WO2015154539A1 - 网站安全检测方法及装置 - Google Patents

网站安全检测方法及装置 Download PDF

Info

Publication number
WO2015154539A1
WO2015154539A1 PCT/CN2014/095944 CN2014095944W WO2015154539A1 WO 2015154539 A1 WO2015154539 A1 WO 2015154539A1 CN 2014095944 W CN2014095944 W CN 2014095944W WO 2015154539 A1 WO2015154539 A1 WO 2015154539A1
Authority
WO
WIPO (PCT)
Prior art keywords
link
domain name
scanned
new
task
Prior art date
Application number
PCT/CN2014/095944
Other languages
English (en)
French (fr)
Inventor
龙专
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Priority to US15/303,216 priority Critical patent/US9954886B2/en
Publication of WO2015154539A1 publication Critical patent/WO2015154539A1/zh
Priority to US15/939,133 priority patent/US20180219907A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis

Definitions

  • the present invention relates to the field of the Internet, and in particular, to a website security detection method and apparatus.
  • an island page is a page that a crawler cannot catch. If there is a vulnerability and it is discovered by a hacker, it will cause a great security risk.
  • the existing vulnerability scanners are based on spider technology to crawl the website links and then conduct security tests. They cannot scan the newly uploaded domain names in time and cannot detect the vulnerabilities in the isolated pages.
  • the present invention has been made in order to provide a website security detecting method, a corresponding website security detecting apparatus, a computer program, and a computer readable medium that overcome the above problems or at least partially solve the above problems.
  • a website security detection method including:
  • Vulnerability scanning for the task to be scanned in the queue to be scanned Vulnerability scanning for the task to be scanned in the queue to be scanned.
  • a website security detecting apparatus including:
  • the capture module is adapted to perform bypass listening for the network and capture a hypertext transfer protocol (http) request packet;
  • An obtaining module configured to obtain a link corresponding to the hypertext transfer protocol request packet
  • a processing module configured to determine that the link is a new link and/or extract a domain name corresponding to the link, and determine that the domain name is a new domain name
  • the insertion module is adapted to insert the link and/or the domain name into the to-be-scanned queue as a priority to be scanned task; and the scanning module is adapted to perform vulnerability scanning on the to-be-scanned task in the to-be-scanned queue.
  • a computer program comprising computer readable code that causes the website security detection method to be executed when the electronic device runs the computer readable code.
  • a computer readable medium storing a computer program as described above is provided.
  • the network performs bypass listening, grabs the http request packet, obtains the link corresponding to the http request packet, determines that the link is a new link, and inserts the link into the to-be-scanned queue as the priority to be scanned task. And/or extracting the domain name corresponding to the link, and determining that the domain name is a new domain name, inserting the domain name into the to-be-scanned queue as a priority to be scanned task, and performing vulnerability scanning on the to-be-scanned task in the to-be-scanned queue.
  • the corresponding link of the user request can be obtained.
  • the vulnerability scanning process is preferentially performed to achieve real-time monitoring of the website security problem, which is convenient for discovery. Website security vulnerability.
  • FIG. 1 is a flow chart showing a method for detecting a website security according to an embodiment of the present invention
  • FIG. 2 is a flow chart showing a method for detecting a website security according to another embodiment of the present invention.
  • FIG. 3 is a block diagram showing the structure of a website security detecting apparatus according to an embodiment of the present invention.
  • FIG. 4 shows a block diagram of an electronic device for performing the method of the present invention
  • Figure 5 shows a schematic diagram of a memory unit for holding or carrying program code implementing the method according to the invention.
  • FIG. 1 shows a flow chart of a website security detection method in accordance with one embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:
  • step S100 bypass listening is performed for the network, and the http request packet is captured.
  • the http request packet may be a get request packet, a post request packet, or the like.
  • the get request is an entity that obtains the information of the resource specified by the request ur I (uniform resource locator). If the request ur I is only a data generation process, the result that is ultimately returned in the response entity is the result of the processing. The resource, not the description of the process.
  • the post request is used to make a request to the destination server asking it to accept the entity attached to the request and treat it as an additional new sub-item requesting the resource specified by ur I in the request queue. Both the get request packet and the post request packet contain the ur I of the web page.
  • Step S110 obtaining a link corresponding to the http request packet.
  • the link corresponding to the http request packet that is, the ur I of the webpage, can be obtained according to the corresponding ur I.
  • Step S120 determining that the link is a new link, inserting the link into the to-be-scanned queue as a priority to be scanned; and/or extracting the domain name corresponding to the link, determining that the domain name is a new domain name, and inserting the domain name into the queue to be scanned
  • the task to be scanned that is preferentially processed may be determined according to the link and the domain name, or the task to be scanned that is preferentially processed may be determined only according to the link or only according to the domain name, that is, when the link is determined to be a new link, the link is inserted into the to-be-scanned If the domain name is a new domain name, the domain name is inserted into the queue to be scanned as the priority to be scanned.
  • step S130 a vulnerability scan is performed on the task to be scanned in the queue to be scanned.
  • the network performs bypass listening, fetches the http request packet, obtains the link corresponding to the http request packet, determines that the link is a new link, and inserts the link into the to-be-scanned queue as the priority to be scanned. If the domain name is the new domain name, the domain name is inserted into the queue to be scanned as the priority to be scanned task, and the vulnerability scan is performed on the task to be scanned in the queue to be scanned.
  • the corresponding link of the user request can be obtained.
  • the vulnerability scanning process is preferentially performed to achieve real-time monitoring of the website security problem, which is convenient for discovery. Website security vulnerability.
  • FIG. 2 is a flow chart showing a method of website security detection according to another embodiment of the present invention.
  • Figure 2 As shown, the method includes the following steps:
  • step S200 bypass listening is performed for the network, and the http request packet is captured.
  • the http request packet mainly includes: protocol, server domain name, port number, request packet path, get parameter name, post parameter name, extension, target server network segment, and the like.
  • the http request packet can be a get request packet or a post request packet. Both the get request packet and the post request packet contain the ur I of the web page.
  • the security detection device accesses the network in bypass mode and performs bypass detection on all network requests.
  • the http request is sent to the website, and the security detection device fetches the http request packet according to the http request sent by the user.
  • Step S210 Acquire a link corresponding to the Hypertext Transfer Protocol request packet.
  • the http request package contains the ur I of the web page, correspondingly, the corresponding link can be restored from the http request package, that is, the ur I of the web page.
  • step S220 it is analyzed whether the link is a valid link, and if so, step S230 is performed; if not, step S200 is performed.
  • a valid link is a link that opens a web page or downloads a file normally.
  • An invalid link means that the page is no longer valid and cannot provide any valuable information to the user.
  • the link is determined to be an invalid link. Take a link with the domain name abcd.com as an example. If the domain name abcd.com does not appear in the link or only a part of the domain name such as ad.com appears, the link is an invalid link.
  • the link obtained in step S210 is analyzed to determine whether the link is a valid link. If the link has no domain name, the domain name is incomplete, the link is incomplete, the post protocol packet has no content, etc., the link is determined to be an invalid link; if otherwise, the link is invalid; link.
  • step S230 the link is added to the link library.
  • the link library is used to store all valid links for user access.
  • the valid link in step S220 is added to the link library.
  • the link can be regarded as a new link, which can be used as a basis for judging whether the link is a new link.
  • step S240 the links with the same domain name in the link library are summarized.
  • some links in the link library have the same domain name abcd.com, some links have the same domain name cefg.com, and some links have the same domain name fged.com, then the links in the link library are based on the domain name abcd.com, Cefg.com and fged.com are summarized separately.
  • step S250 the domain name corresponding to the link is extracted.
  • the domain names corresponding to the links after the aggregation in step S240 are extracted, for example, domain names such as abcd.com, cefg.com, and fged.com are obtained.
