WO2017008543A1 - 网络攻击判断方法、安全的网络数据传输方法及相应装置 - Google Patents

网络攻击判断方法、安全的网络数据传输方法及相应装置 Download PDF

Info

Publication number
WO2017008543A1
WO2017008543A1 PCT/CN2016/078843 CN2016078843W WO2017008543A1 WO 2017008543 A1 WO2017008543 A1 WO 2017008543A1 CN 2016078843 W CN2016078843 W CN 2016078843W WO 2017008543 A1 WO2017008543 A1 WO 2017008543A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack
rule
network
browsing request
webpage browsing
Prior art date
Application number
PCT/CN2016/078843
Other languages
English (en)
French (fr)
Inventor
林宇飞
Original Assignee
广州市动景计算机科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201510416040.9A external-priority patent/CN106341376A/zh
Priority claimed from CN201510416039.6A external-priority patent/CN106385395B/zh
Application filed by 广州市动景计算机科技有限公司 filed Critical 广州市动景计算机科技有限公司
Priority to RU2017114862A priority Critical patent/RU2685994C1/ru
Priority to US15/505,835 priority patent/US10574673B2/en
Publication of WO2017008543A1 publication Critical patent/WO2017008543A1/zh
Priority to US16/773,910 priority patent/US11277418B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

  • the present disclosure relates to the field of web browsing technologies, and in particular, to a network attack judging method, a secure network data transmission method, and a corresponding apparatus.
  • a browser is software that displays the content of a web page for the user to browse. If the user needs to browse a certain webpage, the browser generates a corresponding webpage browsing request according to the user operation, and transmits the webpage browsing request to the DNS server, and the DNS server performs domain name resolution, and transmits the domain name parsing result to the browsing.
  • the domain name resolution result includes the IP address corresponding to the domain name that needs to be accessed. After receiving the domain name resolution result, the browser accesses the server according to the IP address, obtains corresponding webpage data, and displays the same. The webpage content corresponding to the webpage data satisfies the browsing needs of the user.
  • the webpage browsing request is sometimes attacked by a network, and the result of the domain name parsing received by the browser is incorrect, but the browser cannot recognize whether the network is attacked or not.
  • the browser cannot obtain the correct IP address, which further prevents the browser from obtaining the required web page data, so that the user cannot browse the required information.
  • the present disclosure provides a protection method, apparatus, and system for network attacks.
  • a network attack judging method is provided, which is applied to a browser client, where the network attack judging method includes: obtaining feedback information returned by the network according to a webpage browsing request; and acquiring the attacking rule. Comparing with the feedback information, determining whether the webpage browsing request is subjected to a network attack according to the comparison result, wherein the attack rule is sent by the rule configuration server.
  • the feedback information is domain name resolution information.
  • the matching the attack rule with the feedback information, and determining whether the webpage browsing request is subjected to a network attack according to the comparison result including: determining, according to the attack rule and the domain name resolution information, Determining the legality of the IP address included in the domain name resolution information; determining whether the webpage browsing request is subjected to a network attack according to the legality of the IP address included in the domain name resolution information, wherein if the IP address is legal, determining The webpage browsing request is not attacked by a network. If the IP address is illegal, it is determined that the webpage browsing request is attacked by a network.
  • the determining, according to the attack rule and the domain name resolution information, the validity of the IP address included in the domain name resolution information including: acquiring the target attack in the attack rule by using the webpage browsing request a rule in which the attack rule includes a domain name, IP An address and a rule type identifier, where the target attack rule includes a domain name that is the same as the domain name to be accessed by the webpage browsing request; traversing the target attack rule, determining whether the IP address included in the domain name resolution information is included in the target In the attack rule, if the IP address included in the domain name resolution information is not included in the target attack rule, it is determined that the IP address included in the domain name resolution information is legal; if the IP address included in the domain name resolution information includes Determining, in the target attack rule, whether the IP address included in the domain name resolution information is legal according to the target attack rule, where the IP address included in the domain name resolution information corresponds to the target attack rule
  • the rule type identifier is a legal identifier, and the IP address is determined to be legal
  • the feedback information is response information returned by the network according to the webpage browsing request.
  • the attacking rule is matched with the feedback information, and the webpage browsing request is determined to be subjected to a network attack according to the comparison result, including: obtaining the target attack in the attack rule by using the webpage browsing request a rule, where the attack rule includes a tampering keyword, an information expression before tampering, and a falsified information expression, where the target attack rule includes the tamper information expression and the webpage browsing request Corresponding to: traversing the target attack rule, determining whether a response header keyword in the response information matches a tampering keyword in the target attack rule; if the response header keyword in the response information is related to the target The tampering keyword in the attack rule is matched to determine whether the response header content in the response information matches the falsified information expression in the target attack rule; if the response header content and the target attack rule The falsified information expressions in the match match, determining the Web browsing requests are subject to cyber attacks.
  • the information expression is: a URL address expression, a channel number expression, or a media type expression.
  • a secure network data transmission method which is applied to a browser client, where the secure network data transmission method includes: obtaining feedback information returned by the network according to a webpage browsing request; And the attacking rule is compared with the feedback information, and determining, according to the comparison result, whether the webpage browsing request is subjected to a network attack, wherein the attacking rule is sent by the rule configuration server; determining that the webpage browsing request is subjected to a network attack , the transmission of network data in a secure manner.
  • the transmitting, by the secure manner, the network data comprises: encrypting the webpage browsing request and sending the request to the proxy server, after the proxy server decrypts the encrypted webpage browsing request, and the decrypted webpage browsing request Performing domain name resolution, accessing a target server corresponding to the domain name resolution result, acquiring network data corresponding to the decrypted webpage browsing request, and encrypting the network data; and receiving the encrypted network data returned by the proxy server .
  • the secure network data transmission method further includes: after determining that the webpage browsing request is subjected to a network attack, discarding the domain name resolution information.
  • a secure network data transmission method which is applied to a rule configuration server, and the secure network data transmission method includes: formulating an attack rule according to the received operation; The rule is transmitted to the browser client, so that the browser client determines whether it is subject to a network attack according to the attack rule.
  • the transmitting the attack rule to the browser client so that the browser client determines whether the network attack is received according to the attack rule, including: acquiring a webpage browsing request transmitted by the browser client, and according to The webpage browsing request acquires an IP address to be accessed by the browser client; and the attacking rule corresponding to the area indicated by the IP address and the operator is inquired from the specified attack rule; The attack rules corresponding to the area and the operator are transmitted to the browser client, so that the browser client determines whether it is attacked by the network according to the attack rule.
  • a network attack judging device which is applied to a browser client, and the network attack judging device includes: a feedback information acquiring module, configured to obtain feedback information returned by the network according to the webpage browsing request. And a determining module, configured to compare the obtained attack rule with the feedback information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, wherein the attack rule is sent by the rule configuration server.
  • the feedback information is domain name resolution information or response information.
