WO2016201889A1 - 网址劫持检测的方法及装置 - Google Patents

网址劫持检测的方法及装置 Download PDF

Info

Publication number
WO2016201889A1
WO2016201889A1 PCT/CN2015/095336 CN2015095336W WO2016201889A1 WO 2016201889 A1 WO2016201889 A1 WO 2016201889A1 CN 2015095336 W CN2015095336 W CN 2015095336W WO 2016201889 A1 WO2016201889 A1 WO 2016201889A1
Authority
WO
WIPO (PCT)
Prior art keywords
url
jump
access
secure
determining
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/095336
Other languages
English (en)
French (fr)
Inventor
於一飞
杜中义
左景龙
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xiaomi Inc
Original Assignee
Xiaomi Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xiaomi Inc filed Critical Xiaomi Inc
Priority to MX2017003545A priority Critical patent/MX364352B/es
Priority to JP2016525092A priority patent/JP6271725B2/ja
Priority to RU2016140114A priority patent/RU2658191C2/ru
Priority to KR1020177009157A priority patent/KR101994561B1/ko
Publication of WO2016201889A1 publication Critical patent/WO2016201889A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2457—Query processing with adaptation to user needs
    • G06F16/24578—Query processing with adaptation to user needs using ranking
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/951—Indexing; Web crawling techniques
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present disclosure relates to the field of network security technologies, and in particular, to a method and an apparatus for detecting a website hijacking.
  • Some network operators will listen to the user's request on the intermediate route when the user accesses the network. When matching certain conditions, the user will return a jump response before the target server, so that the user can jump to the network operator.
  • the destination page of the jump may be a phishing website, or a Trojan horse, a bullet box advertisement, etc., which affects the user's experience; if the user requests a cooperative website of the browser, it may also damage the legitimate interests of the browser.
  • Embodiments of the present disclosure provide a method and an apparatus for detecting a web address hijacking, including the following technical solutions:
  • a method for URL hijacking detection including:
  • the determining, according to the URL access instruction history, the secure jump URL of the current access URL including:
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • the current is determined according to the obtained at least one of the historical website access instructions.
  • the safe URL of the access URL including:
  • determining the security jump URL of the current access URL according to the probability P of the jump URL and/or the access time T including:
  • the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL
  • each jump URL in the at least one of the historical website access instructions is determined as the secure jump URL.
  • determining a secure jump URL of the current access URL according to a probability of occurrence of the jump URL and/or the access time including:
  • the time interval between the last access time and the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • determining a secure jump URL of the current access URL according to a probability of occurrence of the jump URL and/or the access time including:
  • the weight N of the ratio of the time interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the determining, according to the secure jump URL, whether the target jump URL is hijacked comprises:
  • the method further includes:
  • the method further includes:
  • All the URL access instructions of the record are sorted in ascending order according to the access time order;
  • an apparatus for detecting a web address hijacking includes:
  • the obtaining module is configured to obtain a current access URL and a target jump URL in the current URL access instruction
  • a first determining module configured to determine, according to the URL access instruction history record, a secure jump URL of the current access URL
  • a second determining module configured to determine, according to the secure jump URL, whether the target jump URL is hijacked.
  • the first determining module comprises:
  • Obtaining a sub-module configured to obtain, by the URL access instruction history record, a historical website access instruction corresponding to the current access URL;
  • the website determining sub-module is configured to determine, according to the obtained at least one of the historical website access instructions, a secure jump URL of the current visited web address.
  • the historical website access instruction includes the access URL, whether the jump, the jump URL, and the access time are included.
  • the URL determination sub-module is used to:
  • the URL determination sub-module is further configured to:
  • the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL
  • each of the at least one of the historical URL access instructions is redirected Both are determined as the secure jump URL.
  • the URL determination sub-module is further configured to:
  • the time interval between the last access time and the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • the URL determination sub-module is further configured to:
  • the weight N of the ratio of the time interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the second determining module comprises:
  • a first URL determining submodule configured to determine that the target jump URL is not hijacked when the target jump URL matches the secure jump URL
  • the second website determining submodule is configured to determine that the target jump URL is hijacked when the target jump URL does not match the secure jump URL.
  • the apparatus further includes:
  • an execution module configured to perform an operation of preventing a jump to the target jump URL after determining that the target jump URL is hijacked.
  • the apparatus further includes:
  • a recording module configured to record the URL access instruction according to the current access time
  • a sorting module configured to sort all the URL access instructions of the record in ascending order of access time
  • a selection module configured to: from all the URL access instructions after the arrangement, determine a preset number of URL access instructions whose access time is before the current access time, access the instruction history for the URL; or, from the arranged all In the URL access instruction, a web access instruction that determines that the time interval between the current access time is less than or equal to a preset duration is the access command history record.
  • an apparatus for detecting a web address hijacking includes:
  • a memory for storing processor executable instructions
  • processor is configured to:
  • obtaining a current access URL and a target jump URL in the current URL access instruction determining a secure jump URL of the current access URL according to the URL access instruction history;
  • the jump URL determines whether the target jump URL is hijacked.
  • the disclosure determines the security jump URL according to the historical website access instruction, and then determines whether the target jump URL is hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found without prior maintenance and delivery. Blacklisted URLs can also detect hijacking, increase the recognition rate of hijacked URLs, and reduce costs.
  • determining the secure jump URL of the current access URL according to the URL access instruction history record including: obtaining the current visit URL from the URL access instruction history record Corresponding historical website access instruction; determining the secure jump URL of the current access URL according to the obtained at least one of the historical website access instructions.
  • the disclosure determines a secure jump URL according to a historical website access instruction corresponding to the current visited website, and then determines whether the target jump URL is hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the disclosure can be immediately It was found that hijacking can be found without prior maintenance and blacklisting of URLs, improving the recognition rate of hijacked websites and reducing costs.
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • the historical URL access instruction of the disclosure includes an access URL, whether a jump, a jump URL, and an access time are included, and then the secure jump URL is determined according to the access URL, whether the jump, the jump URL, and the access time are included, and the URL is guaranteed. The security of the jump.
  • determining, according to the obtained at least one of the historical website access instructions, the secure jump URL of the current visited web address including: accessing the obtained at least one of the historical website addresses
  • the command performs statistical analysis to calculate the probability of occurrence of different jump URLs, and determines a secure jump URL of the current visited web address according to the probability P of the jump URL and/or the access time.
  • the present disclosure can quickly determine a secure jump URL according to the probability of occurrence of the jump URL, the access time or probability, and the access time, and can make the result of the determined secure jump URL more accurate, thereby further ensuring the security of the URL jump. Improve the recognition rate of hijacked websites and reduce costs.
  • determining the secure jump URL of the current visited web address according to the probability P and/or the access time of the jump URL including: determining the at least one of the Whether the history URL access instruction includes a jump URL whose occurrence probability is greater than a preset probability threshold; when the judgment result is included, determining the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL; When the determination result is not included, each jump URL in the at least one of the historical URL access instructions is determined as the secure jump URL.
  • the jump URLs whose occurrence probability is greater than the preset probability threshold are used as the security jump URL, thereby ensuring the accuracy of the secure jump URL. . If the history URL access command does not include a jump URL whose probability is greater than the preset probability threshold, then the probability distribution in the history URL access command is more dispersed. At this time, all the jumps in the history URL access command may be temporarily considered. Transfer URLs are all secure.
  • determining, according to the probability of occurrence of the jump URL and/or the access time, the secure jump URL of the current visited web address including: the last access time and The time interval of the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • the jump URL may also be considered as safe.
  • determining a secure jump URL of the current visited web address according to a probability of occurrence of the jump URL and/or the access time including: when the jump URL is The probability P of occurrence, the access time interval T of the last access time and the current access time, the weight M of the probability P of occurrence of the jump URL, the ratio of the access time interval T to the maximum access time interval T max
  • the weight N and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the disclosure can also jointly determine the security jump URL according to the two conditions of the probability of the jump URL appearing and the access time, which can make the determined result of the secure jump URL more accurate, thereby further ensuring the security of the URL jump and improving The recognition rate of hijacked URLs reduces costs.
  • determining whether the target jump URL is hijacked according to the secure jump URL comprises: determining, when the target jump URL matches the secure jump URL, determining The target jump URL is not hijacked; when the target jump URL does not match the secure jump URL, it is determined that the target jump URL is hijacked.
  • the disclosure determines the security jump URL according to the historical website access instruction, and then determines whether the target jump URL is hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found, and no need to maintain and black out in advance.
  • the list URL can also detect hijacking, improve the recognition rate of hijacked URLs, and reduce costs.
  • the method further includes performing an operation of preventing a jump to the target jump URL after determining that the target jump URL is hijacked.
  • the operation of the present disclosure to prevent jumping to the target jump URL may include one or more of the following: outputting a warning prompt message to prompt the user, switching to https, using a proxy server. Of course, it can also include other operations that can prevent a jump to the target jump URL. In this way, the security of the network can be guaranteed.
  • the method further includes: recording the URL access instruction according to the current access time; sorting all recorded URL access instructions in ascending order according to an access time order; accessing from all arranged URLs In the instruction, determining a preset number of URL access instructions whose access time is before the current access time, accessing the instruction history record for the URL; or determining, from all the URL access instructions after the arrangement, the current access time A URL access instruction having a time interval less than or equal to a preset duration, accessing the instruction history for the URL.
  • the disclosure selects the access time requirement in the all the URL access instructions recorded, or the preset number of URL access instructions as the URL access instruction history record, and then finds the access URL as the current access from the access URL access instruction history record.
  • the historical URL access command of the URL so that the historical URL access can be updated as the current access time changes, so that the secure jump URL can be automatically learned and corrected, so that the result of the secure jump URL is more accurate, that is, the hijacked
  • the judgment result of the website is more accurate.
  • the user does not need to maintain and update the network blacklist in real time, which reduces the user's operation and improves the user experience.
  • FIG. 1 is a flow chart showing a method of URL hijacking detection according to an exemplary embodiment.
  • FIG. 2 is a flowchart of a method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 3 is a flowchart of step S202 in a method for detecting URL hijacking according to an exemplary embodiment.
  • FIG. 4 is a flowchart of step S302 in a method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 5 is a flowchart of step S302 in another method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 6 is a flowchart of step S302 in another method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 7 is a flowchart of step S103 in a method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 8 is a flowchart of still another method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 9 is a flowchart of still another method for URL hijacking detection according to an exemplary embodiment.
  • FIG. 10 is a block diagram of an apparatus for URL hijacking detection, according to an exemplary embodiment.
  • FIG. 11 is a block diagram of a first determining module in a device for URL hijacking detection according to an exemplary embodiment.
  • FIG. 12 is a block diagram of a second determining module in a device for URL hijacking detection, according to an exemplary embodiment.
