Resource Locator (URL) is loaded by using the layout engine, returned HTML codes are parsed, and other elements in a page corresponding to the returned HTML codes are loaded. The other elements may be CSS, JavaScript and etc., which is not limited in the examples of the present invention.
According to an example, the layout engine is an open-source browser layout engine, e.g. a webkit, the description information of the web page is a Document Object Model (DOM) tree; the layout information of the web page is a render tree. It should be noted that, the layout engine is a tool for configuring the layout of the web page and is not limited to the webkit according to various examples. Similarly, according to various examples, the description information and the layout information are not limited to the DOM tree and the render tree respectively.
Accordingly, at 101, the web page is loaded by using the webkit, and the DOM tree and the render tree are generated.
At 102, the description information of the web page is compared with the layout information of the web page, and it is determined whether all tag nodes included in the description information of the web page are included in the layout information of the web page. If not all tag nodes included in the description information of the web page are included in the layout information of the web page, processing at 103 is performed.
If all tag nodes included in the description information of the web page are included in the layout information of the web page, it indicates that the web page does not have hidden content, and the procedure is terminated. According to an example, at 102, when the layout engine is the webkit, the description information of the web page is the DOM tree, and the layout information of the web page is the render tree, the DOM tree is compared with the render tree and it is determined whether all tag nodes included in the DOM tree are included in the render tree. Further, the description information of the web page is compared with the layout information of the web page, after the description information of the web page and the layout information of the web page are generated and a preset delay time period expires.
According to an example, the preset delay time period may be configured according to time period needed for e.g. loading the web page, such as 5 second, which is not limited in the examples of the present application.
At 103, at least one tag node included in the description information of the web page and not contained in the layout information of the web page is determined as hidden content. According to an example, at 103, when the layout engine is the webkit, the description information of the web page is the DOM tree and the layout information of the web page is the render tree, if not all tag nodes of the DOM tree are included in the render tree, at least one tag node included in the DOM tree and not contained in the render tree is determined as the hidden content.
The purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content. According to the above example, the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus the method for detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
The examples of the present invention also provide a solution for identify a hidden chain. In the solution, if the hidden content are tag nodes having a function of pointing to a
URL and the tag node having the function of pointing to the URL points to an external link, it is determined that the web page is hung with a hidden chain.
The tag node having the function of pointing to the URL may be: a <a> tag node. The introduction of the <a> tag node are as following. <a> tag may define an anchor, and the anchor generally has the following two usages.
1. establishing a link or a hyperlink pointing to another document, by using a Hypertext Reference (href) attribute.
2. establishing a mark inside a document, by using a name or Identifier attribute, that is, establishing a link pointing to a document segment.
In the following example, the layout engine is the webkit, the description information of the web page is the DOM tree and the layout information of the web page is the render tree, and the solutions are described. In the procedure of rending the web page by using the webkit, a dom tree and a render tree are constructed in a memory. The dom tree is used to describe information of a HTML page. The render tree is used to describe the layout of the HTML page, i.e. how to display the dom tree on the screen. In the procedure of constructing the dom tree as the render tree, the webkit determines whether each node of the dom tree is in a hidden state according to a result of parsing the CSS and JavaScript. If the node of the dom tree is in the hidden state, the node is not added to the render tree when constructing the render tree.
By comparing the dom tree and the render tree, many elements included in the dom tree is not contained in the generated render tree. Therefore, by determining whether the nodes included in the dom tree is the same as the nodes included in the render tree, whether the web page has hidden content is determined. Then whether the <a> tag node is included in the hidden content is determined to further determine whether a link is hidden. As shown in Figure 2, the procedure includes the following processing.
At 201, a URL is input.
At 202, the User- Agent of the webkit is configured as a common search engine.
At 203, the URL is visited. Specifically, the URL is loaded by using the webkit, a returned HTML code is parsed, and other elements of a web page, e.g. CSS, JavaScript are loaded. A time period is taken to wait for the execution of the JavaScript, e.g. the time period may be 5 second. The time period may be configured flexibly according to various examples.
At 204, a dom tree and a render tree are generated.
At 205, it is determined whether all HTML tag nodes included in the dom tree is included in the render tree. If all HTML tag nodes included in the dom tree is included in the render tree, processing at 206 is performed. If not all HTML tag nodes included in the dom tree is included in the render tree, it is indicated that the tag node of the dom tree is hidden, and processing at 207 is performed. At 206, it is determined that the web page is not hung with a hidden chain.
At 207, it is determined whether there are several a tag nodes in the hidden tag nodes of the dom tree. If there are several a tag nodes in the hidden tag nodes of the dom tree, processing at 208 is performed; if there is no a tag node in the hidden nodes of the dom tree, processing at 206 is performed.
At 208, it is determined that the web page is hung with a hidden chain.
It should be noted that, many languages may be used for editing web pages, various languages have different characteristics, and different modes for hiding content are used. In the examples of the present invention, the HTML, CSS, JavaScript are taken as examples and are used to limit the scope of the present invention.
Examples of the present application also provide an apparatus for detecting hidden content of a web page. The apparatus may be located in a terminal device, e.g. a PC, a mobile terminal and etc.