  • the determining module includes: an IP address legality determining unit, configured to determine, according to the attack rule and the domain name resolution information, the legality of the IP address included in the domain name resolution information; the network attack determining unit, And determining, according to the legality of the IP address included in the domain name resolution information, whether the webpage browsing request is subjected to a network attack, wherein if the IP address is legal, determining that the webpage browsing request is not subjected to a network attack, if If the IP address is illegal, it is determined that the webpage browsing request is attacked by a network.
  • a secure network data transmission apparatus which is applied to a browser client, and the secure network data transmission apparatus includes: a feedback information acquisition module, configured to acquire a network according to a webpage browsing request Returned feedback information; determination module for Comparing the obtained attack rule with the feedback information, and determining, according to the comparison result, whether the webpage browsing request is subjected to a network attack, wherein the attack rule is sent by a rule configuration server; and a transmission module is configured to determine When the web browsing request is attacked by a network, the network data is transmitted in a secure manner.
  • a secure network data transmission apparatus which is applied to a rule configuration server, the secure network data transmission apparatus comprising: an attack rule formulation module, configured to formulate according to the received operation
  • An attack rule transmission module is configured to transmit the attack rule to a browser client, so that the browser client determines whether the network attack is attacked according to the attack rule.
  • the attack rule transmission module is specifically configured to acquire a webpage browsing request transmitted by the browser client, and obtain an IP address to be accessed by the browser client according to the webpage browsing request; In the rule, querying the attacking rule corresponding to the area indicated by the IP address and the operator; transmitting the attack rule corresponding to the area indicated by the IP address and the operator to the browser client, so that the browser client Determine whether the network is attacked according to the attack rule.
  • a secure network data transmission system including: a rule configuration server, a proxy server, and a user terminal, the user terminal being provided with a browser client, wherein the rule configuration server
  • the method is configured to: according to the received operation, formulate an attack rule, and transmit the attack rule to a browser client of the user terminal; the browser client of the user terminal is configured to obtain the feedback information returned by the network according to the webpage browsing request. And comparing the attack rule with the feedback information, and determining, according to the comparison result, whether the webpage browsing request is subjected to a network attack, and if the webpage browsing request is determined to be subjected to a network attack, Then, the network data is transmitted in a secure manner with the proxy server.
  • the rule configuration server is configured to: according to the received operation, formulate an attack rule, obtain a webpage browsing request transmitted by the browser client of the user terminal, and obtain the browser client according to the webpage browsing request.
  • the IP address of the access is used to query the attack rule corresponding to the area indicated by the IP address and the operator, and the attack rule corresponding to the area indicated by the IP address and the carrier is transmitted to the attack rule.
  • the browser client ;
  • the browser client of the user terminal is specifically configured to obtain the domain name resolution information returned by the network according to the webpage browsing request, and compare and match the attack rule transmitted by the rule configuration server with the domain name resolution information, and determine according to the comparison result. Whether the webpage browsing request is subjected to a network attack, and if it is determined that the webpage browsing request is subjected to a network attack, the network data is transmitted in a secure manner with the proxy server.
  • a computer readable medium having processor-executable non-volatile program code, the program code, when executed by the processor, causing the processor to perform the following method:
  • the present application discloses a network attack judging method, a secure network data transmission method, and a corresponding device.
  • the browser client obtains the attack rule formulated by the rule configuration server, and After obtaining the feedback information returned by the network according to the webpage browsing request, determining whether the webpage browsing request is subjected to a network attack according to the comparison result of the attacking rule and the feedback information, thereby solving the problem that the network attack cannot be identified in the prior art.
  • the browser client transmits the network data in a secure manner, thereby avoiding the impact of the network attack and improving the security of the network data transmission.
  • FIG. 1 is a structural block diagram of an electronic device according to an exemplary embodiment
  • FIG. 2 is a schematic flowchart of a network attack judging method according to an exemplary embodiment
  • FIG. 3 is a schematic diagram of a workflow for determining the legitimacy of an IP address in a network attack judging method according to an exemplary embodiment
  • FIG. 4 is a schematic diagram of a workflow for determining whether a webpage browsing request is subjected to a network attack in a network attack judging method according to an exemplary embodiment
  • FIG. 5 is a schematic flowchart of a secure network data transmission method according to an exemplary embodiment
  • FIG. 6 is a schematic structural diagram of an attack rule in a secure network data transmission method according to an exemplary embodiment
  • FIG. 7 is a diagram of a secure network data transmission method according to an exemplary embodiment. Schematic diagram of the process
  • FIG. 8 is a schematic flowchart of a secure network data transmission method according to an exemplary embodiment
  • FIG. 9 is a schematic structural diagram of a network attack judging apparatus according to an exemplary embodiment.
  • FIG. 10 is a schematic structural diagram of a network attack judging apparatus according to an exemplary embodiment
  • FIG. 11 is a schematic structural diagram of a secure network data transmission apparatus according to an exemplary embodiment
  • FIG. 12 is a schematic structural diagram of a secure network data transmission apparatus according to an exemplary embodiment
  • FIG. 13 is a schematic structural diagram of a secure network data transmission apparatus according to an exemplary embodiment
  • FIG. 14 is a schematic structural diagram of a secure network data transmission apparatus according to an exemplary embodiment
  • FIG. 15 is a schematic structural diagram of a secure network data transmission system according to an exemplary embodiment.
  • the browser cannot recognize the network attack when the network is attacked, and the browser often cannot obtain the correct IP address, so that the required webpage data cannot be obtained, and the user cannot browse.
  • the problem of the required information the present application discloses a network attack judging method, a secure network data transmission method, and a corresponding device.
  • FIG. 1 is a block diagram showing the structure of an electronic device 100 that can be applied to an embodiment of the present application.
  • the electronic device can be a user terminal or a server.
  • the electronic device 100 can include a memory 102, a memory controller 103, a processor 104, and a network module 105.
  • the components of the memory 102, the memory controller 103, the processor 104, and the network module 105 are electrically connected directly or indirectly to enable data transmission or interaction.
  • these components can be electrically connected by one or more communication buses or signal buses.
  • the network attack judging method and the secure network data transmission method include at least one software function module that can be stored in the memory 102 in the form of software or firmware, such as the query word similarity calculation device or the query word search device.
  • the memory 102 can store various software programs and modules, such as the query word similarity calculation method and the program instruction/module corresponding to the device or the query word search method and the program instruction/module corresponding to the device, and the processor 104 passes The software program and the module stored in the memory 102 are executed to perform various function applications and data processing, that is, the calculation method of the query word similarity or the query word search method in the embodiment of the present application.
  • the memory 102 can include, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), erasable read-only Memory (Erasable Programmable Read-Only Memory, EPROM), Electric Erasable Programmable Read-Only Memory (EEPROM), and the like.
  • Processor 104 can be an integrated circuit chip with signal processing capabilities.
  • the processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP processor, etc.), or a digital signal processor (DSP) or an application specific integrated circuit (ASIC). ), off-the-shelf programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the network module 105 is for receiving and transmitting network signals.