  • FIG. 13 is a block diagram of an apparatus for URL hijacking detection, according to an exemplary embodiment.
  • FIG. 14 is a block diagram of another apparatus for URL hijacking detection, according to an exemplary embodiment.
  • 15 is a block diagram of an apparatus suitable for URL hijacking detection, according to an exemplary embodiment.
  • the embodiment of the present disclosure provides a method for detecting a web address hijacking, which can be used in a terminal device, such as a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, and a fitness device.
  • a terminal device such as a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, and a fitness device.
  • a personal digital assistant or the like having a function of accessing a website, as shown in FIG. 1, the method includes steps S101-S103:
  • step S101 the current access URL and the target jump URL in the current URL access instruction are obtained.
  • step S102 the secure jump URL of the current access web address is determined according to the web address access instruction history record.
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • step S103 it is determined whether the target jump URL is hijacked according to the secure jump URL.
  • the security jump URL is determined according to the historical website access instruction, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found without prior maintenance.
  • the blacklisting URL can also find hijacking, improve the recognition rate of hijacked URLs, and reduce costs.
  • step S102 includes steps S201-S202:
  • the historical website access instruction corresponding to the current access web address is obtained from the web address access instruction history record.
  • the historical URL access instruction corresponding to the current access URL may be a URL access instruction history record, the access URL is a historical URL access instruction of the current access URL, or the jump URL is a target jump.
  • the historical URL access directive for the URL is a URL access instruction history record.
  • step S202 the secure jump URL of the current visited web address is determined according to the obtained at least one historical web address access instruction.
  • the secure jump URL is determined according to the historical website access instruction corresponding to the current visited website, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered It can be immediately discovered that hijacking can be found without prior maintenance and blacklisting of URLs, improving the recognition rate of hijacked websites and reducing costs.
  • step S202 includes steps S301-S302:
  • step S301 the obtained at least one historical website access instruction is statistically analyzed, and the probability P of occurrence of different jump URLs is separately calculated.
  • the probability that the obtained at least one historical website access instruction corresponds to is 1, and the probability that each jump URL occupies in all the jump URLs can be separately calculated, and the secure jump URL is determined accordingly.
  • step S302 the security jump URL of the current access URL is determined according to the probability P and/or the access time of the jump URL.
  • determining the secure jump URL according to the probability of occurrence of the jump URL, the access time or the probability, and the access time may make the determined result of the secure jump URL more accurate, thereby further ensuring the security of the URL jump. Improve the recognition rate of hijacked websites and reduce costs.
  • step S302 can be implemented in the following manners:
  • step S302 includes steps S401-S403:
  • step S401 it is determined whether the at least one historical website access instruction includes a jump URL whose occurrence probability is greater than a preset probability threshold.
  • step S402 when the determination result is included, the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL.
  • step S403 when the determination result is not included, each jump URL in at least one historical website access instruction is determined as a secure jump URL.
  • the jump URLs whose occurrence probability is greater than the preset probability threshold are used as the security jump URL, thereby ensuring a secure jump.
  • the accuracy of the URL If the historical URL access command does not include a jump URL whose probability is greater than the preset probability threshold, then the probability distribution in the historical URL access command is more dispersed. All jump URLs in the order are safe. In this way, the result of the determined secure jump URL can be made more accurate, thereby further ensuring the security of the URL jump, improving the recognition rate of the hijacked website, and reducing the cost.
  • the obtained historical access URL corresponding to the current access URL has 10 access commands, wherein the preset probability threshold is 0.5. If the 10 historical URL access instructions contain 2 different jump URLs, one is jump URL 1, one is jump URL 2, the probability of jump URL 1 is 0.6, and the probability of jump URL 2 is 0.4. Then, since the probability of occurrence of the jump URL 1 is greater than the preset probability threshold of 0.5, the jump URL 1 can be determined as the secure jump URL.
  • the 10 historical URL access instructions contain 4 different jump URLs, namely jump URL 1, jump URL 2, jump URL 3, jump URL 4, the probability of jump URL 1 is 0.2, skip The probability of forwarding URL 2 is 0.3, the probability of jumping URL 3 is 0.2, and the probability of jumping URL 4 is 0.3, then 4 hops can be obtained because the probability of occurrence of 4 jump URLs is less than the preset probability threshold of 0.5.
  • the forwarding URLs are all determined to be secure jump URLs.
  • step S302 further includes step S501:
  • step S501 the time interval between the last access time and the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • the jump may also be considered.
  • the URL is safe.
  • a jump URL is consecutively N 1 times, and the interval between the last access time of the jump URL and the current access time is less than a preset time interval, where N 1 >2, the preset time interval may be less than or equal to 1 day. For example, if the last access time of the jump URL is one day apart from the current access time, and the jump URL appears three times in succession, the jump URL may be considered as a secure jump URL.
  • step S302 further includes step S601:
  • step S601 the probability P when a jump URL appears, the access time interval T of the last access time and the current access time, the weight M of the probability P of the jump URL appearing, the access time interval T and the maximum access time
  • the weight N of the ratio of the interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the security jump threshold is 0.5
  • the probability of a jump URL appearing is 0.4
  • the weight M is 0.6
  • T is 12 hours
  • T max is 24 hours
  • the jump URL can be considered as a secure jump URL.
  • the greater the probability that the jump URL appears the smaller the access time interval is, the more likely the jump URL becomes a secure jump URL.
  • the smaller the probability of the jump URL appearing the larger the access interval , the possibility that the jump URL becomes a secure jump URL is lower.
  • the security jump URL may be determined according to the probability of the jump URL appearing and the access time, so that the determined result of the secure jump URL is more accurate, thereby further ensuring the security of the URL jump and improving The recognition rate of hijacked URLs reduces costs.
  • step S103 includes steps S701-S702:
  • step S701 when the target jump URL matches the secure jump URL, it is determined that the target jump URL is not hijacked;
  • step S702 when the target jump URL does not match the secure jump URL, it is determined that the target jump URL is hijacked.
  • the security jump URL is determined according to the historical website access instruction, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found without prior maintenance.
  • the blacklisting URL can also find hijacking, improve the recognition rate of hijacked URLs, and reduce costs.
  • step S801 the method further includes step S801:
  • step S801 after it is determined that the target jump URL is hijacked, an operation of preventing the jump to the target jump URL is performed.
  • the operation of blocking the jump to the target jump URL may include one or more of the following: outputting a warning prompt message to prompt the user, switching to https, using a proxy server.
  • it can also include other operations that can prevent a jump to the target jump URL. In this way, the security of the network can be ensured, and the unsafe URLs such as phishing websites can be avoided, and the network security risks are brought to the users.
  • the method before step S101, the method further includes steps S901-S903:
  • step S901 the web address access instruction is recorded according to the current access time.
  • step S902 all the web address access instructions recorded are sorted in ascending order according to the access time order.
  • step S903 from all the URL access instructions after the arrangement, a preset number of URL access instructions whose access time is before the current access time are determined as the URL access instruction history record. Or, from all the URL access instructions in the arrangement, determining a URL access instruction that is less than or equal to a preset duration between the current access time and the address access instruction history.
  • the preset number of URL access commands whose access time is before the current access time may be a continuous preset number of URL access commands before the current access time, or may be a non-contiguous preset before the current access time.
  • the number of URL access instructions may be a continuous preset number of URL access commands before the current access time, or may be a non-contiguous preset before the current access time.
  • all the URL access instructions recorded are selected to meet the access time requirement, or a preset number of URL access instructions are used as the URL access instruction history record, and then the access URL is found from the access URL access instruction history record.
  • the historical URL access command for the current access URL so that the historical URL access can be updated as the current access time changes, so that the secure jump URL can be automatically learned and corrected, thereby making the result of the secure jump URL more accurate. That is to say, the judgment result of the hijacked website is more accurate.
  • the user does not need to maintain and update the network blacklist in real time, which reduces the user's operation and improves the user experience.
  • FIG. 10 is a block diagram of an apparatus for web address hijacking detection, which may be implemented as part or all of an electronic device by software, hardware, or a combination of both, according to an exemplary embodiment.
  • the device for detecting the URL hijacking includes:
  • the obtaining module 1001 is configured to obtain a current access URL and a target jump URL in the current URL access instruction.
  • the first determining module 1002 is configured to determine a secure jump URL of the current visited web address according to the web address access instruction history record.
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • the second determining module 1003 is configured to determine whether the target jump URL is hijacked according to the secure jump URL.
  • the security jump URL is determined according to the historical website access instruction, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found without prior maintenance.
  • the blacklisting URL can also find hijacking, improve the recognition rate of hijacked URLs, and reduce costs.
  • the first determining module 1002 includes:
  • the obtaining submodule 1101 is configured to obtain a historical web address access instruction corresponding to the current access web address from the web address access instruction history record.
  • the URL determination sub-module 1102 is configured to determine a secure jump URL of the current access URL based on the obtained at least one historical URL access instruction.
  • the secure jump URL is determined according to the historical website access instruction corresponding to the current visited website, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered It can be immediately discovered that hijacking can be found without prior maintenance and blacklisting of URLs, improving the recognition rate of hijacked websites and reducing costs.
  • the URL determining sub-module 1102 is configured to perform statistical analysis on the obtained at least one historical URL access instruction, and respectively calculate a probability of occurrence of different jump URLs. Probability P and/or based on the jump URL Visit time T to determine the secure jump URL of the current access URL.
  • determining the secure jump URL according to the probability of occurrence of the jump URL, the access time or the probability, and the access time may make the determined result of the secure jump URL more accurate, thereby further ensuring the security of the URL jump. Improve the recognition rate of hijacked websites and reduce costs.
  • the URL determining sub-module 1102 is further configured to: determine whether the at least one historical website access instruction includes a jump URL whose occurrence probability is greater than a preset probability threshold. When the judgment result is included, the jump URL whose probability is greater than the preset probability threshold is determined as the secure jump URL. When the judgment result is not included, each jump URL in at least one historical URL access instruction is determined as a secure jump URL.
  • the jump URLs whose occurrence probability is greater than the preset probability threshold are used as the security jump URL, thereby ensuring a secure jump.
  • the accuracy of the URL If the history URL access command does not include a jump URL whose probability is greater than the preset probability threshold, then the probability distribution in the history URL access command is more dispersed. At this time, all the jumps in the history URL access command may be temporarily considered. Transfer URLs are all secure. In this way, the result of the determined secure jump URL can be made more accurate, thereby further ensuring the security of the URL jump, improving the recognition rate of the hijacked website, and reducing the cost.
  • the obtained historical access URL corresponding to the current access URL has 10 access commands, wherein the preset probability threshold is 0.5. If the 10 historical URL access instructions contain 2 different jump URLs, one is jump URL 1, one is jump URL 2, the probability of jump URL 1 is 0.6, and the probability of jump URL 2 is 0.4. Then, since the probability of occurrence of the jump URL 1 is greater than the preset probability threshold of 0.5, the jump URL 1 can be determined as the secure jump URL. If the 10 historical URL access instructions contain 4 different jump URLs, respectively, jump URL 1, jump URL 2, jump URL 3, jump URL 4, the probability of jump URL 1 is 0.2, jump The probability of URL 2 is 0.3, the probability of jump URL 3 is 0.2, and the probability of jump URL 4 is 0.3. Since the probability of occurrence of 4 jump URLs is less than the preset probability threshold of 0.5, 4 jumps can be used. The URL is determined to be a secure jump URL.