  • Step S260 determining whether the domain name is a new domain name, if yes, executing step S270; if otherwise, performing step S280.
  • the embodiment of the present invention provides two methods for determining whether a domain name is a new domain name, but the method for determining is not limited to the enumerated method:
  • Method 1 Detect whether there is traffic of the domain name within the preset time period, and if not, determine that the domain name is a new domain name.
  • Traffic refers to access to the website. Take a preset time period of 1 week as an example to detect whether there is traffic of the domain name in this week, and if not, determine that the domain name is a new domain name.
  • the domain name fged.com can be determined to be the new domain name.
  • Method 2 Check whether the domain name belongs to the IP address or IP address range. The domain name owner has the verified domain name. If it exists, the domain name is the owner's new domain name.
  • the IP network segment 220.181.158.1 ⁇ 220.181.158.255 has a verified domain name such as webscan.xxx.cn/www.xxx.cn, and the IP segment has been confirmed (by manual method or other methods) Belongs to the xxx company. If a new domain name on the IP of 220.181.158.220 is newdoma in.com, then the domain name can be considered as the new domain name of the company.
  • step S270 the domain name is inserted into the queue to be scanned as a priority to be scanned task.
  • the domain name fged.com is inserted into the to-be-scanned queue as a priority to be scanned task, and the scanning tasks are sorted such as fged.com, abcd.com, cefg.com, where the new domain name is Fged.com ranks at the top of the task to be scanned.
  • step S280 it is determined whether the link is a new link, and if yes, step S290 is performed; if not, step S300 is performed.
  • the link is a new link.
  • a new link is a link that has not appeared on the network if the domain name already exists. For example, after judging that the domain names abcd.com and cefg.com are all existing domain names, it is determined whether the link having the above domain name is a new link, for example, determining the link http://www.abcd.com.***? *** Is it a new link.
  • step S290 the link is inserted into the queue to be scanned as a priority to be scanned task.
  • the link is inserted into the queue to be scanned as a priority to be scanned task.
  • the link is inserted into the queue to be scanned as a priority to be scanned task.
  • step S300 the link is inserted at the end of the queue to be scanned.
  • Step S310 sending a test request to the target website corresponding to the task to be scanned, and performing vulnerability scanning according to the webpage returned by the target website.
  • the test request is sent to the target website corresponding to the task to be scanned according to the task to be scanned, and the target website returns the web page to the security detection device after receiving the test request, and performs a vulnerability scanning service, and accesses the library plan when performing the vulnerability scanning service.
  • a vulnerability scanning service such as the unique vulnerability library, to determine whether the task to be scanned is safe.
  • the website security detection data includes at least one of the following: hanging horse data, false fraud data, search mask data, side note data, tamper data, vulnerability data.
  • the website security detection data the website is tested for security according to the website security detection rules corresponding to the website security detection data, wherein the website security detection rules include at least one of the following: a horse-hanging rule, a false fraud rule, a blocking rule, and a side note. Rules, tampering rules, and vulnerability rules.
  • the invention mainly uses the vulnerability rule to scan a webpage. Vulnerability rules are used to determine vulnerabilities in a website based on vulnerability data.
  • the security detection of the website according to the vulnerability rule includes: obtaining the vulnerability feature in the pre-stored vulnerability feature database, determining whether the vulnerability data conforms to the vulnerability feature, and determining the vulnerability as the vulnerability data conforms to the vulnerability feature; if the vulnerability data is not If it meets the vulnerability characteristics, it is determined to be non-vulnerability. According to the judgment result, the vulnerability of the website is determined, and the vulnerability feature may be a vulnerability keyword.
  • the webpage status code 404 is used as a vulnerability keyword; or, the 404 page content is used as a vulnerability keyword; or, by accessing the normal webpage of the website, extracting the webpage content, the webpage status code, and the http header of the normal webpage, accessing the webpage
  • the webpage that does not exist on the website extracts the webpage content of the feedback webpage, the webpage status code, and the http header, compares the webpage content, the webpage status code, and the http header of the normal webpage and the feedback webpage, and obtains the 404 keyword as a vulnerability keyword;
  • the webpage content, the webpage status code, and the http header of the feedback webpage are used as vulnerability keywords, and the like, and the present invention does not limit this.
  • the embodiment shown in FIG. 2 provides a task to be scanned that is preferentially processed according to a domain name and a link.
  • the task to be scanned that is preferentially processed may be determined only according to the link or only according to the domain name.
  • the above steps S240-S300 may be replaced with determining whether the link is a new link, and if so, inserting the link into the queue to be scanned as a priority to be scanned task; Otherwise the link is inserted at the end of the queue to be scanned.
  • the above steps S240-S300 may be replaced by summarizing the links having the same domain name in the link library, extracting the domain name corresponding to the link, and determining whether the domain name is a new domain name, if The domain name is inserted into the queue to be scanned as the priority to be scanned; if not, the domain name is inserted at the end of the queue to be scanned.
  • the network performs bypass listening, grabs a hypertext transfer protocol (http) request packet, obtains a link corresponding to the hypertext transfer protocol request packet, and analyzes whether the link is a valid link. If yes, add the link to the link library, summarize the links with the same domain name in the link library, extract the domain name corresponding to the link, and determine whether the domain name is a new domain name according to the link library, and if so, insert the domain name into the queue to be scanned as a priority.
  • http hypertext transfer protocol
  • the task to be scanned is processed; if it is determined whether the link is a new link, if the link is inserted into the queue to be scanned as the priority to be scanned, if the link is inserted at the end of the queue to be scanned, the corresponding task is to be scanned.
  • the target website sends a test request to perform a vulnerability scan based on the web page returned by the target website. By bypassing the network, you can obtain the corresponding link of the user request. By analyzing whether the link is a valid link and summarizing the links with the same domain name in the link library, you can remove some invalid links and perform security detection only on the domain name.
  • the web crawler After judging the domain name security, it can be determined that the link under the domain name is secure, speeding up the security detection process, and determining whether the link is a new link in the case of detecting that the domain name is an existing domain name, the web crawler cannot be crawled.
  • the webpage is tested to achieve real-time monitoring of website security issues, which is helpful for discovering website security vulnerabilities.
  • FIG. 3 is a structural block diagram of a website security detecting apparatus according to an embodiment of the present invention.
  • the device includes: a capture module 320, an acquisition module 330, an analysis module 340, a link library 350, a summary module 360, a determination module 370, a processing module 380, an insertion module 390, and a scanning module 400.
  • the capture module 320 is adapted to perform bypass listening for the network and fetch the http request packet.
  • the http request packet mainly includes: protocol, server domain name, port number, request packet path, get parameter name, post parameter name, extension, target server network segment, and the like.
  • the http request packet can be a get request packet or a post request packet. Both the get request packet and the post request packet contain the ur I of the web page.
  • the security detection device accesses the network in bypass mode and performs bypass detection on all network requests.
  • the http request is sent to the website, and the security detection device fetches the http request packet according to the http request sent by the user.
  • the obtaining module 330 is adapted to obtain a link corresponding to the hypertext transfer protocol request packet.
  • the http request package contains the ur I of the web page, correspondingly, the corresponding link can be restored from the http request package, that is, the ur I of the web page.
  • the analysis module 340 is adapted to analyze whether the link is a valid link.
  • a valid link is a link that opens a web page or downloads a file normally.
  • An invalid link means that the page is no longer valid and cannot provide any valuable information to the user.
  • the link is determined to be an invalid link. Take a link with the domain name abcd.com as an example. If the domain name abcd.com does not appear in the link or only a part of the domain name such as ad.com appears, the link is an invalid link.
  • the link acquired by the obtaining module 330 is analyzed to determine whether the link is a valid link. If the link has no domain name, the domain name is incomplete, the link is incomplete, the post protocol packet has no content, etc., the link is determined to be an invalid link; if otherwise, the link is invalid; link.