  • the above network signal may include a wireless signal or a wired signal.
  • FIG. 1 is merely illustrative, and the server 100 may also include more or less components than those shown in FIG. 1, or have a different configuration than that shown in FIG.
  • the components shown in Figure 1 can be implemented in hardware, software, or a combination thereof.
  • the present application discloses a network attack judging method, which is applied to a browser client, and the network attack judging method includes:
  • Step S11 Acquire feedback information returned by the network according to the webpage browsing request.
  • the feedback information may be, but is not limited to, domain name resolution information and response information returned by the network according to the webpage browsing request.
  • the domain name resolution information may be returned from the domain name resolution server. For example, if the webpage needs to be browsed, the browser client generates a webpage browsing request according to the operation of the webpage browsing request of the user, and needs to obtain the domain name of the webpage browsing request by the domain name resolution server before transmitting the webpage browsing request to the webpage server. Analyze the information.
  • the response information may be returned by the target server. For example, if the webpage needs to be browsed, the browser client may generate a webpage browsing request and transmit the webpage browsing request to the target server, and the network returns the webpage during the transmission process. Browse the response information corresponding to the request.
  • Step S12 Matching the obtained attack rule with the feedback information, and determining, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where the attack rule is sent by the rule configuration server.
  • each attack rule is formulated by the rule configuration server, and the rule configuration server transmits each attack rule to the browser client.
  • whether the browser client receives the network attack in the process of requesting the webpage data may be determined by checking whether the feedback information is tampered with or the data error occurs.
  • the domain name resolution server may be attacked by a network, causing an error in domain name resolution; or, in the process of transmitting the domain name resolution information to the browser client, a network attack causes a domain name
  • the IP address in the parsing information has been tampered with. This causes the IP address contained in the domain name resolution information to be the wrong IP address, which causes the browser client to fail to obtain the correct IP address, thereby failing to obtain the required web page data.
  • the nodes in the network will browse the webpage. The request is redirected to an illegal destination address, or the channel number corresponding to the web browsing request is modified.
  • the network attack judging method disclosed in the present application is applied to a browser client.
  • the browser client matches the attack rule with the feedback information after acquiring the feedback information returned by the network according to the webpage browsing request.
  • the obtained attack rule is compared with the feedback information, and the webpage browsing request is determined to be subjected to a network attack according to the comparison result, including :
  • the determining the legality of the IP address included in the domain name resolution information according to the attack rule and the domain name resolution information includes the following steps:
  • Step S121 Obtain a target attack rule in the attack rule by using the webpage browsing request, where the attack rule includes a domain name, an IP address, and a rule type identifier, where the target attack rule includes a domain name and the webpage.
  • the domain name requested to be accessed is the same.
  • the rule type identifier included in the attack rule is used to indicate that the domain name corresponds to If the IP address is legal, if the rule type is a legal identifier, the IP address corresponding to the domain name is legal. If the rule type is an illegal identifier, the IP address corresponding to the domain name is invalid.
  • Step S122 traversing the target attack rule, determining whether the IP address included in the domain name resolution information is included in the target attack rule, and if yes, performing the operation of step S123, and if not, performing the operation of step S124.
  • Step S123 If the IP address included in the domain name resolution information is included in the target attack rule, determine whether the IP address included in the domain name resolution information is a legal identifier corresponding to the rule type identifier in the target attack rule. If yes, the operation of step S124 is performed, and if not, the operation of step S125 is performed.
  • Step S124 Determine that the IP address is legal.
  • Step S125 The IP address included in the domain name resolution information is an illegal identifier in the target attack rule, and the IP address is determined to be illegal.
  • the foregoing steps S121 to S125 disclose a method for determining the legality of the IP address included in the domain name resolution information according to the attack rule and the domain name information.
  • this method after obtaining the target attack rule, if the IP address included in the domain name resolution information is not included in the target attack rule, determining that the IP address included in the domain name resolution information is legal, or The IP address included in the domain name resolution information is included in the target attack rule, and further determining, according to the target attack rule, whether the IP address included in the domain name resolution information is legal, where the domain name resolution information is included in the domain name resolution information.
  • the IP address is identified as a legal identifier in the target attack rule, and the IP address is determined to be valid.
  • the corresponding rule type identifier is Illegal identification, then determine the said The IP address is illegal, so that the IP address included in the domain name resolution information is legal according to the attack rule and the domain name resolution information, so as to determine whether the webpage browsing request is attacked by the network according to whether the IP address is legal.
  • the attack rule can be in multiple forms.
  • the attack rule has the form: "domain name
  • the attack rule may also be in any other form including a domain name, a rule type, and an IP address. This application does not limit this, and the rule type includes two types: a legal identifier and an illegal identifier. Other characters may be used, which is not limited in this application.
  • an attack rule is used to describe a workflow for determining whether a web browsing request is subjected to a network attack according to an attack rule and domain name resolution information.
  • the attack rule set one of the attack rules as "m.baidu.com
  • the target attack rule in the attack rule is obtained, wherein The target attack rule is an attack rule containing the domain name "m.baidu.com”.
  • the attack rule corresponding to a domain name may contain multiple.
  • the attack rule corresponding to the same domain name may be set to “domain name
  • attack rules of different domain names can be set together and separated by a separator.
  • it can be set to "domain name 1
  • ⁇ is a separator of the attack rule for isolating different domain names.
  • other types of separators may also be used, which is not limited in this application.
  • 202.91.232.39” attack rule indicates that if the web browsing request is to be accessed The domain name is "m.baidu.com”. If the IP address contained in the domain name resolution information is "61.135.185.17”, the IP address is legal, and the web browsing request is not attacked by the network. If the domain name resolution information is included The IP address is "115.239.210.14", the IP address is illegal, and the web browsing request is attacked by the network.
  • the IP address included in the domain name resolution information is "202.91.232.39”
  • the IP address is illegal, and the web browsing request is attacked by the network.
  • the target attack rule in the attack rule cannot be obtained through the webpage browsing request, that is, the target attack rule does not exist in the attack rule.
  • the domain name resolution information is generally considered to be included in the domain name resolution information.
  • the IP address is legal and the web browsing request is not attacked by the network.
  • the foregoing describes the method for determining whether a network attack is received by verifying the domain name resolution information.
  • the attack rule and the feedback information that are acquired in advance are obtained. Performing a matching comparison, and determining, according to the comparison result, whether the webpage browsing request is subjected to a network attack, including:
  • step S131 it is determined whether the target attack rule exists in the attack rule by using the webpage browsing request. If yes, the operation of step S132 is performed, and if not, the operation of step S135 is performed.
  • the attack rule includes a tampering keyword, an information expression before tampering, and a falsified information expression, where the tampering information expression included in the target attack rule corresponds to the webpage browsing request.