  • the URL determining sub-module is further configured to: determine that the time interval between the last access time and the current access time is less than a preset time interval, and the number of consecutive occurrences is greater than or equal to the preset number of jump URL determinations. Jump URLs for security.
  • the jump may also be considered.
  • the URL is safe.
  • a jump URL is consecutively N 1 times, and the interval between the last access time of the jump URL and the current access time is less than a preset time interval, where N 1 >2, the preset time interval may be less than or equal to 1 day. For example, if the last access time of the jump URL is within one day of the current access time, and the jump URL appears three times in succession, the jump URL may be considered as a secure jump URL.
  • the URL determining sub-module is further configured to: a probability P when a jump URL appears, an access time interval T of the last access time and the current access time, and a weight M of the probability P of the jump URL appearing
  • the weight N of the ratio of the access time interval T to the maximum access time interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the security jump threshold is 0.5
  • the probability of a jump URL appearing is 0.4
  • the weight M is 0.6
  • T is 12 hours
  • T max is 24 hours
  • the jump URL can be considered as a secure jump URL.
  • the greater the probability that the jump URL appears the smaller the access time interval is, the more likely the jump URL becomes a secure jump URL.
  • the smaller the probability of the jump URL appearing the larger the access interval , the possibility that the jump URL becomes a secure jump URL is lower.
  • the security jump URL may be determined according to the probability of the jump URL appearing and the access time, so that the determined result of the secure jump URL is more accurate, thereby further ensuring the security of the URL jump and improving The recognition rate of hijacked URLs reduces costs.
  • the foregoing second determining module 1003 includes:
  • the first URL determination sub-module 1201 is configured to determine that the target jump URL is not hijacked when the target jump URL matches the secure jump URL.
  • the second URL determining sub-module 1202 is configured to not match the target jump URL and the secure jump URL, it is determined that the target jump URL is hijacked.
  • the security jump URL is determined according to the historical website access instruction, and then the target jump URL is determined to be hijacked according to the secure jump URL, so that when an abnormal jump is encountered, the discovery can be immediately found without prior maintenance.
  • the blacklisting URL can also find hijacking, improve the recognition rate of hijacked URLs, and reduce costs.
  • the foregoing apparatus further includes:
  • the execution module 1301 is configured to perform an operation of preventing a jump to the target jump URL after determining that the target jump URL is hijacked.
  • the operation of blocking the jump to the target jump URL may include one or more of the following: outputting a warning prompt message to prompt the user, switching to https, using a proxy server. Of course, it can also include other operations that can prevent a jump to the target jump URL. In this way, you can ensure the security of the network and avoid jumping to unsafe websites such as phishing websites. And bring users network security risks.
  • the foregoing apparatus further includes:
  • the recording module 1401 is configured to record a web address access instruction in accordance with the current access time.
  • the sorting module 1402 is configured to sort all recorded web access instructions in ascending order of access time.
  • the selection module 1403 is configured to determine, from all the URL access instructions after the arrangement, a preset number of URL access instructions whose access time is before the current access time, which is a URL access instruction history record; or, from all the arranged URL access commands
  • the web access instruction that determines that the time interval between the current access time is less than or equal to the preset duration is the URL access instruction history.
  • the preset number of URL access commands whose access time is before the current access time may be a continuous preset number of URL access commands before the current access time, or may be a non-contiguous preset before the current access time.
  • the number of URL access instructions may be a continuous preset number of URL access commands before the current access time, or may be a non-contiguous preset before the current access time.
  • all the URL access instructions recorded are selected to meet the access time requirement, or a preset number of URL access instructions are used as the URL access instruction history record, and then the access URL is found from the access URL access instruction history record.
  • the historical URL access command for the current access URL so that the historical URL access can be updated as the current access time changes, so that the secure jump URL can be automatically learned and corrected, thereby making the result of the secure jump URL more accurate. That is to say, the judgment result of the hijacked website is more accurate.
  • the user does not need to maintain and update the network blacklist in real time, which reduces the user's operation and improves the user experience.
  • an apparatus for detecting a web address hijacking includes:
  • a memory for storing processor executable instructions
  • processor is configured to:
  • the above processor can also be configured to:
  • Determining, according to the URL access instruction history record, the security jump URL of the current access URL including:
  • the above processor can also be configured to:
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • the above processor can also be configured to:
  • Determining, according to the obtained at least one of the historical website access instructions, the security jump URL of the current access URL including:
  • the above processor can also be configured to:
  • Determining, according to the probability P of the jump URL and/or the access time, the secure jump URL of the current access URL including:
  • the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL
  • each jump URL in the at least one of the historical website access instructions is determined as the secure jump URL.
  • the above processor can also be configured to:
  • the secure jump URL of the current access URL including:
  • the time interval between the last access time and the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • the above processor can also be configured to:
  • the secure jump URL of the current access URL including:
  • the weight N of the ratio of the time interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the above processor can also be configured to:
  • Determining, according to the secure jump URL, whether the target jump URL is hijacked including:
  • the above processor can also be configured to:
  • the method further includes:
  • the above processor can also be configured to:
  • the method further includes:
  • All the URL access instructions of the record are sorted in ascending order according to the access time order;
  • FIG. 15 is a block diagram of an apparatus 1500 for web address hijacking detection, which is suitable for a terminal device, according to an exemplary embodiment.
  • device 1500 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a gaming console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.
  • device 1500 can include one or more of the following components: processing component 1502, memory 1504, power component 1506, multimedia component 1508, audio component 1510, input/output (I/O) interface 1512, sensor component 1514, And a communication component 1516.
  • Processing component 1502 typically controls the overall operation of device 1500, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations.
  • Processing component 1502 can include one or more processors 1520 to execute instructions to perform all or part of the steps of the above described methods.
  • processing component 1502 can include one or more modules to facilitate interaction between component 1502 and other components.
  • processing component 1502 can include a multimedia module to facilitate interaction between multimedia component 1508 and processing component 1502.
  • Memory 1504 is configured to store various types of data to support operation at device 1500. Examples of such data include instructions for any application or method operating on device 1500, contact data, phone book data, messages, pictures, videos, and the like.
  • the memory 1504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Disk or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM erasable Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Disk Disk or Optical Disk.
  • Power component 1506 provides power to various components of device 1500.
  • Power component 1506 can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for device 1500.
  • the multimedia component 1508 includes a screen between the device 1500 and the user that provides an output interface.
  • the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor can sense not only the boundaries of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.
  • the multimedia component 1508 includes a front camera and/or a rear camera. When the device 1500 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera can receive external multimedia data. Each front and rear camera can be a fixed optical lens system or have focal length and optical zoom capabilities.
  • the audio component 1510 is configured to output and/or input an audio signal.
  • the audio component 1510 includes a microphone (MIC) that is configured to receive an external audio signal when the device 1500 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode.
  • the received audio signal may be further stored in memory 1504 or transmitted via communication component 1516.
  • audio component 1510 also includes a speaker for outputting an audio signal.
  • the I/O interface 1512 provides an interface between the processing component 1502 and the peripheral interface module, which may be a keyboard, a click wheel, a button, or the like. These buttons may include, but are not limited to, a home button, a volume button, a start button, and a lock button.
  • Sensor assembly 1514 includes one or more sensors for providing device 1500 with a status assessment of various aspects.
  • sensor assembly 1514 can detect an open/closed state of device 1500, the relative positioning of components, such as a display and a keypad of device 1500, and sensor component 1514 can also detect a change in position of a component of device 1500 or device 1500, the user The presence or absence of contact with device 1500, device 1500 orientation or acceleration/deceleration and temperature change of device 1500.
  • Sensor assembly 1514 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • Sensor component 1514 can also include a light sensor, such as CMOS Or CCD image sensor for use in imaging applications.
  • the sensor component 1514 can also include an acceleration sensor, a gyro sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
  • Communication component 1516 is configured to facilitate wired or wireless communication between device 1500 and other devices.
  • the device 1500 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof.
  • the communication component 1516 receives broadcast signals or broadcast associated information from an external broadcast management system via a broadcast channel.
  • communication component 1516 also includes a near field communication (NFC) module to facilitate short range communication.
  • NFC near field communication
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, wireless communication device (BT) technology, and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • BT wireless communication device
  • device 1500 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A gate array (FPGA), controller, microcontroller, microprocessor, or other electronic component implementation for performing the above methods.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A gate array
  • controller microcontroller, microprocessor, or other electronic component implementation for performing the above methods.
  • non-transitory computer readable storage medium comprising instructions, such as a memory 1504 comprising instructions executable by processor 1520 of apparatus 1500 to perform the above method.
  • the non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.
  • a non-transitory computer readable storage medium when the instructions in the storage medium are executed by a processor of the apparatus 1500, to enable the apparatus 1500 to perform the method of web address hijacking detection, the method comprising:
  • Determining, according to the URL access instruction history record, the security jump URL of the current access URL including:
  • the historical URL access instruction includes an access URL, a jump, a jump URL, and an access time.
  • Determining, according to the obtained at least one of the historical website access instructions, the security jump URL of the current access URL including:
  • Determining the current access URL according to the probability P of the jump URL and/or the access time Secure jump URL.
  • Determining, according to the probability P of the jump URL and/or the access time, the secure jump URL of the current access URL including:
  • the jump URL whose occurrence probability is greater than the preset probability threshold is determined as the secure jump URL
  • each jump URL in the at least one of the historical website access instructions is determined as the secure jump URL.
  • the secure jump URL of the current access URL including:
  • the time interval between the last access time and the current access time is less than the preset time interval, and the jump URL whose number of consecutive occurrences is greater than or equal to the preset number of times is determined as the secure jump URL.
  • the secure jump URL of the current access URL including:
  • the weight N of the ratio of the time interval T max and the safe jump threshold Q are determined as the secure jump URL when the following conditions are met:
  • the determining, according to the secure jump URL, whether the target jump URL is hijacked comprises:
  • the method further includes:
  • the method further includes:
  • All the URL access instructions of the record are sorted in ascending order according to the access time order;
  • a preset number of URL access instructions whose access time is before the current access time are determined, and the instruction history is accessed for the URL. Or, from all the URL access instructions in the arrangement, determining a web access instruction that is less than or equal to a preset duration between the current access time, and accessing the instruction history for the web address.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Computational Linguistics (AREA)
  • Information Transfer Between Computers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)
  • Computer And Data Communications (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本公开是关于网址劫持检测的方法及装置，其中，方法包括：获取当前网址访问指令中的当前的访问网址和目标跳转网址；根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；根据所述安全跳转网址确定所述目标跳转网址是否被劫持。通过该技术方案，根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。