  • a link library 350 is adapted to store links.
  • the link library 350 is used to store all valid links accessed by the user.
  • the analysis module 340 analyzes the valid link of the decision into the link library. In order to avoid repeatedly adding the same link to the link library 350, after determining that the link is a valid link, it is further determined whether the link exists in the link library, and if not, the link is added to the link library 350.
  • the summary module 360 is adapted to summarize the links in the link library with the same domain name.
  • some links in the link library have the same domain name abcd.com, some links have the same domain name cefg.com, and some links have the same domain name fged.com, then the links in the link library are based on the domain name abcd.com, Cefg.com and fged.com are summarized separately.
  • the determining module 370 is adapted to determine, according to the link library, whether the link is a new link and/or whether the domain name is a new domain name.
  • the link is a new link.
  • a new link is a link that has not appeared on the network if the domain name already exists. For example, after judging that the domain names abcd.com and cefg.com are all existing domain names, it is determined whether the link having the above domain name is a new link, for example, determining the link http://www.abcd.com.***? *** Is it a new link.
  • the processing module 380 is adapted to determine that the link is a new link and/or extract the domain name corresponding to the link, and determine that the domain name is a new domain name.
  • the processing module 380 is specifically configured to: detect whether there is traffic of a domain name within a preset time period, and if not, determine that the domain name is a new domain name.
  • Traffic refers to access to the website. Take a preset time period of 1 week as an example to detect whether there is traffic of the domain name in this week, and if not, determine that the domain name is a new domain name.
  • the domain name fged.com can be determined to be the new domain name.
  • the processing module 380 is specifically configured to: detect whether the domain name owner has the verified domain name of the IP address or the IP address range to which the domain name belongs, and if yes, determine that the domain name is the new domain name of the owner.
  • the IP network segment 220.181.158.1 ⁇ 220.181.158.255 has a verified domain name such as webscan.xxx.cn/www.xxx.cn, and the IP segment has been confirmed (by manual method or other methods) Belongs to the xxx company. If a new domain name on the IP of 220.181.158.220 is newdoma in.com, then the domain name can be considered as the new domain name of the company.
  • the inserting module 390 is adapted to insert a link and/or a domain name into the queue to be scanned as a priority to be scanned task.
  • the domain name fged.com is inserted into the to-be-scanned queue as a priority to be scanned task, and the scanning tasks are sorted such as fged.com, abcd.com, Cefg.com, where the new domain name fged.com is at the forefront of the task to be scanned.
  • the link is inserted into the queue to be scanned as a priority to be scanned task.
  • the link is inserted into the queue to be scanned as a priority to be scanned task.
  • the scanning module 400 is adapted to perform a vulnerability scan for the task to be scanned in the queue to be scanned.
  • the scanning module 400 includes: a requesting unit 410, configured to send a test request to a target website corresponding to the task to be scanned;
  • the scanning unit 420 is adapted to perform vulnerability scanning according to the webpage returned by the target website.
  • the test request is sent to the target website corresponding to the task to be scanned according to the task to be scanned, and the target website returns the web page to the security detection device after receiving the test request, and performs a vulnerability scanning service, and accesses the library plan when performing the vulnerability scanning service.
  • a vulnerability scanning service such as the unique vulnerability library, to determine whether the task to be scanned is safe.
  • the website security detection data includes at least one of the following: hanging horse data, false fraud data, search mask data, side note data, tamper data, vulnerability data.
  • the website security detection data the website is tested for security according to the website security detection rules corresponding to the website security detection data, wherein the website security detection rules include at least one of the following: a horse-hanging rule, a false fraud rule, a blocking rule, and a side note. Rules, tampering rules, and vulnerability rules.
  • the invention mainly uses the vulnerability rule to scan a webpage. Vulnerability rules are used to determine vulnerabilities in a website based on vulnerability data.
  • the security detection of the website according to the vulnerability rule includes: obtaining the vulnerability feature in the pre-stored vulnerability feature database, determining whether the vulnerability data conforms to the vulnerability feature, and determining the vulnerability as the vulnerability data conforms to the vulnerability feature; if the vulnerability data is not If it meets the vulnerability characteristics, it is determined to be non-vulnerability. According to the judgment result, the vulnerability of the website is determined, and the vulnerability feature may be a vulnerability keyword.
  • the webpage status code 404 is used as a vulnerability keyword; or, the 404 page content is used as a vulnerability keyword; or, by accessing the normal webpage of the website, extracting the webpage content, the webpage status code, and the http header of the normal webpage, accessing the webpage
  • the webpage that does not exist on the website extracts the webpage content of the feedback webpage, the webpage status code, and the http header, compares the webpage content, the webpage status code, and the http header of the normal webpage and the feedback webpage, and obtains the 404 keyword as a vulnerability keyword;
  • the webpage content, the webpage status code, and the http header of the feedback webpage are used as a vulnerability keyword, etc., and the present invention does not limit this.
  • the network performs bypass listening, grabs the hypertext transfer protocol request packet, obtains a link corresponding to the hypertext transfer protocol request packet, analyzes whether the link is a valid link, and if so, adds the link to the link library. And summarizing the links with the same domain name in the link library, extracting the domain name corresponding to the link, determining whether the domain name is a new domain name according to the link library, and if so, inserting the domain name into the queue to be scanned as a priority to be scanned; if not, Whether the link is a new link, if it is a chain The task to be scanned is inserted into the queue to be scanned as a priority to be scanned.
  • a test request is sent to the target website corresponding to the task to be scanned, and the vulnerability is scanned according to the webpage returned by the target website.
  • After judging the domain name security it can be determined that the link under the domain name is secure, speeding up the security detection process, and determining whether the link is a new link in the case of detecting that the domain name is an existing domain name, the web crawler cannot be crawled.
  • the webpage is tested to achieve real-time monitoring of website security issues, which is helpful for discovering website security vulnerabilities.
  • the security detection device supports intranet/external network/IDC deployment, supports stand-alone and distributed deployment, and can be applied to large enterprises. After the device accesses the internal network of the enterprise in bypass mode, it bypasses all network requests and requests the restore link for security detection. If a new website and/or web page is online, you can quickly The security is detected; in addition, the device can perform security detection on the silo page that the web crawler cannot crawl, and more comprehensively monitor the website security problem.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the present description may be employed. All features disclosed in the requirements, abstract and drawings are combined with all processes or units of any method or device so disclosed. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the website security detection device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals.
  • Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 4 illustrates an electronic device in which the website security detecting method of the present invention can be implemented.
  • the electronic device conventionally includes a processor 410 and a computer program product or computer readable medium in the form of a memory 420.
  • the memory 420 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 420 has a memory space 430 for program code 431 for performing any of the method steps described above.
  • storage space 430 for program code may include various program code 431 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG.
  • the storage unit may have a storage section or a storage space or the like arranged similarly to the storage 420 in the electronic device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit comprises a program 431' for performing the steps of the method according to the invention, ie a code readable by a processor, such as 410, which, when executed by the electronic device, causes the electronic device to perform the above Each step in the described method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种网站安全检测方法及装置。其中方法包括：针对网络进行旁路侦听，抓取超文本传输协议请求包，获取超文本传输协议请求包对应的链接，确定链接为新链接，则将链接插入到待扫描队列中作为优先处理的待扫描任务；和/或提取链接对应的域名，确定域名为新域名，则将域名插入到待扫描队列中作为优先处理的待扫描任务，针对待扫描队列中的待扫描任务进行漏洞扫描。通过对网络进行旁路侦听可以获取用户请求对应链接，在确定链接为新链接或判定链接的域名是新域名的情况下，优先对其进行漏洞扫描处理，达到实时监控网站安全问题，利于发现网站安全漏洞。