  • Step S132 If it is determined that the target attack rule exists in the attack rule, after obtaining the target attack rule, traverse the target attack rule, and determine whether the response header keyword in the response information is in the target attack rule. The tampering keywords match, and if so, the operation of step S133 is performed, and if not, the operation of step S135 is performed.
  • the response information includes a response header and a response header body, and the response header is composed of a response header
  • the keyword and response header content is composed.
  • the tampering keyword is different depending on the type of network attack. For example, if the cyber attack redirects the webpage corresponding to the web browser to another webpage, so that the browser client browses the redirected web address, in this case, the tampering keyword is often “location”, etc. Field. A field such as "location" may indicate a network address to which the network browsing request is relocated when the type of the network attack is a URL redirect. Generally, if the tamper keyword is included in the response header keyword, the response header keyword in the response information is considered to match the tampering keyword in the target attack rule.
  • Step S133 If the response header keyword in the response information matches the tampering keyword in the target attack rule, determine whether the response header content in the response information is falsified in the target attack rule. The information expressions match, and if so, the operation of step S134 is performed, and if not, the operation of step S135 is performed.
  • Step S134 If the content of the response header matches the falsified information expression in the target attack rule, determine that the webpage browsing request is subjected to a network attack.
  • the tamper-evident information expression is different from the tamper-evident information expression.
  • Step S135 Determine that the webpage browsing request is not subjected to a network attack.
  • step S131 to step S135 it is possible to determine whether the webpage browsing request is subjected to a network attack according to the attack rule and the feedback information.
  • the attack rule includes the tampering keyword, the information expression before the tampering, and the falsified information expression. If an attack rule corresponds to the webpage browsing request before the tampering, the tampering key The word matches the response header keyword in the response information, and the falsified information expression matches the response header content in the response information, indicating that the webpage browsing request is subjected to a network attack.
  • Information expressions also include multiple types depending on the type of cyber attack.
  • the information expression is: a URL address expression, a channel number expression, or a media type expression, or the information expression may be other types, which is not limited in this application.
  • the information expression before the tampering and the falsified information expression are both URL address expressions, it means that after the network attack, the access address of the web browsing request is redirected to other URL addresses; if the information expression before tampering And the falsified information expression is a channel number expression, indicating that the channel number in the web browsing request is tampered with after the network attack; if the information expression before the tampering and the falsified information expression are media type expressions The format indicates that the media type expression in the web browsing request has been tampered with after the network attack.
  • the webpage browsing request indicates that the webpage to be accessed is a page of the Baidu website
  • the information expression before the tampering included in the target attacking rule includes the URL address of the Baidu website
  • the response header keyword in the response header information includes Redirecting a keyword
  • the URL address included in the response header content is a URL address of another webpage
  • matching the falsified URL address included in the target attack rule thereby determining that the webpage browsing request is subjected to a network attack, web browsing The request is redirected to another web page and the browser will not be able to access the Baidu website.
  • attack rule is used to describe a workflow for determining whether a web browsing request is subjected to a network attack according to attack rules and feedback information.
  • the attack rule is set to "rescode
  • .*m.baidu.com.*from 1009719a
  • .*m.sogou.com.*”, where, " Rescode”, “301” and “location” are tampering keywords, ".*m.baidu.com.*from 1009719a” is the information expression before tampering, and “.*m.sogou.com.*” is tampering
  • the information expression is a URL (Uniform Resource Locator, Uniform Resource Locator), separated by "
  • ”, where "rescode” is short for "response code”, which represents the server return code for web browsing requests, "301” and “location” for redirection, " .*m.baidu.com.*from 1009719a” means that before the cyber attack, the purpose of the browser client is to access the Baidu website, ".*m.sogou.com.*” means that after the
  • the secure network data transmission method includes:
  • Step S21 Acquire feedback information returned by the network according to the webpage browsing request.
  • the browser When the user needs to access the browser, the browser is operated, such as touching the browser, etc., after receiving the operation, the browser generates a corresponding webpage browsing request, and the network according to the The web browsing request returns the corresponding feedback information.
  • the feedback is often attacked by the network during network transmission, and the browser client cannot obtain correct feedback information.
  • the network attack may occur at different nodes in the network, and the feedback information may be, but is not limited to, domain name resolution information and response information returned by the network according to the webpage browsing request.
  • the browser client For example, if the webpage needs to be browsed, the browser client generates a webpage browsing request according to the operation of the webpage browsing request of the user, and needs to obtain the domain name of the webpage browsing request by the domain name resolution server before transmitting the webpage browsing request to the webpage server.
  • the response information may be returned by the target server.
  • the browser client may generate a webpage browsing request and transmit the webpage browsing request to the target server, and the network returns the webpage during the transmission process.
  • Step S22 Perform matching matching on the obtained attack rule with the domain name resolution information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where the attack rule is sent by the rule configuration server.
  • the attack rule is matched with the feedback information, and the web browsing request is determined to be cyber-attack according to the comparison result.
  • the method of S121 to S125 determines the validity of the IP address included in the domain name resolution information, and then determines whether the webpage browsing request is subjected to a network attack according to the legality of the IP address, and details are not described herein again.
  • the attack rule that is pre-acquired is matched with the feedback information, and the method for determining whether the webpage browsing request is subjected to a network attack according to the comparison result may be referred to. Step S131 to step S135, and details are not described herein again.
  • Step S23 Determine that the webpage browsing request is subjected to a network attack, and perform network data transmission in a secure manner.
  • the foregoing steps S21 to S23 disclose a secure network data transmission method, in which the browser client compares the pre-acquired attack rule with the feedback information after acquiring the feedback information returned by the network according to the webpage browsing request. According to the comparison result, it is judged whether the webpage browsing request is attacked by the network, and after determining that the webpage browsing request is subjected to the network attack according to the comparison result, the network data is transmitted in a secure manner; if the webpage browsing request is determined not to be attacked by the network according to the comparison result , according to the traditional technology for the transmission of network data.
  • the transmission of network data in a secure manner can avoid the infringement of network attacks, thereby solving the problem in the prior art that the web browsing request is tampered with after the network attack, and the security risk can be reduced.
  • the attacking rule is matched and matched with the domain name resolution information, and the webpage browsing request is judged according to the comparison result, and According to the comparison result, after determining that the webpage browsing request is subjected to the network attack, the network data is transmitted in a secure manner; if the webpage browsing request is determined not to be attacked by the network according to the comparison result, the IP address to be accessed is obtained according to the domain name resolution information, and the access is obtained.
  • the destination server corresponding to the IP address performs network data transmission.
  • the network data can be transmitted in a secure manner to avoid network attacks. This solves the problem in the prior art.
  • the browser client After the network attack, the browser client cannot obtain the correct IP address, which further prevents the browser client from acquiring.
  • the required webpage data causes the user to be unable to browse the required information, and enables the browser client to display the webpage data corresponding to the webpage browsing request to satisfy the browsing requirement of the user.