Description

网址劫持检测的方法及装置
相关申请的交叉引用
本申请基于申请号为201510347804.3、申请日为2015年6月19日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及网络安全技术领域，尤其涉及网址劫持检测的方法及装置。
背景技术
部分网络运营商会在用户访问网络时，在中间路由上监听用户的请求，当匹配到某些特定条件时，抢在目标服务器之前返回一个跳转响应，使用户跳转到跟网络运营商有利益关系的网址。跳转的目的网页，有可能是钓鱼网站，或者包含木马、弹框广告等，影响用户的体验；如果用户请求的是浏览器的合作网站，则还有会损害浏览器的正当利益。
发明内容
本公开实施例提供一种网址劫持检测的方法及装置，包括以下技术方案：
根据本公开实施例的第一方面，提供一种网址劫持检测的方法，包括：
获取当前网址访问指令中的当前的访问网址和目标跳转网址；
根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；
根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
在一个实施例中，所述根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址，包括：
从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
在一个实施例中，所述历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
在一个实施例中，根据获取到的至少一个所述历史网址访问指令，来确定所述当前 的访问网址的安全跳转网址，包括：
对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；
根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。
在一个实施例中，根据所述跳转网址出现的概率P和/或所述访问时间T，来确定所述当前的访问网址的安全跳转网址，包括：
判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。
在一个实施例中，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
在一个实施例中，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
Figure PCTCN2015095336-appb-000001
在一个实施例中，所述根据所述安全跳转网址确定所述目标跳转网址是否被劫持，包括：
在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
在一个实施例中，所述方法还包括：
在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
在一个实施例中，所述方法还包括：
按照所述当前访问时间记录所述网址访问指令；
将记录的所有网址访问指令按照访问时间顺序进行升序排列；
从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
根据本公开实施例的第二方面，提供一种网址劫持检测的装置，包括：
获取模块，用于获取当前网址访问指令中的当前的访问网址和目标跳转网址；
第一确定模块，用于根据网址访问指令历史记录中，确定所述当前的访问网址的安全跳转网址；
第二确定模块，用于根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
在一个实施例中，所述第一确定模块包括：
获取子模块，用于从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
网址确定子模块，用于根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
在一个实施例中，所述历史网址访问指令中包括所述访问网址、是否包含跳转、跳转网址和访问时间。
在一个实施例中，所述网址确定子模块用于：
对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。
在一个实施例中，所述网址确定子模块还用于：
判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址 均确定为所述安全跳转网址。
在一个实施例中，所述网址确定子模块还用于：
将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
在一个实施例中，所述网址确定子模块还用于：
当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
Figure PCTCN2015095336-appb-000002
在一个实施例中，所述第二确定模块包括：
第一网址确定子模块，用于在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
第二网址确定子模块，用于在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
在一个实施例中，所述装置还包括：
执行模块，用于在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
在一个实施例中，所述装置还包括：
记录模块，用于按照所述当前访问时间记录所述网址访问指令；
排序模块，用于将记录的所有网址访问指令按照访问时间顺序进行升序排列；
选取模块，用于从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
根据本公开实施例的第三方面，提供一种网址劫持检测的装置，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，所述处理器被配置为：
获取网址访问指令中的当前的访问网址和目标跳转网址；
从预先记录的网址访问指令历史记录中，查找出访问网址为所述当前的访问网址的历史网址访问指令；
根据所述历史网址访问指令确定所述当前的访问网址的安全跳转网址；
根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
本公开的实施例提供的方法及装置可以包括以下有益效果：
(1)在一个实施例中，获取当前网址访问指令中的当前的访问网址和目标跳转网址；根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；根据所述安全跳转网址确定所述目标跳转网址是否被劫持。本公开根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址来判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
(2)在另一个实施例中，所述根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址，包括：从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。本公开根据与当前的访问网站所对应的历史网址访问指令来确定安全跳转网址，进而根据安全跳转网址来判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
(3)在另一个实施例中，所述历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。本公开的历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间，进而根据访问网址、是否包含跳转、跳转网址和访问时间等来确定安全跳转网址，保证网址跳转的安全性。
(4)在另一个实施例中，根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址，包括：对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。本公开能够根据跳转网址出现的概率、访问时间或者概率和访问时间来快速地确定安全跳转网址，并且可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
(5)在一个实施例中，根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。本公开在历史网址访问指令中包含出现概率大于预设概率阈值的跳转网址时，将这些出现概率大于预设概率阈值的跳转网址作为安全跳转网址，从而保证安全跳转网址的准确性。而在历史网址访问指令中不包含出现概率大于预设概率阈值的跳转网址时，则此时说明历史网址访问指令中的概率分布较分散，此时可暂时认为历史网址访问指令中的所有跳转网址都是安全的。
(6)在另一个实施例中，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。本公开中，如果一个跳转网址连续出现的次数大于或者等于预设次数，并且其最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，则也可认为该跳转网址是安全的。
(7)在另一个实施例中，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
Figure PCTCN2015095336-appb-000003
本公开还可以根据跳转网址出现的概率和访问时间这两个条件来共同确定安全跳转网址，可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
(8)在另一个实施例中，所述根据所述安全跳转网址确定所述目标跳转网址是否被劫持，包括：在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。本公开根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑 名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
(9)在一个实施例中，所述方法还包括：在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。本公开阻止跳转到目标跳转网址的操作可以包括以下一项或多项：输出警告提示信息以提示用户，切换到https，使用代理服务器。当然，还可以包括其它可以阻止跳转到目标跳转网址的操作。这样，可以保证网络的安全性。
(10)在一个实施例中，所述方法还包括：按照所述当前访问时间记录所述网址访问指令；将记录的所有网址访问指令按照访问时间顺序进行升序排列；从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。本公开在记录的所有网址访问指令中选取出符合访问时间要求的，或者预设数量的网址访问指令作为网址访问指令历史记录，继而从访问网址访问指令历史记录中查找出访问网址为当前的访问网址的历史网址访问指令，这样，历史网址访问可以随着当前访问时间的变化而更新，这样，可以自动学习并更正安全跳转网址，从而使得安全跳转网址的结果更准确，即使得被劫持网址的判断结果更准确。同时，也不需要用户再实时维护和更新网络黑名单，减少了用户的操作，提升了用户的使用体验。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。
图1是根据一示例性实施例示出的网址劫持检测的方法的流程图。
图2是根据一示例性实施例示出的一种网址劫持检测的方法的流程图。
图3是根据一示例性实施例示出的一种网址劫持检测的方法中步骤S202的流程图。
图4是根据一示例性实施例示出的一种网址劫持检测的方法中步骤S302的流程图。
图5是根据一示例性实施例示出的另一种网址劫持检测的方法中步骤S302的流程图。
图6是根据一示例性实施例示出的又一种网址劫持检测的方法中步骤S302的流程图。
图7是根据一示例性实施例示出的一种网址劫持检测的方法中步骤S103的流程图。
图8是根据一示例性实施例示出的再一种网址劫持检测的方法的流程图。
图9是根据一示例性实施例示出的又一种网址劫持检测的方法的流程图。
图10是根据一示例性实施例示出的网址劫持检测的装置的框图。
图11是根据一示例性实施例示出的网址劫持检测的装置中第一确定模块的框图。
图12是根据一示例性实施例示出的网址劫持检测的装置中第二确定模块的框图。
图13是根据一示例性实施例示出的一种网址劫持检测的装置的框图。
图14是根据一示例性实施例示出的另一种网址劫持检测的装置的框图。