Description

网站安全检测方法及装置 技术领域
本发明涉及互联网领域，具体涉及一种网站安全检测方法及装置。
背景技术
随着互联网技术应用的越来越广泛，人们很多的日常工作和娱乐都在网络上进行，网络已跟我们的生活息息相关。因此，网站的安全也越来越被人们所重视。然而，网络存在着各种各样的安全隐患，比如：COOKIE中毒、应用程序缓冲溢出、跨站脚本攻击、已知安全漏洞等等，无时无刻不让网站用户担心吊胆。网站用户希望了解网站的安全程度，使用较为安全的网站，而网站管理者希望能够及时修复漏洞，为网站用户提供安全的浏览平台。
在信息高度发达的今天，作为信息载体的网站业务(代码)更新频繁，而每个公司配备的信息安全人员不足以支持如此多和频繁的安全测试。
例如，孤岛页面是爬虫抓不到的页面，如果存在漏洞又被黑客发现了的话，会导致极大的安全风险。现有的漏洞扫描器都是基于蜘蛛技术来抓取网站链接后再进行安全测试的，不能及时扫描新上线的域名和不能检测到孤岛页面存在的漏洞。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的网站安全检测方法、相应的网站安全检测装置、计算机程序以及计算机可读介质。
根据本发明的一个方面，提供了一种网站安全检测方法，包括：
针对网络进行旁路侦听，抓取超文本传输协议(http)请求包；
获取所述超文本传输协议请求包对应的链接；
确定所述链接为新链接，则将所述链接插入到待扫描队列中作为优先处理的待扫描任务；和/或
提取所述链接对应的域名，确定所述域名为新域名，则将所述域名插入到待扫描队列中作为优先处理的待扫描任务；
针对待扫描队列中的待扫描任务进行漏洞扫描。
根据本发明的另一方面，提供了一种网站安全检测装置，包括：
抓取模块，适于针对网络进行旁路侦听，抓取超文本传输协议(http)请求包；
获取模块，适于获取所述超文本传输协议请求包对应的链接；
处理模块，适于确定所述链接为新链接和/或提取所述链接对应的域名，确定所述域名为新域名；
插入模块，适于将所述链接和/或所述域名插入到待扫描队列中作为优先处理的待扫描任务；扫描模块，适于针对待扫描队列中的待扫描任务进行漏洞扫描。
根据本发明的另一个方面，提供了一种计算机程序，其包括计算机可读代码，当电子设备运行所述计算机可读代码时，导致所述的网站安全检测方法被执行。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存储了如上所述的计算机程序。
根据本发明的方案，针对网络进行旁路侦听，抓取http请求包，获取http请求包对应的链接，确定链接为新链接，则将链接插入到待扫描队列中作为优先处理的待扫描任务；和/或提取链接对应的域名，确定域名为新域名，则将域名插入到待扫描队列中作为优先处理的待扫描任务，针对待扫描队列中的待扫描任务进行漏洞扫描。通过对网络进行旁路侦听可以获取用户请求对应链接，在确定链接为新链接或判定链接的域名是新域名的情况下，优先对其进行漏洞扫描处理，达到实时监控网站安全问题，利于发现网站安全漏洞。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据本发明一个实施例的网站安全检测方法的流程图；
图2示出了根据本发明另一个实施例的网站安全检测方法的流程图；
图3示出了根据本发明一个实施例的网站安全检测装置的结构框图；
图4示出了用于执行本发明的方法的电子设备的框图；以及
图5示出了用于保持或者携带实现根据本发明的方法的程序代码的存储单元示意图。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
图1示出了根据本发明一个实施例的网站安全检测方法的流程图。如图1所示，该方法包括如下步骤：
步骤S100，针对网络进行旁路侦听，抓取http请求包。
http请求包可以是get请求包、post请求包等。get请求是以实体的方式得到由请求ur I(统一资源定位符)所指定资源的信息，如果请求ur I只是一个数据产生过程，那么最终要在响应实体中返回的是处理过程的结果所指向的资源，而不是处理过程的描述。post请求用来向目的服务器发出请求，要求它接受被附在请求后的实体，并把它当作请求队列中请求ur I所指定资源的附加新子项。get请求包、post请求包中均包含网页的ur I。
步骤S110，获取http请求包对应的链接。
由于http请求包中包含了网页的ur I，因此可以根据相应的ur I获取http请求包对应的链接，即网页的ur I。
步骤S120，确定链接为新链接，则将链接插入到待扫描队列中作为优先处理的待扫描任务；和/或，提取链接对应的域名，确定域名为新域名，则将域名插入到待扫描队列中作为优先处理的待扫描任务。
本实施例可以是根据链接和域名来确定优先处理的待扫描任务，也可以仅根据链接或仅根据域名确定优先处理的待扫描任务，即由确定链接为新链接，则将链接插入到待扫描队列中作为优先处理的待扫描任务或提取链接对应的域名，确定域名为新域名，则将域名插入到待扫描队列中作为优先处理的待扫描任务。
步骤S130，针对待扫描队列中的待扫描任务进行漏洞扫描。
根据本发明提供的方法，针对网络进行旁路侦听，抓取http请求包，获取http请求包对应的链接，确定链接为新链接，则将链接插入到待扫描队列中作为优先处理的待扫描任务；和/或提取链接对应的域名，确定域名为新域名，则将域名插入到待扫描队列中作为优先处理的待扫描任务，针对待扫描队列中的待扫描任务进行漏洞扫描。通过对网络进行旁路侦听可以获取用户请求对应链接，在确定链接为新链接或判定链接的域名是新域名的情况下，优先对其进行漏洞扫描处理，达到实时监控网站安全问题，利于发现网站安全漏洞。
图2示出了根据本发明另一个实施例的网站安全检测方法的流程图。如图2 所示，该方法包括如下步骤：
步骤S200，针对网络进行旁路侦听，抓取http请求包。
http请求包主要包括：协议、服务器域名、端口号、请求包路径、get参数名、post参数名、扩展名、目标服务器网段等。http请求包可以是get请求包或post请求包等。get请求包、post请求包中均包含网页的ur I。
安全检测设备以旁路侦听的方式接入网络，对所有的网络请求进行旁路侦听。用户通过客户端访问网站时会向网站发送http请求，安全检测设备根据用户发送的http请求抓取http请求包。
步骤S210，获取超文本传输协议请求包对应的链接。
由于http请求包中包含了网页的ur I，对应地，从http请求包中可以还原得到相应的链接，即网页的ur I。
步骤S220，分析链接是否为有效链接，若是则执行步骤S230；若否则执行步骤S200。
有效链接指能够正常打开网页或下载文件的链接。无效链接指页面已经无效，无法对用户提供任何有价值信息的页面。当某一链接出现无域名、域名不全、链接不完整、post协议数据包没内容等现象时则将该链接判定为无效链接。以域名为abcd.com的某一链接为例，若链接中没有出现域名abcd.com或只出现域名的一部分如ad.com，则该链接为无效链接。
对步骤S210中获取的链接进行分析，判定该链接是否为有效链接，若链接出现无域名、域名不全、链接不完整、post协议数据包没内容等现象则判定链接为无效链接；若否则为有效链接。
步骤S230，将链接加入到链接库中。
链接库用于存储用户访问的所有有效链接。将步骤S220中的有效链接加入到链接库中。为了避免将同一链接重复加入到链接库，在判断链接为有效链接后，先判断链接库中是否存在该链接，若不存在，则将该链接加入到链接库中。本发明中，如果链接库中不存在该链接可将该链接视为新链接，这可作为后续判断链接是否为新链接的依据。
步骤S240，将链接库中具有相同域名的链接进行汇总。
举例来说，链接库中一部分链接具有相同的域名abcd.com，一部分链接具有相同的域名cefg.com，一部分链接具有相同的域名fged.com，则将链接库中的链接根据域名abcd.com、cefg.com、fged.com分别进行汇总。
步骤S250，提取链接对应的域名。
提取步骤S240中汇总后的链接对应的域名，例如，得到abcd.com、cefg.com、fged.com等域名。
步骤S260，判断域名是否为新域名，若是则执行步骤S270；若否则执行步骤S280。
本发明实施例给出了两种判断域名是否为新域名的方法，但判断方法不仅限于所列举方法：
方法1：检测在预设时间段内是否有域名的流量，若否，则确定域名为新域名。
流量指对网站的访问。以一个预设时间段为1个星期为例，检测在这一个星期内是否有域名的流量，若否，则判定域名为新域名。
举例来说，在1个星期内，并未检测到关于域名fged.com的流量，则可以判定域名fged.com为新域名。
方法2：检测域名所属的IP地址或IP地址范围是否存在域名所有人的验证域名，若存在，则确定域名为所有人的新域名。
举例来说，假设220.181.158.1～220.181.158.255这个IP网段内存在验证域名如webscan.xxx.cn/www.xxx.cn等，并且该IP段已经确认(通过人工方法或其它方法确认)是属于xxx公司的。如果在220.181.158.220这个IP上新出现了一个域名是newdoma in.com，则可以认为这个域名是该公司的新域名。
利用上述两种方法来判定域名是否为新域名。在上面的例子中，设检测到fged.com为新域名，abcd.com、cefg.com为已存在域名。
步骤S270，将域名插入到待扫描队列中作为优先处理的待扫描任务。
在判定域名fged.com为新域名后，将域名fged.com插入到待扫描队列作为优先处理的待扫描任务，对待扫描任务进行排序如fged.com、abcd.com、cefg.com，其中新域名fged.com排在待扫描任务的最前列。
步骤S280，判断链接是否为新链接，若是则执行步骤S290；若否则执行步骤S300。
在判定域名不是新域名的情况下，来判断链接是否为新链接。新链接指在域名已存在的情况下，网络中未出现过的链接。举例来说，在判断域名abcd.com、cefg.com都为已存在域名后，判断具有上述域名的链接是否为新链接，例如判断链接http：//www.abcd.com.***？***是否为新链接。
步骤S290，将链接插入到待扫描队列中作为优先处理的待扫描任务。
在判断链接是新链接的情况下，将链接插入到待扫描队列中作为优先处理的待扫描任务。举例来说，利用上述判断新链接的方法判断链接http：//www.abcd.com.***？***是新链接，则将该链接插入到待扫描队列中作为优先处理的待扫描任务。
步骤S300，将链接插入到待扫描队列末尾。
步骤S310，向与待扫描任务对应的目标网站发送测试请求，根据目标网站返回的网页进行漏洞扫描。
根据待扫描任务分别向与待扫描任务对应的目标网站发送测试请求，目标网站在收到测试请求后将网页返回给安全检测设备，进行漏洞扫描服务，在进行漏洞扫描服务时会访问库带计划等独有漏洞库，判断待扫描任务是否安全。
网站安全检测数据包括以下至少之一：挂马数据、虚假欺诈数据、搜索屏蔽数据、旁注数据、篡改数据、漏洞数据。根据网站安全检测数据，按照与网站安全检测数据相对应的网站安全检测规则对网站进行安全检测，其中，网站安全检测规则包括以下至少之一：挂马规则、虚假欺诈规则、屏蔽规则、旁注规则、篡改规则、和漏洞规则。本发明主要利用漏洞规则对网页进行扫描。漏洞规则用于根据漏洞数据确定网站存在的漏洞。