  • step S23 the transmitting the network data in a secure manner as described in step S23 includes the following steps:
  • the browser client encrypts the webpage browsing request and sends it to the proxy server, so that the proxy server decrypts the encrypted webpage browsing request, performs domain name resolution, and accesses and domain name resolution on the decrypted webpage browsing request.
  • the corresponding target server acquires network data corresponding to the decrypted webpage browsing request, and encrypts the network data.
  • a private protocol that is, a preset protocol, is preset between the browser client and the proxy server, and the encryption and decryption method between the browser client and the proxy server can be specified by the preset protocol.
  • the browser client encrypts the webpage browsing request according to a preset protocol with the network proxy server, and transmits the encrypted webpage browsing request to the proxy server.
  • Proxy service After obtaining the encrypted webpage browsing request, the device decrypts according to the preset protocol, and after obtaining the decrypted webpage browsing request, performs domain name resolution on the decrypted webpage browsing request, and accesses the target server corresponding to the domain name resolution result.
  • the proxy server After obtaining the network data, the proxy server encrypts the network data according to a preset protocol, and transmits the encrypted network data to the browser client. After receiving the encrypted network data, the browser client decrypts the network data according to a preset protocol, and displays the decrypted network data for the user to browse.
  • the data transmitted between the browser client and the proxy server is encrypted, it is not affected by network attacks, enabling the browser client to obtain the correct web page data.
  • the browser client may further perform format analysis on the received attack rule. If the format analysis is performed to determine that the received attack rule does not meet the preset format, Discard attack rules that do not conform to the preset format.
  • each attack rule may be in the form of "key1
  • .*m.baidu.com.*from 1009719a
  • attack rule key1 is rescode
  • rule1 is 301
  • key2 is location
  • key3 is location
  • rule3 is ".*m.so.com.*” with "
  • the attack rule is considered to be in conformity with the format.
  • the browser client determines whether the attack rule conforms to the form of "key1
  • the attack rule may be set to other forms, such as "key1: rule1; key2: rule2; keyn: rulen", which is not limited in this application.
  • the secure network data transmission method disclosed in the present application further includes: after determining that the webpage browsing request is subjected to a network attack, discarding the domain name resolution information.
  • the domain name resolution information received by the browser client may be affected by the network attack.
  • the domain name resolution information is the domain name resolution information returned by the network according to the webpage browsing request, and the IP address included in the domain name resolution information is often wrong. Therefore, the domain name resolution information is discarded, thereby reducing storage space.
  • the IP address included in the incorrect domain name resolution information is the IP address of the 360 website.
  • a network node between the browser client and the domain name server has a DNS hijack, and the IP address corresponding to the domain name "m.baidu.com" parsed by the domain name resolution server is modified to the IP address of the 360 website.
  • the browser client will access the 360 website.
  • the secure network data transmission method disclosed in the present application determines that the webpage browsing request is subjected to a network attack according to the attack rule, thereby transmitting the network data in a secure manner, so that the browser client can access the correct Baidu website.
  • each attack rule forms a data structure as shown in FIG. 6, and the data structure is a two-dimensional data structure.
  • each domain name is used as an index to indicate a rule list of each domain name.
  • the rule configuration server configures multiple attack rules according to the browser's access requirements. For example, when a browser visits a Baidu website, it may encounter a jump to 360 websites or other advertising websites. A cyber attack; when a browser visits a shopping site, it may encounter a cyber attack that jumps to other shopping sites.
  • the rule configurator configures multiple attack rules according to this.
  • the browser client can parse the attack rule into the two-dimensional data structure shown in FIG. 6 according to the domain name included in each attack rule.
  • the protection method for network attacks disclosed in the present application can be applied to various application scenarios to protect multiple types of network attacks.
  • the network attack causes the destination address in the web browsing request to be tampered with, causing it to be redirected to an illegal destination address.
  • the browser client can only access the illegal destination address that is redirected.
  • the browser client can recognize the network attack and obtain the required webpage data through the proxy server. For example, if the cyber attack will access Baidu's web browsing request and is redirected to the 360 website, in this case, the response header in the response message includes "301" or "302", and "location”, etc. Redirects the field and contains the URL of the 360 website.
  • the browser client After receiving the response information returned by the network, the browser client searches for the target attack rule in the attack rule according to the destination address to be accessed included in the webpage browsing request and the URL address of Baidu, wherein the target attack rule is in the target attack rule.
  • the included URL address expression before the tampering is opposite to the Baidu URL address included in the web browsing request. Then, traversing the target attack rule to determine whether the response header keyword in the response header information matches the tampering keyword in each target attack rule, and the tampering keyword is “301” or “302”. And redirect fields such as "location”.
  • the falsified information expression is the redirected website address.
  • the falsified information expression is the URL address of the 360 website, and the tampering in the response header content and the target attack rule. If the subsequent information expressions match, it is determined that the webpage browsing request is subjected to a network attack, and the webpage browsing request is tampered with, so that it is redirected to the 360 website, and the required webpage data needs to be obtained through the secure proxy server, thereby avoiding The impact of cyber attacks.
  • some illegal operators redirect normal web browsing requests to their own ad pages.
  • the browser can only access the advertisement of the operator.
  • the browser client can recognize the situation and obtain the required webpage data.
  • the reason for the white screen in Indonesia is that the operator conducts a network attack and jumps the normal web browsing request of the user to an advertisement page.
  • the advertisement is loaded slowly, and there will be a white screen of ten seconds. White screen situation.
  • the URL address expression before the tampering included in one or several attack rules is the destination address corresponding to the web browsing request
  • the response header keyword corresponds to the tampering keyword in one of the target attack rules.
  • each includes a "301" or “302”, and a "location” and other redirect fields
  • the response header content matches the falsified information expression in the target attack rule, and corresponds to the URL of the advertisement page.
  • the address determines that the webpage browsing request is redirected to the advertisement page, and is attacked by the network, and the required webpage data is obtained through the secure proxy server, so that the browser client displays the normal webpage. Page data, reducing the white screen situation in Indonesia.
  • some illegal merchants tamper with the channel number included in the web browsing request on some network nodes to achieve their own profitability.
  • attack rules contain the channel number before the tampering And the same as the channel number included in the webpage browsing request, determining that the attacking rule is a target attacking rule, if the keyword of the response information matches the tampering keyword in one of the target attacking rules, and the response header content and the target attacking If the falsified channel number expressions in the rules match, it is determined that the webpage browsing request is subjected to a network attack, and the required webpage data needs to be obtained through the secure proxy server, thereby avoiding the influence of the network attack.
  • a secure network data transmission method is disclosed that is applied to a rule configuration server.
  • the secure network data transmission method includes the following steps:
  • Step S31 According to the received operation, an attack rule is formulated.
  • Step S32 Obtain a webpage browsing request transmitted by the browser client, and obtain an IP address to be accessed by the browser client according to the webpage browsing request.
  • step S31 and the step S32 are not performed in a strict time sequence, and may be performed simultaneously. Alternatively, the operation of step S32 may be performed first, and then the operation of step S31 may be performed.