图15是根据一示例性实施例示出的适用于网址劫持检测的装置的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
本公开实施例提供了一种网址劫持检测的方法，该方法可用于终端设备中，如可以是移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等具有访问网址功能的终端设备，如图1所示，该方法包括步骤S101-S103：
在步骤S101中，获取当前网址访问指令中的当前的访问网址和目标跳转网址。
在步骤S102中，根据网址访问指令历史记录，确定当前的访问网址的安全跳转网址。在一个实施例中，历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
在步骤S103中，根据安全跳转网址确定目标跳转网址是否被劫持。
在该实施例中，根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
如图2所示，在一个实施例中，上述步骤S102包括步骤S201-S202：
在步骤S201中，从网址访问指令历史记录中，获取当前的访问网址所对应的历史网址访问指令。其中，当前的访问网址所对应的历史网址访问指令可以是网址访问指令历史记录中，访问网址为当前的访问网址的历史网址访问指令，也可以是跳转网址为目标跳转 网址的历史网址访问指令。
在步骤S202中，根据获取到的至少一个历史网址访问指令，来确定当前的访问网址的安全跳转网址。
在该实施例中，根据与当前的访问网站所对应的历史网址访问指令来确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
如图3所示，在一个实施例中，上述步骤S202包括步骤S301-S302：
在步骤S301中，对获取到的至少一个历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率P。其中，获取到的至少一个历史网址访问指令对应的概率为1，可以分别计算每个跳转网址在所有的跳转网址中所占的概率，进而据此来确定安全跳转网址。
在步骤S302中，根据跳转网址出现的概率P和/或访问时间，来确定当前的访问网址的安全跳转网址。
在该实施例中，根据跳转网址出现的概率、访问时间或者概率和访问时间来确定安全跳转网址，可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
其中，上述步骤S302可以实施为以下几种方式：
方式一
如图4所示，在一个实施例中，上述步骤S302包括步骤S401-S403：
在步骤S401中，判断至少一个历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址。
在步骤S402中，在判断结果为包含时，将出现概率大于预设概率阈值的跳转网址确定为安全跳转网址。
在步骤S403中，在判断结果为不包含时，将至少一个历史网址访问指令中的每个跳转网址均确定为安全跳转网址。
在该实施例中，在历史网址访问指令中包含出现概率大于预设概率阈值的跳转网址时，将这些出现概率大于预设概率阈值的跳转网址作为安全跳转网址，从而保证安全跳转网址的准确性。而在历史网址访问指令中不包含出现概率大于预设概率阈值的跳转网址时，则此时说明历史网址访问指令中的概率分布较分散，此时可暂时认为历史网址访问指 令中的所有跳转网址都是安全的。这样，可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
例如，获取到的当前的访问网址所对应的历史网址访问指令为10条，其中，预设概率阈值为0.5。若10条历史网址访问指令中包含2种不同的跳转网址，一种为跳转网址1，一种为跳转网址2，跳转网址1的概率为0.6，跳转网址2的概率为0.4，则由于跳转网址1出现的概率0.6大于预设概率阈值0.5，则可以将跳转网址1确定为安全跳转网址。若10条历史网址访问指令中包含4种不同的跳转网址，分别为为跳转网址1、跳转网址2、跳转网址3、跳转网址4，跳转网址1的概率为0.2，跳转网址2的概率为0.3，跳转网址3的概率为0.2，跳转网址4的概率为0.3，则由于4个跳转网址出现的概率均小于预设概率阈值0.5，则可以将4个跳转网址均确定为安全跳转网址。
方式二
如图5所示，在一个实施例中，上述步骤S302还包括步骤S501：
在步骤S501中，将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为安全跳转网址。
在该实施例中，如果一个跳转网址连续出现的次数大于或者等于预设次数，并且其最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，则也可认为该跳转网址是安全的。
例如，某个跳转网址连续出现N1次，且该跳转网址的最后一次访问时间与当前访问时间的时间间隔小于预设时间间隔，其中，N1＞2，预设时间间隔可小于等于1天。比如，该跳转网址的最后一次访问时间与当前的访问时间相隔1天的时间内，跳转网址连续出现3次，则可以认为该跳转网址是安全跳转网址。
实施例三
如图6所示，在一个实施例中，上述步骤S302还包括步骤S601：
在步骤S601中，当一个跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、跳转网址出现的概率P的权重M、访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此跳转网址确定为安全跳转网址：
Figure PCTCN2015095336-appb-000004
其中，例如，安全跳转阈值为0.5，一个跳转网址出现的概率为0.4，其权重M为0.6，T为12小时，Tmax为24小时，其权重N为0.4，则根据上述公式计算：0.5*0.6+(1-12/24) *0.4＝0.5，则可以认为该跳转网址为安全跳转网址。其中，跳转网址出现的概率越大，访问时间间隔越小，则该跳转网址成为安全跳转网址的可能性就越大，反之，跳转网址出现的概率越小，访问时间间隔越大，则该跳转网址成为安全跳转网址的可能性就越下。
在该实施例中，可以根据跳转网址出现的概率和访问时间共同来确定安全跳转网址，这样可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
如图7所示，在一个实施例中，上述步骤S103包括步骤S701-S702：
在步骤S701中，在目标跳转网址与安全跳转网址匹配时，确定目标跳转网址未被劫持；
在步骤S702中，在目标跳转网址与安全跳转网址不匹配时，确定目标跳转网址被劫持。
在该实施例中，根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
如图8所示，在一个实施例中，在步骤S103之后，上述方法还包括步骤S801：
在步骤S801，在确定目标跳转网址被劫持后，执行阻止跳转到目标跳转网址的操作。其中，阻止跳转到目标跳转网址的操作可以包括以下一项或多项：输出警告提示信息以提示用户，切换到https，使用代理服务器。当然，还可以包括其它可以阻止跳转到目标跳转网址的操作。这样，可以保证网络的安全性，避免跳转到钓鱼网站等不安全网址，而给用户带来网络安全隐患。
如图9所示，在一个实施例中，在步骤S101之前，上述方法还包括步骤S901-S903：
在步骤S901中，按照当前访问时间记录网址访问指令。
在步骤S902中，将记录的所有网址访问指令按照访问时间顺序进行升序排列。
在步骤S903中，从排列后的所有网址访问指令中，确定访问时间在当前访问时间之前的预设数量的网址访问指令，为网址访问指令历史记录。或者，从排列后的所有网址访问指令中，确定与当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为网址访问指令历史记录。
其中，访问时间在当前访问时间之前的预设数量的网址访问指令，可以是在当前访问时间之前的连续的预设数量的网址访问指令，也可以是在当前访问时间之前的非连续的预设数量的网址访问指令。
在该实施例中，在记录的所有网址访问指令中选取出符合访问时间要求的，或者预设数量的网址访问指令作为网址访问指令历史记录，继而从访问网址访问指令历史记录中查找出访问网址为当前的访问网址的历史网址访问指令，这样，历史网址访问可以随着当前访问时间的变化而更新，这样，可以自动学习并更正安全跳转网址，从而使得安全跳转网址的结果更准确，即使得被劫持网址的判断结果更准确。同时，也不需要用户再实时维护和更新网络黑名单，减少了用户的操作，提升了用户的使用体验。
下述为本公开装置实施例，可以用于执行本公开方法实施例。
图10是根据一示例性实施例示出的一种网址劫持检测的装置的框图，该装置可以通过软件、硬件或者两者的结合实现成为电子设备的部分或者全部。如图10所示，该网址劫持检测的装置包括：
获取模块1001被配置为获取当前网址访问指令中的当前的访问网址和目标跳转网址。
第一确定模块1002被配置为根据网址访问指令历史记录中，确定当前的访问网址的安全跳转网址。在一个实施例中，历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
第二确定模块1003被配置为根据安全跳转网址确定目标跳转网址是否被劫持。
在该实施例中，根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
如图11所示，在一个实施例中，第一确定模块1002包括：
获取子模块1101被配置为从网址访问指令历史记录中，获取当前的访问网址所对应的历史网址访问指令。
网址确定子模块1102被配置为根据获取到的至少一个历史网址访问指令，来确定当前的访问网址的安全跳转网址。
在该实施例中，根据与当前的访问网站所对应的历史网址访问指令来确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
在一个实施例中，网址确定子模块1102用于：对获取到的至少一个历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率。根据跳转网址出现的概率P和/或 访问时间T，来确定当前的访问网址的安全跳转网址。
在该实施例中，根据跳转网址出现的概率、访问时间或者概率和访问时间来确定安全跳转网址，可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
在一个实施例中，网址确定子模块1102还用于：判断至少一个历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址。在判断结果为包含时，将出现概率大于预设概率阈值的跳转网址确定为安全跳转网址。在判断结果为不包含时，将至少一个历史网址访问指令中的每个跳转网址均确定为安全跳转网址。
在该实施例中，在历史网址访问指令中包含出现概率大于预设概率阈值的跳转网址时，将这些出现概率大于预设概率阈值的跳转网址作为安全跳转网址，从而保证安全跳转网址的准确性。而在历史网址访问指令中不包含出现概率大于预设概率阈值的跳转网址时，则此时说明历史网址访问指令中的概率分布较分散，此时可暂时认为历史网址访问指令中的所有跳转网址都是安全的。这样，可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
例如，获取到的当前的访问网址所对应的历史网址访问指令为10条，其中，预设概率阈值为0.5。若10条历史网址访问指令中包含2种不同的跳转网址，一种为跳转网址1，一种为跳转网址2，跳转网址1的概率为0.6，跳转网址2的概率为0.4，则由于跳转网址1出现的概率0.6大于预设概率阈值0.5，则可以将跳转网址1确定为安全跳转网址。若10条历史网址访问指令中包含4种不同的跳转网址，分别为跳转网址1、跳转网址2、跳转网址3、跳转网址4，跳转网址1的概率为0.2，跳转网址2的概率为0.3，跳转网址3的概率为0.2，跳转网址4的概率为0.3，则由于4个跳转网址出现的概率均小于预设概率阈值0.5，则可以将4个跳转网址均确定为安全跳转网址。
在一个实施例中，网址确定子模块还用于：将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为安全跳转网址。
在该实施例中，如果一个跳转网址连续出现的次数大于或者等于预设次数，并且其最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，则也可认为该跳转网址是安全的。
例如，某个跳转网址连续出现N1次，且该跳转网址的最后一次访问时间与当前访问时间的时间间隔小于预设时间间隔，其中，N1＞2，预设时间间隔可小于等于1天。比如， 该跳转网址的最后一次访问时间与当前的访问时间相隔1天的时间内，跳转网址连续出现3次，则可以认为该跳转网址是安全跳转网址。