根据漏洞数据，按照漏洞规则对网站进行安全检测包括：获取预先存储的漏洞特征数据库中的漏洞特征，判断漏洞数据是否符合漏洞特征，若漏洞数据符合漏洞特征，则确定为漏洞；若漏洞数据不符合漏洞特征，则确定为非漏洞。根据判断结果确定网站存在的漏洞，其中，漏洞特征可以为漏洞关键字。如，将网页状态代码404作为漏洞关键字；或者，将404页面内容作为漏洞关键字；或者，通过访问网站的正常网页，提取该正常网页的网页内容、网页状态代码和http头部，访问该网站不存在的网页，提取反馈网页的网页内容、网页状态代码和http头部，比较该正常网页和该反馈网页的网页内容、网页状态代码和http头部，获取404关键字作为漏洞关键字；再或者，访问不存在的网页，将反馈网页的网页内容、网页状态代码和http头部作为漏洞关键字等等，本发明对此不作限制。
图2所示的实施例提供的是根据域名和链接来确定优先处理的待扫描任务，作为另两种实施方式，也可以仅根据链接或仅根据域名确定优先处理的待扫描任务。
对于仅根据链接确定优先处理的待扫描任务的实施例，上述步骤S240-步骤S300可以替换为判断链接是否为新链接，若是则将链接插入到待扫描队列中作为优先处理的待扫描任务；若否则将链接插入到待扫描队列末尾。
对于仅根据域名确定优先处理的待扫描任务的实施例，上述步骤S240-步骤S300可以替换为将链接库中具有相同域名的链接进行汇总，提取链接对应的域名，判断域名是否为新域名，若是则将域名插入到待扫描队列中作为优先处理的待扫描任务；若否则将域名插入到待扫描队列末尾。
根据本发明的方法，针对网络进行旁路侦听，抓取超文本传输协议(http)请求包，获取超文本传输协议请求包对应的链接，分析链接是否为有效链接， 若是则将链接加入到链接库中，将链接库中具有相同域名的链接进行汇总，提取链接对应的域名，根据链接库判断域名是否为新域名，若是则将域名插入到待扫描队列中作为优先处理的待扫描任务；若否则判断链接是否为新链接，若是则将链接插入到待扫描队列中作为优先处理的待扫描任务，若否则将链接插入到待扫描队列末尾，向与待扫描任务对应的目标网站发送测试请求，根据目标网站返回的网页进行漏洞扫描。通过对网络进行旁路侦听可以获取用户请求对应链接，通过分析链接是否为有效链接并将链接库中具有相同域名的链接进行汇总，可以将一些无效的链接去除，并只对域名进行安全检测，在判断域名安全后，则可判定该域名下的链接是安全的，加快了安全检测流程，在检测域名是已存在域名的情况下，判断链接是否为新链接，可以对网络爬虫无法抓取的网页进行检测，达到实时监控网站安全问题，利于发现网站安全漏洞。
图3是根据本发明一个实施例的网站安全检测装置的结构框图。如图3所示，该装置包括：抓取模块320、获取模块330、分析模块340、链接库350、汇总模块360、判断模块370、处理模块380、插入模块390、扫描模块400。
抓取模块320，适于针对网络进行旁路侦听，抓取http请求包。
http请求包主要包括：协议、服务器域名、端口号、请求包路径、get参数名、post参数名、扩展名、目标服务器网段等。http请求包可以是get请求包或post请求包等。get请求包、post请求包中均包含网页的ur I。
安全检测设备以旁路侦听的方式接入网络，对所有的网络请求进行旁路侦听。用户通过客户端访问网站时会向网站发送http请求，安全检测设备根据用户发送的http请求抓取http请求包。
获取模块330，适于获取超文本传输协议请求包对应的链接。
由于http请求包中包含了网页的ur I，对应地，从http请求包中可以还原得到相应的链接，即网页的ur I。
分析模块340，适于分析链接是否为有效链接。
有效链接指能够正常打开网页或下载文件的链接。无效链接指页面已经无效，无法对用户提供任何有价值信息的页面。当某一链接出现无域名、域名不全、链接不完整、post协议数据包没内容等现象时则将该链接判定为无效链接。以域名为abcd.com的某一链接为例，若链接中没有出现域名abcd.com或只出现域名的一部分如ad.com，则该链接为无效链接。
对获取模块330获取的链接进行分析，判定该链接是否为有效链接，若链接出现无域名、域名不全、链接不完整、post协议数据包没内容等现象则判定链接为无效链接；若否则为有效链接。
链接库350，适于存储链接。
链接库350用于存储用户访问的所有有效链接。将分析模块340分析判定的有效链接加入到链接库中。为了避免将同一链接重复加入到链接库350，在判断链接为有效链接后，进一步判断链接库中是否存在该链接，若不存在，则将该链接加入到链接库350中。
汇总模块360，适于将链接库中具有相同域名的链接进行汇总。
举例来说，链接库中一部分链接具有相同的域名abcd.com，一部分链接具有相同的域名cefg.com，一部分链接具有相同的域名fged.com，则将链接库中的链接根据域名abcd.com、cefg.com、fged.com分别进行汇总。
判断模块370，适于根据链接库确定链接是否为新链接和/或域名是否为新域名。
在判定域名不是新域名的情况下，来判断链接是否为新链接。新链接指在域名已存在的情况下，网络中未出现过的链接。举例来说，在判断域名abcd.com、cefg.com都为已存在域名后，判断具有上述域名的链接是否为新链接，例如判断链接http：//www.abcd.com.***？***是否为新链接。
处理模块380，适于确定链接为新链接和/或提取链接对应的域名，确定域名为新域名。
处理模块380具体适于：检测在预设时间段内是否有域名的流量，若否，则确定域名为新域名。
流量指对网站的访问。以一个预设时间段为1个星期为例，检测在这一个星期内是否有域名的流量，若否，则判定域名为新域名。
举例来说，在1个星期内，并未检测到关于域名fged.com的流量，则可以判定域名fged.com为新域名。
处理模块380具体适于：检测域名所属的IP地址或IP地址范围是否存在域名所有人的验证域名，若存在，则判定域名为所有人的新域名。
举例来说，假设220.181.158.1～220.181.158.255这个IP网段内存在验证域名如webscan.xxx.cn/www.xxx.cn等，并且该IP段已经确认(通过人工方法或其他方法确认)是属于xxx公司的。如果在220.181.158.220这个IP上新出现了一个域名是newdoma in.com，则可以认为这个域名是该公司的新域名。
利用上述两种方法来判定域名是否为新域名。在上面的例子中，设检测到fged.com为新域名，abcd.com、cefg.com为已存在域名。
插入模块390，适于将链接和/或域名插入到待扫描队列中作为优先处理的待扫描任务。
在判定域名fged.com为新域名后，将域名fged.com插入到待扫描队列作为优先处理的待扫描任务，对待扫描任务进行排序如fged.com、abcd.com、 cefg.com，其中新域名fged.com排在待扫描任务的最前列。
在判断链接是新链接的情况下，将链接插入到待扫描队列中作为优先处理的待扫描任务。举例来说，利用上述判断新链接的方法判断链接http：//www.abcd.com.***？***是新链接，则将该链接插入到待扫描队列中作为优先处理的待扫描任务。
扫描模块400，适于针对待扫描队列中的待扫描任务进行漏洞扫描。
扫描模块400包括：请求单元410，适于向与待扫描任务对应的目标网站发送测试请求；
扫描单元420，适于根据目标网站返回的网页进行漏洞扫描。
根据待扫描任务分别向与待扫描任务对应的目标网站发送测试请求，目标网站在收到测试请求后将网页返回给安全检测设备，进行漏洞扫描服务，在进行漏洞扫描服务时会访问库带计划等独有漏洞库，判断待扫描任务是否安全。
网站安全检测数据包括以下至少之一：挂马数据、虚假欺诈数据、搜索屏蔽数据、旁注数据、篡改数据、漏洞数据。根据网站安全检测数据，按照与网站安全检测数据相对应的网站安全检测规则对网站进行安全检测，其中，网站安全检测规则包括以下至少之一：挂马规则、虚假欺诈规则、屏蔽规则、旁注规则、篡改规则、和漏洞规则。本发明主要利用漏洞规则对网页进行扫描。漏洞规则用于根据漏洞数据确定网站存在的漏洞。
根据漏洞数据，按照漏洞规则对网站进行安全检测包括：获取预先存储的漏洞特征数据库中的漏洞特征，判断漏洞数据是否符合漏洞特征，若漏洞数据符合漏洞特征，则确定为漏洞；若漏洞数据不符合漏洞特征，则确定为非漏洞。根据判断结果确定网站存在的漏洞，其中，漏洞特征可以为漏洞关键字。如，将网页状态代码404作为漏洞关键字；或者，将404页面内容作为漏洞关键字；或者，通过访问网站的正常网页，提取该正常网页的网页内容、网页状态代码和http头部，访问该网站不存在的网页，提取反馈网页的网页内容、网页状态代码和http头部，比较该正常网页和该反馈网页的网页内容、网页状态代码和http头部，获取404关键字作为漏洞关键字；或者，访问不存在的网页，将反馈网页的网页内容、网页状态代码和http头部作为漏洞关键字等等，本发明对此不作限制。
根据本发明的装置，针对网络进行旁路侦听，抓取超文本传输协议请求包，获取超文本传输协议请求包对应的链接，分析链接是否为有效链接，若是则将链接加入到链接库中，将链接库中具有相同域名的链接进行汇总，提取链接对应的域名，根据链接库判断域名是否为新域名，若是则将域名插入到待扫描队列中作为优先处理的待扫描任务；若否则判断链接是否为新链接，若是则将链 接插入到待扫描队列中作为优先处理的待扫描任务，若否则将链接插入到待扫描队列末尾，向与待扫描任务对应的目标网站发送测试请求，根据目标网站返回的网页进行漏洞扫描。通过对网络进行旁路侦听可以获取用户请求对应链接，通过分析链接是否为有效链接并将链接库中具有相同域名的链接进行汇总，可以将一些无效的链接去除，并只对域名进行安全检测，在判断域名安全后，则可判定该域名下的链接是安全的，加快了安全检测流程，在检测域名是已存在域名的情况下，判断链接是否为新链接，可以对网络爬虫无法抓取的网页进行检测，达到实时监控网站安全问题，利于发现网站安全漏洞。
该安全检测设备支持内网/外网/IDC部署，支持单机和分布式部署，可以应用于大型企业。该设备以旁路侦听的方式接入企业内部网络后，对所有的网络请求进行旁路侦听，并将请求还原链接进行安全检测，如果有新的网站和/或网页上线，可以迅速对其安全性进行检测；此外，该设备还可以对网络爬虫无法抓取的孤岛页面进行安全检测，更全面地监控网站安全问题。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利 要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的网站安全检测设备中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图4示出了可以实现本发明的网站安全检测方法的电子设备。该电子设备传统上包括处理器410和以存储器420形式的计算机程序产品或者计算机可读介质。存储器420可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器420具有用于执行上述方法中的任何方法步骤的程序代码431的存储空间430。例如，用于程序代码的存储空间430可以包括分别用于实现上面的方法中的各种步骤的各个程序代码431。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图5所述的便携式或者固定存储单元。该存储单元可以具有与图4的电子设备中的存储器420类似布置的存储段或者存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本发明的方法步骤的程序431’，即可以由例如诸如410之类的处理器读取的代码，这些代码当由电子设备运行时，导致该电子设备执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同 一个实施例。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下被实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (16)