  • step S33 the attacking rule corresponding to the area indicated by the IP address and the operator is queried from the specified attack rule.
  • the rule configuration server needs to obtain the IP address to be accessed by the browser client according to the webpage browsing request. After the attack rule is formulated, the rule configuration server queries the IP address indication from the attack rule. The attack rules corresponding to the region and the operator.
  • Step S34 The attacking rule corresponding to the area indicated by the IP address and the operator is transmitted to the browser client, so that the browser client determines whether the network attack is attacked according to the attack rule.
  • the method for determining whether the network is attacked by the browser client according to the attack rule may first determine the legality of the IP address included in the domain name resolution information according to the method of step S121 to step S125, and then according to the legality of the IP address. Determine whether the web browsing request is attacked by a network, and will not be described here.
  • the rule configuration server can formulate an attack rule, obtain an attack rule corresponding to the area and the operator indicated by the IP address to be accessed by the browser client, and indicate the area indicated by the IP address.
  • An attack rule corresponding to the operator is transmitted to the browser client.
  • the browser client determines whether the network attack is received according to the received attack rule, and performs network data transmission in a secure manner to ensure the impact of the network attack.
  • a secure network data transmission method is disclosed, which is applied to a rule configuration server.
  • the secure network data transmission method includes the following steps:
  • Step S41 Formulate an attack rule according to the received operation.
  • Step S42 The attack rule is transmitted to the browser client, so that the browser client determines whether it is subjected to a network attack according to the attack rule.
  • step S131 to step S135 The method for determining whether the browser client is subjected to a network attack according to an attack rule may be referred to as step S131 to step S135, and details are not described herein again.
  • the rule configuration server can formulate an attack rule corresponding to various types of network attacks, and transmit the attack rule to the browser client, so that the browser client receives the The attack rule determines whether the network attack is performed.
  • the browser client performs network data transmission in a secure manner to determine the impact of the network attack.
  • the network attack judging device includes: a feedback obtaining module 110 and a determining module 120.
  • the feedback information obtaining module 110 is configured to obtain feedback information returned by the network according to the webpage browsing request;
  • the determining module 120 is configured to compare and match the obtained attack rule with the feedback information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where the attack rule is sent by the rule configuration server. .
  • the feedback information is response information returned by the network according to the webpage browsing request.
  • the determining module 120 may include: an obtaining unit, a first determining unit, a second determining unit, and a third determining unit.
  • the acquiring unit is configured to obtain a target attack rule in an attack rule by using the webpage browsing request, where the attack rule includes a tampering keyword and information before tampering And an falsified information expression, wherein the tampering information expression included in the target attack rule corresponds to the webpage browsing request;
  • the first determining unit is configured to traverse the target attack rule, and determine whether a response header keyword in the response information matches a tampering keyword in the target attack rule;
  • the second determining unit is configured to determine, if the response header keyword in the response information matches the tampering keyword in the target attack rule, whether the response header content in the response information is related to the target attack The falsified information expressions in the rules match;
  • the third determining unit is configured to determine that the webpage browsing request is subjected to a network attack if the content of the response header matches the falsified information expression in the target attack rule.
  • the information expression is: a URL address expression, a channel number expression, or a media type expression.
  • the network attack judging device acquires an attack rule formulated by the rule configuration server, and after obtaining the feedback information returned by the network according to the webpage browsing request, determining the webpage according to the comparison result of the attack rule and the feedback information. Whether the browsing request is subject to a network attack, thereby solving the problem in the prior art that the network attack cannot be identified.
  • the network attack judging device includes: a domain name resolution information obtaining module 130 and a determining module 140.
  • the domain name resolution information obtaining module 130 is configured to obtain domain name resolution information returned by the network according to the webpage browsing request;
  • the determining module 140 is configured to compare and match the obtained attack rule with the domain name resolution information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where The attack rule is sent by the rule configuration server.
  • the determining module 140 includes: an IP address legality determining unit and a network attack determining unit.
  • the IP address legality determining unit is configured to determine the legality of the IP address included in the domain name resolution information according to the attack rule and the domain name resolution information.
  • the network attack determining unit is configured to determine, according to the legality of the IP address included in the domain name resolution information, whether the webpage browsing request is subjected to a network attack, wherein if the IP address is legal, determining the webpage browsing The request is not attacked by the network. If the IP address is illegal, it is determined that the web browsing request is attacked by the network.
  • the IP address legality determining unit includes: a target attack rule obtaining subunit, a target attack rule traversing subunit, a first determining subunit, and a second determining subunit.
  • the target attack rule obtaining sub-unit is configured to obtain a target attack rule in the attack rule by using the webpage browsing request, where the attack rule includes a domain name, an IP address, and a rule type identifier, where the target The domain name included in the attack rule is the same as the domain name to be accessed by the webpage browsing request;
  • the target attack rule traversal sub-unit is configured to traverse the target attack rule, and determine whether an IP address included in the domain name resolution information is included in the target attack rule;
  • the first determining subunit is configured to determine that the IP address included in the domain name resolution information is legal if the IP address included in the domain name resolution information is not included in the target attack rule;
  • the second determining subunit is configured to determine, according to the target attack rule, whether an IP address included in the domain name resolution information is legal, if the IP address included in the domain name resolution information is included in the target attack rule, Wherein, if the IP address included in the domain name resolution information is in the office If the corresponding rule type identifier in the target attack rule is a legal identifier, the IP address is determined to be legal. If the IP address included in the domain name resolution information is an illegal identifier in the target attack rule, It is determined that the IP address is illegal.
  • the network attack judging device acquires an attack rule formulated by the rule configuration server, and after obtaining the domain name resolution information returned by the network according to the webpage browsing request, determining the location according to the comparison result between the attack rule and the domain name parsing information. Whether the web browsing request is subjected to a network attack, thereby solving the problem that the network attack cannot be recognized in the prior art.
  • the seventh embodiment of the present application discloses a secure network data transmission device applied to a browser client.
  • the secure network data transmission apparatus includes: a domain name resolution information acquisition module 210, a determination module 220, and a transmission module 230.
  • the domain name resolution information obtaining module 210 is configured to obtain domain name resolution information returned by the network according to the webpage browsing request;
  • the determining module 220 is configured to compare and match the obtained attack rule with the domain name resolution information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where the attack rule is sent by the rule configuration server. of;
  • the transmission module 230 is configured to determine that the webpage browsing request is subjected to a network attack, and then perform network data transmission in a secure manner.
  • the determining module 220 includes: an IP address legality determining unit and a network attack determining unit.
  • the IP address legality determining unit is configured to determine the legality of the IP address included in the domain name resolution information according to the attack rule and the domain name resolution information.
  • the network attack determining unit is configured to: according to the IP address included in the domain name resolution information The legality of determining whether the webpage browsing request is subjected to a network attack, wherein if the IP address is legal, determining that the webpage browsing request is not attacked by a network, and if the IP address is illegal, determining the webpage browsing request Attacked by the network.