在一个实施例中，网址确定子模块还用于：当一个跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、跳转网址出现的概率P的权重M、访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此跳转网址确定为安全跳转网址：
Figure PCTCN2015095336-appb-000005
其中，例如，安全跳转阈值为0.5，一个跳转网址出现的概率为0.4，其权重M为0.6，T为12小时，Tmax为24小时，其权重N为0.4，则根据上述公式计算：0.5*0.6+(1-12/24)*0.4＝0.5，则可以认为该跳转网址为安全跳转网址。其中，跳转网址出现的概率越大，访问时间间隔越小，则该跳转网址成为安全跳转网址的可能性就越大，反之，跳转网址出现的概率越小，访问时间间隔越大，则该跳转网址成为安全跳转网址的可能性就越下。
在该实施例中，可以根据跳转网址出现的概率和访问时间共同来确定安全跳转网址，这样可以使得确定的安全跳转网址的结果更准确，从而进一步保证网址跳转的安全性，提高被劫持网址的识别率，降低成本。
如图12所示，在一个实施例中，上述第二确定模块1003包括：
第一网址确定子模块1201被配置为在目标跳转网址与安全跳转网址匹配时，确定目标跳转网址未被劫持。
第二网址确定子模块1202被配置为目标跳转网址与安全跳转网址不匹配时，确定目标跳转网址被劫持。
在该实施例中，根据历史网址访问指令确定安全跳转网址，进而根据安全跳转网址判断目标跳转网址是否被劫持，这样，当遇到异常跳转时，可以立即发现，不需要事先维护和下发黑名单网址也可以发现劫持，提高被劫持网址的识别率，降低成本。
如图13所示，在一个实施例中，上述装置还包括：
执行模块1301被配置为在确定目标跳转网址被劫持后，执行阻止跳转到目标跳转网址的操作。
其中，阻止跳转到目标跳转网址的操作可以包括以下一项或多项：输出警告提示信息以提示用户，切换到https，使用代理服务器。当然，还可以包括其它可以阻止跳转到目标跳转网址的操作。这样，可以保证网络的安全性，避免跳转到钓鱼网站等不安全网址， 而给用户带来网络安全隐患。
如图14所示，在一个实施例中，上述装置还包括：
记录模块1401被配置为按照当前访问时间记录网址访问指令。
排序模块1402被配置为将记录的所有网址访问指令按照访问时间顺序进行升序排列。
选取模块1403被配置为从排列后的所有网址访问指令中，确定访问时间在当前访问时间之前的预设数量的网址访问指令，为网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为网址访问指令历史记录。
其中，访问时间在当前访问时间之前的预设数量的网址访问指令，可以是在当前访问时间之前的连续的预设数量的网址访问指令，也可以是在当前访问时间之前的非连续的预设数量的网址访问指令。
在该实施例中，在记录的所有网址访问指令中选取出符合访问时间要求的，或者预设数量的网址访问指令作为网址访问指令历史记录，继而从访问网址访问指令历史记录中查找出访问网址为当前的访问网址的历史网址访问指令，这样，历史网址访问可以随着当前访问时间的变化而更新，这样，可以自动学习并更正安全跳转网址，从而使得安全跳转网址的结果更准确，即使得被劫持网址的判断结果更准确。同时，也不需要用户再实时维护和更新网络黑名单，减少了用户的操作，提升了用户的使用体验。
根据本公开实施例的第三方面，提供一种网址劫持检测的装置，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，处理器被配置为：
获取当前网址访问指令中的当前的访问网址和目标跳转网址；
根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；
根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
上述处理器还可被配置为：
所述根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址，包括：
从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
上述处理器还可被配置为：
所述历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
上述处理器还可被配置为：
根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址，包括：
对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；
根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。
上述处理器还可被配置为：
根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。
上述处理器还可被配置为：
根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
上述处理器还可被配置为：
根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
Figure PCTCN2015095336-appb-000006
上述处理器还可被配置为：
所述根据所述安全跳转网址确定所述目标跳转网址是否被劫持，包括：
在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
上述处理器还可被配置为：
所述方法还包括：
在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
上述处理器还可被配置为：
所述方法还包括：
按照所述当前访问时间记录所述网址访问指令；
将记录的所有网址访问指令按照访问时间顺序进行升序排列；
从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图15是根据一示例性实施例示出的一种用于网址劫持检测的装置1500的框图，该装置适用于终端设备。例如，装置1500可以是移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
参照图15，装置1500可以包括以下一个或多个组件：处理组件1502，存储器1504，电源组件1506，多媒体组件1508，音频组件1510，输入/输出(I/O)的接口1512，传感器组件1514，以及通信组件1516。
处理组件1502通常控制装置1500的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理元件1502可以包括一个或多个处理器1520来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件1502可以包括一个或多个模块，便于处理组件1502和其他组件之间的交互。例如，处理部件1502可以包括多媒体模块，以方便多媒体组件1508和处理组件1502之间的交互。
存储器1504被配置为存储各种类型的数据以支持在设备1500的操作。这些数据的示例包括用于在装置1500上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器1504可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电力组件1506为装置1500的各种组件提供电力。电力组件1506可以包括电源管理系统，一个或多个电源，及其他与为装置1500生成、管理和分配电力相关联的组件。
多媒体组件1508包括在装置1500和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件1508包括一个前置摄像头和/或后置摄像头。当设备1500处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件1510被配置为输出和/或输入音频信号。例如，音频组件1510包括一个麦克风(MIC)，当装置1500处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器1504或经由通信组件1516发送。在一些实施例中，音频组件1510还包括一个扬声器，用于输出音频信号。
I/O接口1512为处理组件1502和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件1514包括一个或多个传感器，用于为装置1500提供各个方面的状态评估。例如，传感器组件1514可以检测到设备1500的打开/关闭状态，组件的相对定位，例如组件为装置1500的显示器和小键盘，传感器组件1514还可以检测装置1500或装置1500一个组件的位置改变，用户与装置1500接触的存在或不存在，装置1500方位或加速/减速和装置1500的温度变化。传感器组件1514可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件1514还可以包括光传感器，如CMOS 或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件1514还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件1516被配置为便于装置1500和其他设备之间有线或无线方式的通信。装置1500可以接入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合。在一个示例性实施例中，通信部件1516经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信部件1516还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，无线通讯设备(BT)技术和其他技术来实现。
在示例性实施例中，装置1500可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器1504，上述指令可由装置1500的处理器1520执行以完成上述方法。例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
一种非临时性计算机可读存储介质，当存储介质中的指令由装置1500的处理器执行时，使得装置1500能够执行上述网址劫持检测的方法，方法包括：
获取当前网址访问指令中的当前的访问网址和目标跳转网址；
根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；
根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
所述根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址，包括：
从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
所述历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址，包括：
对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；
根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的 安全跳转网址。
根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。
根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
Figure PCTCN2015095336-appb-000007
在一个实施例中，所述根据所述安全跳转网址确定所述目标跳转网址是否被劫持，包括：
在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
所述方法还包括：
在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
所述方法还包括：
按照所述当前访问时间记录所述网址访问指令；
将记录的所有网址访问指令按照访问时间顺序进行升序排列；
从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录。或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
本领域技术人员在考虑说明书及实践这里公开的公开后，将容易想到本公开的其它实施方案。本申请旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (21)