Figure 3 is a schematic diagram illustrating a structure of an apparatus for detecting hidden content of a web page according to various examples of the present invention. As shown in Figure 3, the apparatus includes a loading unit 301, a comparing unit 302 and a content determining unit 303.
The loading unit 301 is to generate description information of a web page and layout information of the web page, by loading the web page. The comparing unit 302 is to compare the description information of the web page with the layout information of the web page, and determine whether all tag nodes included in the description information of the web page are included in the layout information of the web page.
The content determining unit 303 is to determine at least one tag node included in the description information of the web page and not contained in the layout information of the web page as hidden content, when the comparing unit determines that not all tag nodes included in the description information of the web page are included in the layout information of the web page. The purpose of configuring hidden content in the web page is not to display content to be hidden on the screen after the browser layouts the content. According to the above example, the page is loaded by the layout engine, the description information and layout information of the web page are generated, the description information are compared with the layout information, and thus the method for detecting the hidden content is not affected by the types or encryption, thereby accurately detecting the hidden content and improving accuracy of detecting the hidden content of the web page.
According to an example, the comparing unit is to, after generating the description information of the web page and the layout information of the web page and a preset delay time period expires, compare the description information of the web page with the layout information of the web page, determine whether all tag nodes included in the description information of the web page are included in the layout information of the web page.
Moreover, as shown in Figure 4, the loading unit 301 is further to load the web page by using the webkit. The apparatus further comprises a loading controlling unit 401.
The loading controlling unit 401 is to, before loading the web page by using the layout engine, configure a user-agent of the layout engine as a search engine.
Many hackers determine whether a web page is visited by a common user or by a search engine crawler according to the user-agent. The hacker only returns a page with SEO to the search engine crawler, and returns normal content to the common user, and thus it is different for network managers to detect abnormal states of the web site. According to the example, when the user-agent of the layout engine is configured as the search engine, the above problem is solved, thereby further improving the accuracy of detecting the hidden content of the web page. According to an example, the loading unit 301 is to load a URL by using the layout engine, parse returned HTML codes, and load other elements in a page corresponding to the returned HTML codes. The other elements include CSS, JavaScript and etc., which is not limited in the example of the present application.
According to an example, the load unit 301 is to load the web page by using a webkit and generate a dom tree and a render tree.
The comparing unit 302 is to compare the DOM tree with the render tree, determine whether all tag nodes included in the DOM tree are included in the render tree.
The content determining unit 303 is to determine at least one tag node included in the DOM tree and not contained in the render tree as the hidden content, when the comparing unit 302 determines that not all tag nodes included in the DOM tree are included in the render tree.
It should be noted that, the layout engine is a tool for configuring the layout of the web page and is not limited in webkit according to various examples. Similarly, according to various examples, the description information and the layout information are not limited to the DOM tree and the render tree respectively.
According to an example, a solution for identifying a black link is provided. As shown Figure 5, the apparatus includes a content determining sub-unit 501.
The content determining sub-unit 501 is to determining that the web page is hung with a hidden chain, if the hidden content are tag nodes having a function of pointing to a URL and the tag node having the function of pointing to the URL points to an external link.
It should be noted that, in the above examples, the units are divided according logic functions. The methods and modules described herein may be implemented by hardware, machine -readable instructions or a combination of hardware and machine-readable instructions. Machine-readable instructions used in the examples disclosed herein may be stored in storage medium readable by multiple processors, such as hard drive, CD-ROM, DVD, compact disk, floppy disk, magnetic tape drive, RAM, ROM or other proper storage device. Or, at least part of the machine-readable instructions may be substituted by specific -purpose hardware, such as custom integrated circuits, gate array, FPGA, PLD and specific -purpose computers and so on.
A machine-readable storage medium is also provided, which is to store instructions to cause a machine to execute a method as described herein. Specifically, a system or apparatus having a storage medium that stores machine-readable program codes for implementing functions of any of the above examples and that may make the system or the apparatus (or CPU or MPU) read and execute the program codes stored in the storage medium.
In this situation, the program codes read from the storage medium may implement any one of the above examples, thus the program codes and the storage medium storing the program codes are part of the technical scheme.
The storage medium for providing the program codes may include floppy disk, hard drive, magneto-optical disk, compact disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tape drive, Flash card, ROM and so on. Optionally, the program code may be downloaded from a server computer via a communication network.
It should be noted that, alternatively to the program codes being executed by a computer, at least part of the operations performed by the program codes may be implemented by an operation system running in a computer following instructions based on the program codes to realize a technical scheme of any of the above examples.
In addition, the program codes implemented from a storage medium are written in storage in an extension board inserted in the computer or in storage in an extension unit connected to the computer. In this example, a CPU in the extension board or the extension unit executes at least part of the operations according to the instructions based on the program codes to realize a technical scheme of any of the above examples.
The foregoing is only preferred examples of the present invention and is not used to limit the protection scope of the present invention. Any modification, equivalent substitution and improvement without departing from the spirit and principle of the present invention are within the protection scope of the present invention.