  • the IP address legality determining unit includes: a target attack rule obtaining subunit, a target attack rule traversing subunit, a first determining subunit, and a second determining subunit.
  • the target attack rule obtaining sub-unit is configured to obtain a target attack rule in the attack rule by using the webpage browsing request, where the attack rule includes a domain name, an IP address, and a rule type identifier, where the target The domain name included in the attack rule is the same as the domain name to be accessed by the webpage browsing request;
  • the target attack rule traversal sub-unit is configured to traverse the target attack rule, and determine whether an IP address included in the domain name resolution information is included in the target attack rule;
  • the first determining subunit is configured to determine that the IP address included in the domain name resolution information is legal if the IP address included in the domain name resolution information is not included in the target attack rule;
  • the second determining subunit is configured to determine, according to the target attack rule, whether an IP address included in the domain name resolution information is legal, if the IP address included in the domain name resolution information is included in the target attack rule, If the IP address included in the domain name resolution information is a legal identifier in the target attack rule, the IP address is determined to be valid, and the IP address included in the domain name resolution information is in the office. If the corresponding rule type identifier in the target attack rule is an illegal identifier, it is determined that the IP address is illegal.
  • the transmission module 230 includes: a sending unit and a receiving unit.
  • the sending unit is configured to encrypt the webpage browsing request and send the request to the proxy server, after the proxy server decrypts the encrypted webpage browsing request, and the decrypted network
  • the page browsing request performs domain name resolution, and accesses a target server corresponding to the domain name resolution result, acquires network data corresponding to the decrypted webpage browsing request, and encrypts the network data;
  • the receiving unit is configured to receive the encrypted network data returned by the proxy server.
  • the secure network data transmission device further includes: a discarding module, configured to discard the domain name resolution information after the webpage browsing request is subjected to a network attack.
  • the secure network data transmission device acquires an attack rule formulated by the rule configuration server, and after obtaining the domain name resolution information returned by the network according to the webpage browsing request, according to the comparison result of the attack rule and the domain name resolution information, According to the comparison result, it is determined whether the webpage browsing request is subjected to a network attack, and after determining that the webpage browsing request is subjected to the network attack according to the comparison result, the network data is transmitted in a secure manner; if the webpage browsing request is determined not to be attacked by the network according to the comparison result, Then, the network data is transmitted according to the conventional technology.
  • the transmission of network data in a secure manner can avoid the infringement of network attacks, thereby solving the existing technology.
  • the correct IP address cannot be obtained, and the browser client cannot obtain the required webpage data.
  • the problem that the user cannot browse the required information enables the browser client to display the webpage data corresponding to the webpage browsing request, and meets the browsing requirement of the user.
  • the eighth embodiment of the application discloses a secure network data transmission device applied to a browser client.
  • the secure network data transmission apparatus includes: a feedback information acquisition module 240, a determination module 250, and a transmission module 260.
  • the feedback information obtaining module 240 is configured to send a webpage browsing request to the target server. After seeking, obtaining feedback information returned by the network according to the webpage browsing request;
  • the determining module 250 is configured to compare and match the pre-acquired attack rule with the feedback information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack, where the attack rule is sent by the rule configuration server. ;
  • the transmission module 260 is configured to determine that the webpage browsing request is subjected to a network attack, and then perform network data transmission in a secure manner.
  • the feedback information is usually response information returned by the network according to the webpage browsing request.
  • the determining module 220 includes: an obtaining unit, a first determining unit, a second determining unit, and a third determining unit.
  • the acquiring unit is configured to obtain a target attack rule in an attack rule by using the webpage browsing request, where the attack rule includes a tampering keyword, an information expression before tampering, and a falsified information expression. And the information expression before the tampering included in the target attack rule corresponds to the webpage browsing request;
  • the first determining unit is configured to traverse the target attack rule, and determine whether a response header keyword in the response information matches a tampering keyword in the target attack rule;
  • the second determining unit is configured to determine, if the response header keyword in the response information matches the tampering keyword in the target attack rule, whether the response header content in the response information is related to the target attack The falsified information expressions in the rules match;
  • the third determining unit is configured to determine that the webpage browsing request is subjected to a network attack if the content of the response header matches the falsified information expression in the target attack rule.
  • the transmission module 260 includes: a sending unit and a receiving unit.
  • the sending unit is configured to encrypt the webpage browsing request and send the webpage browsing request to the proxy server, so that the proxy server decrypts the encrypted webpage browsing request, and then goes to the target server to obtain the network data corresponding to the webpage browsing request. And encrypting the network data;
  • the receiving unit is configured to receive the encrypted network data returned by the proxy server.
  • the secure network data transmission device further includes: a discarding module, wherein the discarding module is configured to discard the feedback information after the webpage browsing request is subjected to a network attack.
  • the secure network data transmission device acquires an attack rule formulated by the rule configuration server, and after obtaining the feedback information returned by the network according to the webpage browsing request, according to the comparison result of the attack rule and the feedback information, according to the comparison
  • the network data is transmitted in a secure manner; if the webpage browsing request is determined not to be attacked by the network according to the comparison result, then according to the comparison result,
  • Traditional technology carries out the transmission of network data.
  • the transmission of network data in a secure manner can avoid the infringement of network attacks, thereby solving the problem in the prior art that the web browsing request is tampered with after the network attack, and can avoid security risks.
  • the ninth embodiment of the application discloses a secure network data transmission device that is applied to a rule configuration server.
  • the secure network data transmission apparatus includes an attack rule formulation module 310 and an attack rule transmission module 320.
  • the attack rule formulation module 310 is configured to formulate an attack rule according to the received operation.
  • the attack rule transmission module 320 is configured to transmit the attack rule to a browser client End, so that the browser client determines whether it is subjected to a network attack according to the attack rule.
  • an attack rule corresponding to various types of network attacks can be formulated, and the attack rule is transmitted to a browser client, so that the browser client according to the received attack The rule determines whether the network attack is performed.
  • the browser client performs network data transmission in a secure manner to determine the impact of the network attack.
  • the tenth embodiment of the application discloses a secure network data transmission device that is applied to a rule configuration server.
  • the secure network data transmission apparatus includes: an attack rule formulation module 340, an IP address acquisition module 350, an attack rule query module 360, and an attack rule transmission module 370.
  • the attack rule formulation module 340 is configured to formulate an attack rule according to the received operation.
  • the IP address obtaining module 350 is configured to obtain a webpage browsing request transmitted by the browser client, and obtain an IP address to be accessed by the browser client according to the webpage browsing request;
  • the attack rule querying module 360 is configured to query, according to the specified attack rule, an attack rule corresponding to the area indicated by the IP address and the operator;
  • the attack rule transmission module 370 is configured to transmit an attack rule corresponding to the area indicated by the IP address and an operator to the browser client, so that the browser client determines whether the network is affected by the network according to the attack rule. attack.