  1. 一种网址劫持检测的方法，其特征在于，包括：
    获取当前网址访问指令中的当前的访问网址和目标跳转网址；
    根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；
    根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
  2. 如权利要求1所述的方法，其特征在于，所述根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址，包括：
    从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
    根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
  3. 如权利要求2所述的方法，其特征在于，所述历史网址访问指令中包括访问网址、是否包含跳转、跳转网址和访问时间。
  4. 如权利要求3所述的方法，其特征在于，根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址，包括：
    对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；
    根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。
  5. 如权利要求4所述的方法，其特征在于，根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
    判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
    在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
    在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。
  6. 如权利要求4所述的方法，其特征在于，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
    将最后一次的访问时间与当前的访问时间的访问时间间隔T小于预设时间间隔，且 连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
  7. 如权利要求4所述的方法，其特征在于，根据所述跳转网址出现的概率和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址，包括：
    当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
    Figure PCTCN2015095336-appb-100001
  8. 如权利要求1所述的方法，其特征在于，所述根据所述安全跳转网址确定所述目标跳转网址是否被劫持，包括：
    在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
    在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
  9. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
  10. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    按照所述当前访问时间记录所述网址访问指令；
    将记录的所有网址访问指令按照访问时间顺序进行升序排列；
    从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
  11. 一种网址劫持检测的装置，其特征在于，包括：
    获取模块，用于获取当前网址访问指令中的当前的访问网址和目标跳转网址；
    第一确定模块，用于根据网址访问指令历史记录中，确定所述当前的访问网址的安全跳转网址；
    第二确定模块，用于根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
  12. 如权利要求11所述的装置，其特征在于，所述第一确定模块包括：
    获取子模块，用于从网址访问指令历史记录中，获取所述当前的访问网址所对应的历史网址访问指令；
    网址确定子模块，用于根据获取到的至少一个所述历史网址访问指令，来确定所述当前的访问网址的安全跳转网址。
  13. 如权利要求12所述的装置，其特征在于，所述历史网址访问指令中包括所述访问网址、是否包含跳转、跳转网址和访问时间。
  14. 如权利要求13所述的装置，其特征在于，所述网址确定子模块用于：
    对获取到的至少一个所述历史网址访问指令进行统计分析，分别计算不同跳转网址出现的概率；根据所述跳转网址出现的概率P和/或所述访问时间，来确定所述当前的访问网址的安全跳转网址。
  15. 如权利要求14所述的装置，其特征在于，所述网址确定子模块还用于：
    判断所述至少一个所述历史网址访问指令中是否包含出现概率大于预设概率阈值的跳转网址；
    在判断结果为包含时，将所述出现概率大于预设概率阈值的跳转网址确定为所述安全跳转网址；
    在判断结果为不包含时，将所述至少一个所述历史网址访问指令中的每个跳转网址均确定为所述安全跳转网址。
  16. 如权利要求14所述的装置，其特征在于，所述网址确定子模块还用于：
    将最后一次的访问时间与当前的访问时间的时间间隔小于预设时间间隔，且连续出现的次数大于或者等于预设次数的跳转网址确定为所述安全跳转网址。
  17. 如权利要求14所述的装置，其特征在于，所述网址确定子模块还用于：
    当一个所述跳转网址出现的概率P、最后一次的访问时间与当前的访问时间的访问时间间隔T、所述跳转网址出现的概率P的权重M、所述访问时间间隔T与最大访问时间间隔Tmax的比值的权重N、安全跳转阈值Q，满足下述条件时，将此所述跳转网址确定为所述安全跳转网址：
    Figure PCTCN2015095336-appb-100002
  18. 如权利要求11所述的装置，其特征在于，所述第二确定模块包括：
    第一网址确定子模块，用于在所述目标跳转网址与所述安全跳转网址匹配时，确定所述目标跳转网址未被劫持；
    第二网址确定子模块，用于在所述目标跳转网址与所述安全跳转网址不匹配时，确定所述目标跳转网址被劫持。
  19. 如权利要求11所述的装置，其特征在于，所述装置还包括：
    执行模块，用于在确定所述目标跳转网址被劫持后，执行阻止跳转到所述目标跳转网址的操作。
  20. 如权利要求11所述的装置，其特征在于，所述装置还包括：
    记录模块，用于按照所述当前访问时间记录所述网址访问指令；
    排序模块，用于将记录的所有网址访问指令按照访问时间顺序进行升序排列；
    选取模块，用于从排列后的所有网址访问指令中，确定访问时间在所述当前访问时间之前的预设数量的网址访问指令，为所述网址访问指令历史记录；或者，从排列后的所有网址访问指令中，确定与所述当前访问时间之间的时间间隔小于或等于预设时长的网址访问指令，为所述网址访问指令历史记录。
  21. 一种网址劫持检测的装置，其特征在于，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被配置为：
    获取当前网址访问指令中的当前的访问网址和目标跳转网址；
    根据网址访问指令历史记录，确定所述当前的访问网址的安全跳转网址；
    根据所述安全跳转网址确定所述目标跳转网址是否被劫持。
PCT/CN2015/095336 2015-06-19 2015-11-23 网址劫持检测的方法及装置 Ceased WO2016201889A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
MX2017003545A MX364352B (es) 2015-06-19 2015-11-23 Metodo y dispositivo para detectar la suplantacion de direcciones web.
JP2016525092A JP6271725B2 (ja) 2015-06-19 2015-11-23 ウェブサイト乗っ取り検出方法及び装置
RU2016140114A RU2658191C2 (ru) 2015-06-19 2015-11-23 Способ и устройство для обнаружения несанкционированного использования веб-адресов
KR1020177009157A KR101994561B1 (ko) 2015-06-19 2015-11-23 웹사이트 하이재크 검출 방법 및 장치