Claims

Claims
1. A method for detecting hidden content of a web page, comprising:
loading a web page;
generating description information of the web page and generating layout information of the web page;
comparing the description information of the web page with the layout information of the web page according to a preconfigured rule;
determining whether all tag nodes comprised in the description information of the web page are contained in the layout information of the web page; and
determining at least one tag node, which being comprised in the description information of the web page and not being contained in the layout information of the web page, as hidden content.
2. The method of claim 1, wherein comparing the description information of the web page with the layout information of the web page comprises:
after a preset delay time period expires, comparing the description information of the web page with the layout information of the web page.
3. The method of claim 1, wherein loading the web page comprises:
configuring a user-agent character string of an layout engine as a search engine; loading the web page by using the layout engine.
4. The method of claim 3, wherein loading the web page by using the layout engine comprises:
loading a Uniform/Universal Resource Locator (URL) by using the layout engine; parsing returned HTML codes; and loading other elements in a page corresponding to the returned HTML codes.
5. The method of claims 3 or 4, wherein
the layout engine is a is an open-source browser layout engine; the description information of the web page is a Document Object Model (DOM) tree; and the layout information of the web page is a render tree.
6. The method of any of claims 1 to 4, further comprising:
determining whether the web page is hung with a hidden chain according to the hidden content.
7. The method of claim 6, wherein determining whether the web page comprises a hidden chain according to the hidden content comprises:
if the hidden content is a tag node having a function of pointing to a URL, and the tag node having the function of pointing to the URL points to an external link, determining that the web page is hung with the hidden chain.
8. An apparatus for detecting hidden content of a web page, comprising:
a loading unit, configured to load a web page and to generate description information of a web page and generate layout information of the web page;
a comparing unit, configured to compare the description information of the web page with the layout information of the web page according to a preconfigured rule, and further to determine whether all tag nodes comprised in the description information of the web page are contained in the layout information of the web page; and
a content determining unit, configured to determine at least one tag node, which being comprised in the description information of the web page and not being contained in the layout information of the web page, as hidden content.
9. The apparatus of claim 8, wherein
the comparing unit is to, after a preset delay time period expires, compare the description information of the web page with the layout information of the web page, determine whether all tag nodes comprised in the description information of the web page are comprised in the layout information of the web page.
10. The apparatus of claim 8, further comprising:
a loading controlling unit, to configure a user-agent character string of an layout engine as a search engine;
wherein the loading unit is to loading the web page by using a layout engine.
11. The apparatus of claim 10, wherein
the loading unit is to load a Uniform/Universal Resource Locator (URL) by using the layout engine; parse returned HTML codes; and load other elements in a page corresponding to the returned HTML code.
12. The apparatus of claims 10 or 11, wherein
the loading unit is to loading the web page by using an open- source browser layout engine, generate a Document Object Model (DOM) tree and a render tree;
the comparing unit is to compare the DOM tree with the render tree, determine whether all tag nodes comprised in the DOM tree are comprised in the render tree; a content determining unit, to determine at least one tag node comprised in the DOM tree and not contained in the render tree as hidden content, when the comparing unit determines that not all tag nodes comprised in the DOM tree are comprised in the render tree.
13. The apparatus of any of claims 8 to 11, further comprising:
a content determining sub-unit, to determining whether the web page is hung with a hidden chain according to the hidden content.
14. The apparatus of claim 13, wherein
the content determining sub-unit is to determine that the web page is hung with the hidden chain, if the hidden content is a tag node having a function of pointing to a URL and the tag node having the function of pointing to the URL points to an external link.
PCT/CN2013/085367 2012-10-18 2013-10-17 Method and apparatus for detecting hidden content of web page Ceased WO2014059934A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US14/688,314 US9979746B2 (en) 2012-10-18 2015-04-16 Method and apparatus for detecting hidden content of web page
US15/959,693 US10333972B2 (en) 2012-10-18 2018-04-23 Method and apparatus for detecting hidden content of web page