  1. 一种网站安全检测方法，包括：
    针对网络进行旁路侦听，抓取超文本传输协议(http)请求包；
    获取所述超文本传输协议请求包对应的链接；
    确定所述链接为新链接，则将所述链接插入到待扫描队列中作为优先处理的待扫描任务；和/或
    提取所述链接对应的域名，确定所述域名为新域名，则将所述域名插入到待扫描队列中作为优先处理的待扫描任务；
    针对待扫描队列中的待扫描任务进行漏洞扫描。
  2. 根据权利要求1所述的方法，获取所述超文本传输协议请求包对应的链接之后还包括：
    将所述链接加入到链接库中；
    根据所述链接库确定所述链接是否为新链接和/或所述域名是否为新域名。
  3. 根据权利要求2所述的方法，将所述链接加入到链接库中还包括：
    将所述链接库中具有相同域名的链接进行汇总。
  4. 根据权利要求1-3任一项所述的方法，所述确定所述域名为新域名进一步包括：
    检测在预设时间段内是否有所述域名的流量，若否，则确定所述域名为新域名。
  5. 根据权利要求1-3任一项所述的方法，所述确定所述域名为新域名进一步包括：
    若检测所述域名所属的IP地址或IP地址范围存在所述域名所有人的验证域名，则确定所述域名为所述所有人的新域名。
  6. 根据权利要求1-5任一项所述的方法，在所述将链接加入到链接库中之前还包括：
    分析所述链接是否为有效链接。
  7. 根据权利要求1-6任一项所述的方法，所述针对待扫描队列中的待扫描任务进行漏洞扫描具体包括：
    向与所述待扫描任务对应的目标网站发送测试请求，根据所述目标网站返回的网页进行漏洞扫描。
  8. 一种网站安全检测装置，包括：
    抓取模块，适于针对网络进行旁路侦听，抓取超文本传输协议(http)请求包；
    获取模块，适于获取所述超文本传输协议请求包对应的链接；
    处理模块，适于确定所述链接为新链接和/或提取所述链接对应的域名，确定所述域名为新域名；
    插入模块，适于将所述链接和/或所述域名插入到待扫描队列中作为优先处理的待扫描任务；扫描模块，适于针对待扫描队列中的待扫描任务进行漏洞扫描。
  9. 根据权利要求8所述的装置，还包括：
    链接库，适于存储所述链接；
    判断模块，适于根据所述链接库确定所述链接是否为新链接和/或所述域名是否为新域名。
  10. 根据权利要求9所述的装置，还包括：
    汇总模块，适于将所述链接库中具有相同域名的链接进行汇总。
  11. 根据权利要求8-10任一项所述的装置，所述处理模块具体适于：
    检测在预设时间段内是否有所述域名的流量，若否，则确定所述域名为新域名。
  12. 根据权利要求8-10任一项所述的装置，所述处理模块具体适于：
    检测所述域名所属的IP地址或IP地址范围是否存在所述域名所有人的验证域名，若存在，则判定所述域名为所述所有人的新域名。
  13. 根据权利要求8-12任一项所述的装置，还包括：
    分析模块，适于分析所述链接是否为有效链接。
  14. 根据权利要求8-13任一项所述的装置，所述扫描模块进一步包括：
    请求单元，适于向与所述待扫描任务对应的目标网站发送测试请求；
    扫描单元，适于根据所述目标网站返回的网页进行漏洞扫描。
  15. 一种计算机程序，包括计算机可读代码，当电子设备运行所述计算机可读代码运行时，导致权利要求1-7中的任一项权利要求所述的网站安全检测方法被执行。
  16. 一种计算机可读介质，其中存储了如权利要求15所述的计算机程序。
PCT/CN2014/095944 2014-04-11 2014-12-31 网站安全检测方法及装置 WO2015154539A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/303,216 US9954886B2 (en) 2014-04-11 2014-12-31 Method and apparatus for detecting website security
US15/939,133 US20180219907A1 (en) 2014-04-11 2018-03-28 Method and apparatus for detecting website security