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510347804.3 2015-06-19
CN201510347804.3A CN105100061B (zh) 2015-06-19 2015-06-19 网址劫持检测的方法及装置

Publications (1)

Publication Number Publication Date
WO2016201889A1 true WO2016201889A1 (zh) 2016-12-22

Family

ID=54579608

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095336 Ceased WO2016201889A1 (zh) 2015-06-19 2015-11-23 网址劫持检测的方法及装置

Country Status (8)

Country Link
US (1) US10313392B2 (zh)
EP (1) EP3107262B1 (zh)
JP (1) JP6271725B2 (zh)
KR (1) KR101994561B1 (zh)
CN (1) CN105100061B (zh)
MX (1) MX364352B (zh)
RU (1) RU2658191C2 (zh)
WO (1) WO2016201889A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105100061B (zh) * 2015-06-19 2018-09-04 小米科技有限责任公司 网址劫持检测的方法及装置
CN107566320B (zh) * 2016-06-30 2020-05-26 中国电信股份有限公司 一种网络劫持检测方法、装置与网络系统
CN107968769A (zh) * 2016-10-19 2018-04-27 中兴通讯股份有限公司 网页安全检测方法及装置
CN110020239B (zh) * 2017-09-20 2023-05-12 腾讯科技（深圳）有限公司 恶意资源转移网页识别方法及装置
CN108173814B (zh) * 2017-12-08 2021-02-05 深信服科技股份有限公司 钓鱼网站检测方法、终端设备及存储介质
CN116137578A (zh) * 2023-03-21 2023-05-19 上海中通吉网络技术有限公司 一种http服务接口实现方法
CN117439826B (zh) * 2023-12-21 2024-03-01 江苏禾冠信息技术有限公司 基于多模态验证的网络安全识别方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102594934A (zh) * 2011-12-30 2012-07-18 奇智软件（北京）有限公司 一种识别被劫持网址的方法及装置
CN102917049A (zh) * 2012-10-17 2013-02-06 北京奇虎科技有限公司 呈现访问网站的信息的方法、浏览器和系统
CN103780450A (zh) * 2012-10-24 2014-05-07 腾讯科技（深圳）有限公司 浏览器访问网址的检测方法和系统
CN103856437A (zh) * 2012-11-28 2014-06-11 深圳市金蝶中间件有限公司 网站安全性的检测方法和系统

Family Cites Families (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020161866A1 (en) * 2001-03-20 2002-10-31 Garnet Tozer Method and apparatus for internet-based remote terminal units and flow computers
US20040139170A1 (en) * 2003-01-15 2004-07-15 Ming-Teh Shen Method and apparatus for management of shared wide area network connections
US8990928B1 (en) * 2003-12-11 2015-03-24 Radix Holdings, Llc URL salience
US7657622B1 (en) * 2003-12-23 2010-02-02 At&T Intellectual Property Ii, L.P. Unified web hosting and content distribution system and method for assuring predetermined performance levels
US9112897B2 (en) * 2006-03-30 2015-08-18 Advanced Network Technology Laboratories Pte Ltd. System and method for securing a network session
US20080295153A1 (en) * 2007-05-24 2008-11-27 Zhidan Cheng System and method for detection and communication of computer infection status in a networked environment
US8255386B1 (en) * 2008-01-30 2012-08-28 Google Inc. Selection of documents to place in search index
US8286239B1 (en) * 2008-07-24 2012-10-09 Zscaler, Inc. Identifying and managing web risks
US8103599B2 (en) * 2008-09-25 2012-01-24 Microsoft Corporation Calculating web page importance based on web behavior model
US8448245B2 (en) * 2009-01-17 2013-05-21 Stopthehacker.com, Jaal LLC Automated identification of phishing, phony and malicious web sites
US8205258B1 (en) * 2009-11-30 2012-06-19 Trend Micro Incorporated Methods and apparatus for detecting web threat infection chains
US8505094B1 (en) * 2010-01-13 2013-08-06 Trend Micro, Inc. Detection of malicious URLs in a web page
WO2011094312A1 (en) * 2010-01-26 2011-08-04 Silver Tail Systems, Inc. System and method for network security including detection of man-in-the-browser attacks
US8869271B2 (en) * 2010-02-02 2014-10-21 Mcafee, Inc. System and method for risk rating and detecting redirection activities
RU2446459C1 (ru) * 2010-07-23 2012-03-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ проверки веб-ресурсов на наличие вредоносных компонент
US20120102568A1 (en) * 2010-10-26 2012-04-26 Mcafee, Inc. System and method for malware alerting based on analysis of historical network and process activity
US8521667B2 (en) * 2010-12-15 2013-08-27 Microsoft Corporation Detection and categorization of malicious URLs
CN103023712B (zh) * 2011-09-28 2015-04-08 腾讯科技（深圳）有限公司 网页恶意属性监测方法和系统
CN103078830B (zh) * 2011-10-25 2016-07-27 阿里巴巴集团控股有限公司 网址信息提供及分享方法、好友添加方法、以及相应设备
RU2495486C1 (ru) * 2012-08-10 2013-10-10 Закрытое акционерное общество "Лаборатория Касперского" Способ анализа и выявления вредоносных промежуточных узлов в сети
US8997228B1 (en) * 2012-09-06 2015-03-31 Symantec Corporation Techniques for detecting infected websites
US9553783B2 (en) * 2012-09-14 2017-01-24 Salesforce.Com, Inc. Spam flood detection methodologies
US8943588B1 (en) * 2012-09-20 2015-01-27 Amazon Technologies, Inc. Detecting unauthorized websites
US9241006B2 (en) * 2012-10-24 2016-01-19 Tencent Technology (Shenzhen) Company Limited Method and system for detecting website visit attempts by browsers
US20140380472A1 (en) * 2013-06-24 2014-12-25 Lenovo (Singapore) Pte. Ltd. Malicious embedded hyperlink detection
JP6055726B2 (ja) * 2013-06-28 2016-12-27 Kddi株式会社 ウェブページ監視装置、ウェブページ監視システム、ウェブページ監視方法およびコンピュータプログラム
RU2592390C2 (ru) * 2013-07-15 2016-07-20 Общество С Ограниченной Ответственностью "Яндекс" Система, способ и устройство для оценки сеансов просмотра
CN104348803B (zh) * 2013-07-31 2018-12-11 深圳市腾讯计算机系统有限公司 链路劫持检测方法、装置、用户设备、分析服务器及系统
WO2015014189A1 (zh) * 2013-08-02 2015-02-05 优视科技有限公司 一种访问网站的方法及装置
US9654504B1 (en) * 2013-12-10 2017-05-16 Symantec Corporation Detecting a hijacked network address
WO2015153849A1 (en) * 2014-04-03 2015-10-08 Automattic, Inc. Systems and methods for protecting websites from botnet attacks
CN104301302B (zh) * 2014-09-12 2017-09-19 深信服网络科技（深圳）有限公司 越权攻击检测方法及装置
CN105100061B (zh) * 2015-06-19 2018-09-04 小米科技有限责任公司 网址劫持检测的方法及装置
US20170053037A1 (en) * 2015-08-18 2017-02-23 Lenovo (Singapore) Pte. Ltd. Validation of internet address input to a device
CN105447204B (zh) * 2016-01-04 2017-12-12 北京百度网讯科技有限公司 网址识别方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102594934A (zh) * 2011-12-30 2012-07-18 奇智软件（北京）有限公司 一种识别被劫持网址的方法及装置
CN102917049A (zh) * 2012-10-17 2013-02-06 北京奇虎科技有限公司 呈现访问网站的信息的方法、浏览器和系统
CN103780450A (zh) * 2012-10-24 2014-05-07 腾讯科技（深圳）有限公司 浏览器访问网址的检测方法和系统
CN103856437A (zh) * 2012-11-28 2014-06-11 深圳市金蝶中间件有限公司 网站安全性的检测方法和系统

Also Published As

Publication number Publication date
MX2017003545A (es) 2017-07-14
JP2017527861A (ja) 2017-09-21
CN105100061B (zh) 2018-09-04
US20160373482A1 (en) 2016-12-22
RU2016140114A (ru) 2018-04-13
US10313392B2 (en) 2019-06-04
KR20170051489A (ko) 2017-05-11
RU2658191C2 (ru) 2018-06-19
CN105100061A (zh) 2015-11-25
EP3107262A1 (en) 2016-12-21
MX364352B (es) 2019-04-23
EP3107262B1 (en) 2018-01-17
KR101994561B1 (ko) 2019-06-28
JP6271725B2 (ja) 2018-01-31

Similar Documents

Publication Publication Date Title
WO2016201889A1 (zh) 网址劫持检测的方法及装置
JP6101866B2 (ja) こどもモード処理方法、装置、プログラム、及び記録媒体
US9693296B2 (en) Network connection method and apparatus
US20180121040A1 (en) Method and device for managing notification messages
US20160239834A1 (en) Method and apparatus for requesting account transfer
WO2016008243A1 (zh) 网络连接方法及装置
US11397596B2 (en) Method and device for controlling pop-up window, electronic device, and storage medium
CN110262692B (zh) 一种触摸屏扫描方法、装置及介质
CN107562349B (zh) 一种执行处理的方法和装置
WO2017201889A1 (zh) 短消息识别方法及装置
CN106775248A (zh) 推送内容的展示方法及装置
CN106792892B (zh) 应用程序的访问控制方法和装置
WO2016110146A1 (zh) 移动终端及虚拟按键的处理方法
CN107402767B (zh) 显示推送消息的方法和装置
CN108984098B (zh) 基于社交软件的信息显示的控制方法及装置
CN112711723A (zh) 一种恶意网址检测方法、装置及电子设备
US20160349947A1 (en) Method and device for sending message
CN107171938B (zh) 屏蔽社交好友的方法和装置
CN110928425A (zh) 信息监控方法及装置
WO2016127625A1 (zh) 地址过滤方法及装置
CN105095296B (zh) 文件管理方法及装置
CN106331760A (zh) 视频播放控制方法及装置
CN105955817A (zh) 服务进程控制方法及装置
CN106960026B (zh) 搜索方法、搜索引擎和电子设备
CN107528860A (zh) 网络安全测试方法、系统及存储介质

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2016525092

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2016140114

Country of ref document: RU

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112016026133

Country of ref document: BR

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15895456

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: MX/A/2017/003545

Country of ref document: MX

ENP Entry into the national phase

Ref document number: 20177009157

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112016026133

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20161108

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15895456

Country of ref document: EP

Kind code of ref document: A1