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210397725.XA CN103778365B (en) 2012-10-18 2012-10-18 Webpage hidden content detecting method and device
CN201210397725.X 2012-10-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/688,314 Continuation US9979746B2 (en) 2012-10-18 2015-04-16 Method and apparatus for detecting hidden content of web page

Publications (1)

Publication Number Publication Date
WO2014059934A1 true WO2014059934A1 (en) 2014-04-24

Family

ID=50487584

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/085367 Ceased WO2014059934A1 (en) 2012-10-18 2013-10-17 Method and apparatus for detecting hidden content of web page

Country Status (3)

Country Link
US (2) US9979746B2 (en)
CN (1) CN103778365B (en)
WO (1) WO2014059934A1 (en)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103778365B (en) 2012-10-18 2015-05-13 腾讯科技（深圳）有限公司 Webpage hidden content detecting method and device
WO2015117267A1 (en) * 2014-02-07 2015-08-13 Google Inc. Systems and methods for automatically creating content modification scheme
CN107294918B (en) * 2016-03-31 2020-09-29 阿里巴巴集团控股有限公司 Phishing webpage detection method and device
US11514094B2 (en) * 2018-02-06 2022-11-29 International Business Machines Corporation Search and navigation of hidden elements of a web page
CN111259284B (en) * 2018-11-30 2023-05-02 阿里巴巴集团控股有限公司 Method and device for page lazy loading, storage medium and processor
US11263028B2 (en) * 2019-03-27 2022-03-01 Citrix Systems, Inc. Providing user interface (UI) elements in virtual machine sessions at reduced latency
US11281478B2 (en) 2019-03-27 2022-03-22 Citrix Systems, Inc. Providing user interface (UI) elements having an ordered hierarchy of graphical control elements in virtual machine sessions at reduced latency and related methods
US11263029B2 (en) 2019-03-27 2022-03-01 Citrix Systems, Inc. Providing user interface (UI) elements having scrollable content in virtual machine sessions at reduced latency and related methods
CN110309667B (en) * 2019-04-16 2022-08-30 网宿科技股份有限公司 Website hidden link detection method and device
CN113111274A (en) * 2020-01-10 2021-07-13 网宿科技股份有限公司 Method and device for detecting hidden link in webpage
CN111353112A (en) * 2020-02-27 2020-06-30 百度在线网络技术（北京）有限公司 Page processing method, apparatus, electronic device and computer readable medium
CN112818271B (en) * 2021-01-27 2025-07-08 北京小米移动软件有限公司 Webpage display method and device, terminal equipment and medium
CN116089892A (en) * 2023-02-20 2023-05-09 中银金融科技有限公司 Page rendering anomaly detection method, device, equipment and medium
CN120710907B (en) * 2025-08-18 2025-10-28 贵州蓝天创新科技有限公司 Webpage dark link intelligent detection method and device based on CSSOMY engine

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009049275A1 (en) * 2007-10-12 2009-04-16 Symantec Corporation Method for detecting and resolving hidden text salting
US20100114902A1 (en) * 2008-11-04 2010-05-06 Brigham Young University Hidden-web table interpretation, conceptulization and semantic annotation
CN102542201A (en) * 2011-12-26 2012-07-04 北京奇虎科技有限公司 Detection method and system for malicious codes in web pages
CN102622543A (en) * 2012-02-06 2012-08-01 北京百度网讯科技有限公司 Method and device for dynamically detecting malicious webpage scripts
CN102682097A (en) * 2012-04-27 2012-09-19 北京神州绿盟信息安全科技股份有限公司 Method and equipment for detecting secrete links in web page
US20120255027A1 (en) * 2011-03-31 2012-10-04 Infosys Technologies Ltd. Detecting code injections through cryptographic methods