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410144318.7 2014-04-11
CN201410144318.7A CN104980309B (zh) 2014-04-11 2014-04-11 网站安全检测方法及装置

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US15/303,216 A-371-Of-International US9954886B2 (en) 2014-04-11 2014-12-31 Method and apparatus for detecting website security
US15/939,133 Continuation US20180219907A1 (en) 2014-04-11 2018-03-28 Method and apparatus for detecting website security

Publications (1)

Publication Number Publication Date
WO2015154539A1 true WO2015154539A1 (zh) 2015-10-15

Family

ID=54276441

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095944 WO2015154539A1 (zh) 2014-04-11 2014-12-31 网站安全检测方法及装置

Country Status (3)

Country Link
US (2) US9954886B2 (zh)
CN (1) CN104980309B (zh)
WO (1) WO2015154539A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713347A (zh) * 2017-01-18 2017-05-24 国网江苏省电力公司电力科学研究院 一种电力移动应用越权访问漏洞检测方法
WO2020019479A1 (zh) * 2018-07-27 2020-01-30 平安科技（深圳）有限公司 网站安全检测方法和装置
CN112887173A (zh) * 2021-02-19 2021-06-01 山东英信计算机技术有限公司 一种存储网络检测方法、装置、设备及可读存储介质
CN116305154A (zh) * 2023-03-08 2023-06-23 北京航天驭星科技有限公司 一种卫星测控软件的漏洞管理方法及相关设备