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4037999B2 (en) * 2000-05-15 2008-01-23 インターナショナル・ビジネス・マシーンズ・コーポレーション Website, robot type search engine response system, robot type search engine registration method, storage medium, and program transmission device
AU2003210900A1 (en) * 2002-02-07 2003-09-02 Empirix Inc. Automated security threat testing of web pages
EP1406183A3 (en) * 2002-10-01 2004-04-14 Sap Ag Method and system for refreshing browser pages
US7287279B2 (en) * 2004-10-01 2007-10-23 Webroot Software, Inc. System and method for locating malware
US8020206B2 (en) * 2006-07-10 2011-09-13 Websense, Inc. System and method of analyzing web content
US8615800B2 (en) * 2006-07-10 2013-12-24 Websense, Inc. System and method for analyzing web content
US8065392B2 (en) * 2007-06-08 2011-11-22 Apple Inc. Methods and systems for managing web feed content with an email client application
US9398032B1 (en) * 2009-07-09 2016-07-19 Trend Micro Incorporated Apparatus and methods for detecting malicious scripts in web pages
US8806325B2 (en) * 2009-11-18 2014-08-12 Apple Inc. Mode identification for selective document content presentation
US8505094B1 (en) * 2010-01-13 2013-08-06 Trend Micro, Inc. Detection of malicious URLs in a web page
CN102375851B (en) * 2010-08-23 2014-05-07 中国移动通信有限公司 Method and equipment for display page
CN102346770B (en) 2011-09-21 2014-05-14 晨星软件研发(深圳)有限公司 WebKit browser webpage content loading method and device
EP2579144B1 (en) 2011-10-07 2019-05-01 BlackBerry Limited Determining a target position for scrolling content
CN102508887A (en) * 2011-10-19 2012-06-20 江西省南城县网信电子有限公司 System and method for resolving digital television interaction service markup language
US8639680B1 (en) * 2012-05-07 2014-01-28 Google Inc. Hidden text detection for search result scoring
CN103778365B (en) 2012-10-18 2015-05-13 腾讯科技（深圳）有限公司 Webpage hidden content detecting method and device

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009049275A1 (en) * 2007-10-12 2009-04-16 Symantec Corporation Method for detecting and resolving hidden text salting
US20100114902A1 (en) * 2008-11-04 2010-05-06 Brigham Young University Hidden-web table interpretation, conceptulization and semantic annotation
US20120255027A1 (en) * 2011-03-31 2012-10-04 Infosys Technologies Ltd. Detecting code injections through cryptographic methods
CN102542201A (en) * 2011-12-26 2012-07-04 北京奇虎科技有限公司 Detection method and system for malicious codes in web pages
CN102622543A (en) * 2012-02-06 2012-08-01 北京百度网讯科技有限公司 Method and device for dynamically detecting malicious webpage scripts
CN102682097A (en) * 2012-04-27 2012-09-19 北京神州绿盟信息安全科技股份有限公司 Method and equipment for detecting secrete links in web page

Also Published As

Publication number Publication date
CN103778365B (en) 2015-05-13
CN103778365A (en) 2014-05-07
US10333972B2 (en) 2019-06-25
US20180241773A1 (en) 2018-08-23
US9979746B2 (en) 2018-05-22
US20150222660A1 (en) 2015-08-06

Similar Documents

Publication Publication Date Title
US10333972B2 (en) Method and apparatus for detecting hidden content of web page
US20150295942A1 (en) Method and server for performing cloud detection for malicious information
US9984047B2 (en) Application page quick access
US8683596B2 (en) Detection of DOM-based cross-site scripting vulnerabilities
US8700991B1 (en) Protecting content presented in a web browser
CN103095681A (en) Loophole detection method and device
US11005877B2 (en) Persistent cross-site scripting vulnerability detection
WO2014086239A1 (en) Method and apparatus for identifying picture
CN113835737B (en) Method and system for adding permission to front-end item
US20150269129A1 (en) Method for adding bookmarks and browser
CN104794046B (en) The method and system of symbolic program running log
US10445397B2 (en) Method and apparatus for uploading information
CN104573486B (en) leak detection method and device
US9398041B2 (en) Identifying stored vulnerabilities in a web service
EP2998885A1 (en) Method and device for information search
WO2014187182A1 (en) Method, apparatus and system for controlling address input
US9396170B2 (en) Hyperlink data presentation
CN104239514A (en) Webpage rendering method, device and mobile terminal
US9819723B2 (en) Method and apparatus for sharing information
CN102917053A (en) Method, device and system for judging uniform resource locator rewriting of webpage
US10163118B2 (en) Method and apparatus for associating user engagement data received from a user with portions of a webpage visited by the user
KR101305755B1 (en) Devices and methods to filter script execution based on address
CN105357265A (en) Method for identifying state of being hijacked of browser
CN105160247A (en) Method for identifying hijacked browser
US20200019645A1 (en) External network system for extracting external website data using generated polymorphic data

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13846867

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15.09.2015)

122 Ep: pct application non-entry in european phase

Ref document number: 13846867

Country of ref document: EP

Kind code of ref document: A1