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106899549B (zh) * 2015-12-18 2020-02-07 北京奇虎科技有限公司 一种网络安全检测方法及装置
US10440042B1 (en) * 2016-05-18 2019-10-08 Area 1 Security, Inc. Domain feature classification and autonomous system vulnerability scanning
CN108632219B (zh) * 2017-03-21 2021-04-27 腾讯科技（深圳）有限公司 一种网站漏洞检测方法、检测服务器、系统及存储介质
CN108667770B (zh) * 2017-03-29 2020-12-18 腾讯科技（深圳）有限公司 一种网站的漏洞测试方法、服务器及系统
CN107634945B (zh) 2017-09-11 2018-06-22 平安科技（深圳）有限公司 网站漏洞扫描方法、装置、计算机设备及存储介质
CN108173814B (zh) * 2017-12-08 2021-02-05 深信服科技股份有限公司 钓鱼网站检测方法、终端设备及存储介质
CN108282489B (zh) * 2018-02-07 2020-01-31 网宿科技股份有限公司 一种漏洞扫描方法、服务端及系统
CN108449355A (zh) * 2018-04-04 2018-08-24 上海有云信息技术有限公司 一种漏洞扫描方法及系统
CN110061979B (zh) * 2019-04-01 2022-01-11 视联动力信息技术股份有限公司 一种业务对象的检测方法和装置
CN111104188B (zh) * 2019-11-11 2024-05-10 中盈优创资讯科技有限公司 漏洞扫描器的调度方法及装置
CN110971599A (zh) * 2019-11-29 2020-04-07 杭州迪普科技股份有限公司 漏洞扫描方法和装置
CN110825541A (zh) * 2019-11-30 2020-02-21 东莞市诺尔检测科技有限公司 一种用于家用电器的安全检测数据处理系统
CN111124841B (zh) * 2019-12-09 2023-08-18 广州品唯软件有限公司 一种异常页面的报警方法、装置及计算机系统
RU2743974C1 (ru) * 2019-12-19 2021-03-01 Общество с ограниченной ответственностью "Группа АйБи ТДС" Система и способ сканирования защищенности элементов сетевой архитектуры
CN111314326B (zh) * 2020-02-01 2022-06-21 深信服科技股份有限公司 Http漏洞扫描主机的确认方法、装置、设备及介质
CN111428179B (zh) * 2020-03-19 2023-09-19 新方正控股发展有限责任公司 图片监测方法、装置及电子设备
CN112906005A (zh) * 2021-02-02 2021-06-04 浙江大华技术股份有限公司 Web漏洞扫描方法、装置、系统、电子装置和存储介质
CN113422759B (zh) * 2021-06-10 2023-04-18 杭州安恒信息技术股份有限公司 漏洞扫描方法、电子装置和存储介质
CN113407948B (zh) * 2021-06-25 2022-05-27 苏州浪潮智能科技有限公司 一种基于预加载的安全扫描方法及装置
CN113536086B (zh) * 2021-06-30 2023-07-14 北京百度网讯科技有限公司 模型训练方法、账号评分方法、装置、设备、介质和产品
CN113836533B (zh) * 2021-09-27 2024-05-24 深信服科技股份有限公司 一种文件监测方法、装置、电子设备及可读存储介质
CN115426202B (zh) * 2022-11-03 2023-01-24 北京源堡科技有限公司 扫描任务下发方法、装置、计算机设备及可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1870493A (zh) * 2006-06-15 2006-11-29 北京华景中天信息技术有限公司 网站安全漏洞扫描方法
CN101101601A (zh) * 2007-07-10 2008-01-09 北京大学 网络搜索中的基于链接层次分类的主题爬取方法
CN103414718A (zh) * 2013-08-16 2013-11-27 蓝盾信息安全技术股份有限公司 一种分布式Web漏洞扫描的方法

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008142710A2 (en) * 2007-05-24 2008-11-27 Iviz Techno Solutions Pvt. Ltd Method and system for simulating a hacking attack on a network
US8286239B1 (en) * 2008-07-24 2012-10-09 Zscaler, Inc. Identifying and managing web risks
US8763071B2 (en) * 2008-07-24 2014-06-24 Zscaler, Inc. Systems and methods for mobile application security classification and enforcement
EP2222048A1 (en) * 2009-02-24 2010-08-25 BRITISH TELECOMMUNICATIONS public limited company Detecting malicious behaviour on a computer network
US8407791B2 (en) * 2009-06-12 2013-03-26 QinetiQ North America, Inc. Integrated cyber network security system and method
CN101964025B (zh) * 2009-07-23 2016-02-03 北京神州绿盟信息安全科技股份有限公司 Xss检测方法和设备
KR101092024B1 (ko) * 2010-02-19 2011-12-12 박희정 웹 서비스의 실시간 취약성 진단 및 결과정보 제공 서비스 시스템
US8516585B2 (en) * 2010-10-01 2013-08-20 Alcatel Lucent System and method for detection of domain-flux botnets and the like
US8677487B2 (en) * 2011-10-18 2014-03-18 Mcafee, Inc. System and method for detecting a malicious command and control channel
CN102710646B (zh) * 2012-06-06 2016-08-03 珠海市君天电子科技有限公司 一种钓鱼网站的收集方法和系统
CN103258032A (zh) * 2013-05-10 2013-08-21 清华大学 平行网页获取方法及装置
US9203849B2 (en) * 2013-12-04 2015-12-01 Apple Inc. Preventing URL confusion attacks

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1870493A (zh) * 2006-06-15 2006-11-29 北京华景中天信息技术有限公司 网站安全漏洞扫描方法
CN101101601A (zh) * 2007-07-10 2008-01-09 北京大学 网络搜索中的基于链接层次分类的主题爬取方法
CN103414718A (zh) * 2013-08-16 2013-11-27 蓝盾信息安全技术股份有限公司 一种分布式Web漏洞扫描的方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713347A (zh) * 2017-01-18 2017-05-24 国网江苏省电力公司电力科学研究院 一种电力移动应用越权访问漏洞检测方法
CN106713347B (zh) * 2017-01-18 2019-06-11 国网江苏省电力公司电力科学研究院 一种电力移动应用越权访问漏洞检测方法
WO2020019479A1 (zh) * 2018-07-27 2020-01-30 平安科技（深圳）有限公司 网站安全检测方法和装置
CN112887173A (zh) * 2021-02-19 2021-06-01 山东英信计算机技术有限公司 一种存储网络检测方法、装置、设备及可读存储介质
CN112887173B (zh) * 2021-02-19 2023-05-23 山东英信计算机技术有限公司 一种存储网络检测方法、装置、设备及可读存储介质
CN116305154A (zh) * 2023-03-08 2023-06-23 北京航天驭星科技有限公司 一种卫星测控软件的漏洞管理方法及相关设备
CN116305154B (zh) * 2023-03-08 2023-11-21 北京航天驭星科技有限公司 一种卫星测控软件的漏洞管理方法及相关设备

Also Published As

Publication number Publication date
US20180219907A1 (en) 2018-08-02
CN104980309A (zh) 2015-10-14
US20170034203A1 (en) 2017-02-02
US9954886B2 (en) 2018-04-24
CN104980309B (zh) 2018-04-20

Similar Documents

Publication Publication Date Title
WO2015154539A1 (zh) 网站安全检测方法及装置
US9300686B2 (en) System and method for detecting malicious links in electronic messages
CN105184159B (zh) 网页篡改的识别方法和装置
US7865953B1 (en) Methods and arrangement for active malicious web pages discovery
US8862675B1 (en) Method and system for asynchronous analysis of URLs in messages in a live message processing environment
US8819819B1 (en) Method and system for automatically obtaining webpage content in the presence of javascript
CN106357689B (zh) 威胁数据的处理方法及系统
CN109274632B (zh) 一种网站的识别方法及装置
CN111163095B (zh) 网络攻击分析方法、网络攻击分析装置、计算设备和介质
WO2015062541A1 (zh) 对抗免杀测试的云查杀方法、装置及系统
KR20180074774A (ko) 악의 웹 사이트 식별 방법, 장치 및 컴퓨터 기억매체
CN103746992A (zh) 基于逆向的入侵检测系统及其方法
JP5752642B2 (ja) 監視装置および監視方法
CN113810408B (zh) 网络攻击组织的探测方法、装置、设备及可读存储介质
CN110311927B (zh) 数据处理方法及其装置、电子设备和介质
CN111163094B (zh) 网络攻击检测方法、网络攻击检测装置、电子设备和介质
WO2015188604A1 (zh) 钓鱼网页的检测方法和装置
CN110336835A (zh) 恶意行为的检测方法、用户设备、存储介质及装置
JPWO2012132296A1 (ja) 情報漏洩防止装置、方法及びプログラム
EP3340097B1 (en) Analysis device, analysis method, and analysis program
JP2007156690A (ja) フィッシング詐欺対策方法、端末、サーバ及びプログラム
JP6258189B2 (ja) 特定装置、特定方法および特定プログラム
JP6007308B1 (ja) 情報処理装置、情報処理方法及びプログラム
JP5966076B1 (ja) 情報処理装置、情報処理方法及びプログラム
JP6105797B1 (ja) 情報処理装置、情報処理方法及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14888858

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15303216

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14888858

Country of ref document: EP

Kind code of ref document: A1