  • the attacking rule corresponding to the IP address to be accessed is determined by the security network data transmission device, and the attack rule corresponding to the IP address to be accessed is determined, and the attack rule corresponding to the IP address is transmitted to the browser.
  • the browser client according to the received attack rule Then, it is determined whether the network attack is performed.
  • the browser client performs network data transmission in a secure manner to ensure the impact of the network attack.
  • a tenth embodiment of the present application discloses a protection system for a network attack.
  • the protection system for network attacks includes: a rule configuration server 100, a user terminal 200, and a proxy server 300, and the user terminal 200 is provided with a browser client.
  • the rule configuration server 100 is configured to formulate an attack rule according to the received operation, and transmit the attack rule to a browser client of the user terminal 200.
  • the rule configuration server may be configured to: according to the received operation, formulate an attack rule, obtain a webpage browsing request transmitted by a browser client of the user terminal, and acquire the browser according to the webpage browsing request.
  • the IP address to be accessed by the client is used to query the attack rule corresponding to the area indicated by the IP address and the operator from the specified attack rule, and the attack corresponding to the area indicated by the IP address and the operator Rules are transmitted to the browser client.
  • the browser client of the user terminal is configured to obtain the feedback information returned by the network according to the webpage browsing request, compare and match the attack rule with the feedback information, and determine, according to the comparison result, whether the webpage browsing request is subjected to a network attack. If it is determined that the webpage browsing request is subjected to a network attack, the network data is transmitted in a secure manner with the proxy server.
  • the browser client of the user terminal may be configured to obtain domain name resolution information returned by the network according to the webpage browsing request, and match the attack rule transmitted by the rule configuration server with the domain name resolution information. In contrast, it is determined whether the webpage browsing request is subjected to a network attack according to the comparison result. If it is determined that the webpage browsing request is subjected to a network attack, the network data is transmitted in a secure manner with the proxy server.
  • the browser client of the user terminal 200 encrypts the webpage browsing request according to a preset protocol with the proxy server 300, and transmits the encrypted webpage browsing request to the website.
  • the proxy server 300 decrypts the encrypted webpage browsing request according to the preset protocol, and transmits the decrypted webpage browsing request to the target server.
  • the webpage data corresponding to the decrypted webpage browsing request is obtained by the target server, and then the webpage data is encrypted and transmitted to the browser client of the user terminal 200 according to the preset protocol.
  • the browser client decrypts the webpage data according to the preset protocol, the webpage content corresponding to the decrypted webpage data is displayed.
  • the protection system of the network attack disclosed in this embodiment can determine whether the webpage browsing request is subjected to a network attack, and in the case of determining that the network attack is performed, the browser client and the proxy server transmit the network data through the secure channel, thereby not Will be affected by cyber attacks. Further, it can also reduce the security risks caused by network attacks.
  • the protection system of the network attack disclosed in this embodiment can determine whether the webpage browsing request is subjected to a network attack, and in the case of determining that the network attack is performed, the browser client and the proxy server transmit the network data through the secure channel, thereby not Will be affected by cyber attacks. Further, it can also reduce the security risks caused by network attacks.
  • the channel for transferring data between the browser client and the proxy server can be named as a secure proxy channel.
  • the method according to the invention can also be implemented as a computer program product, the calculation
  • the program product includes a computer readable medium having non-volatile program code executable by a processor.
  • a computer program for performing the above-described functions defined in the method of the present invention is stored on the computer readable medium. For example, the feedback information returned by the network according to the webpage browsing request may be performed; the obtained attacking rule is compared with the feedback information, and the webpage browsing request is determined to be subjected to a network attack according to the comparison result, wherein the attacking rule is It is sent by the rule configuration server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开一种网络攻击判断方法、安全的网络数据传输方法及相应装置。该申请中，浏览器客户端获取规则配置服务器制定的攻击规则，并在获取网络根据网页浏览请求返回的反馈信息后，根据所述攻击规则与反馈信息的对比结果，确定所述网页浏览请求是否受到网络攻击，从而解决现有技术中，无法识别网络攻击的问题。并且，浏览器客户端在确定受到网络攻击后，通过安全方式进行网络数据的传输，能够避免网络攻击的影响，提高网络数据传输的安全性。

Description

网络攻击判断方法、安全的网络数据传输方法及相应装置
本申请要求于2015年7月15日提交中国专利局、申请号为201510416039.6、发明名称为“网络攻击判断方法、安全的网络数据传输方法及相应装置”的中国专利申请的优先权，以及于2015年07月15日提交中国专利局、申请号为201510416040.9、发明名称为“网络攻击判断方法、安全的网络数据传输方法及相应装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及网页浏览技术领域，尤其涉及一种网络攻击判断方法、安全的网络数据传输方法及相应装置。
背景技术
现代科学技术发展的速度日益加快，信息量迅猛增加，这种情况下，通过浏览器浏览网页，成为一种获取信息的普遍做法。
浏览器是一种能够显示网页内容，以便用户浏览的软件。若用户需要浏览某一网页，浏览器会根据用户操作产生相应的网页浏览请求，并将所述网页浏览请求传输至DNS服务器，由所述DNS服务器进行域名解析，并将域名解析结果传输至浏览器，所述域名解析结果中包含本次需要访问的域名对应的IP地址，所述浏览器接收到域名解析结果后，会根据该IP地址访问服务器，获取相应的网页数据，并显示与所述网页数据相应的网页内容，满足用户的浏览需求。
但是，所述网页浏览请求有时会受到网络攻击，导致浏览器接收到的域名解析结果出现错误，但浏览器无法识别是否受到网络攻击，另外，在 受到网络攻击时，浏览器无法获取到正确的IP地址，进一步导致浏览器无法获取所需的网页数据，使用户无法浏览所需的信息。
发明内容
为克服相关技术中存在的问题，本公开提供一种针对网络攻击的防护方法、装置及系统。
为了解决上述技术问题，本发明实施例公开了如下技术方案：
根据本公开实施例的第一方面，提供一种网络攻击判断方法，应用于浏览器客户端，所述网络攻击判断方法包括：获取网络根据网页浏览请求返回的反馈信息；将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
进一步地，所述反馈信息为域名解析信息。
进一步地，所述将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
进一步地，所述根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性，包括：通过所述网页浏览请求，获取所述攻击规则中的目标攻击规则，其中，所述攻击规则中包含域名、IP 地址和规则类型标识，所述目标攻击规则包含的域名与所述网页浏览请求待访问的域名相同；遍历所述目标攻击规则，确定所述域名解析信息中包含的IP地址是否包含在所述目标攻击规则中；若所述域名解析信息中包含的IP地址未包含在所述目标攻击规则中，确定所述域名解析信息中包含的IP地址合法；若所述域名解析信息中包含的IP地址包含在所述目标攻击规则中，根据所述目标攻击规则确定所述域名解析信息中包含的IP地址是否合法，其中，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为合法标识，则确定所述IP地址合法，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，则确定所述IP地址非法。
进一步地，所述反馈信息为网络根据所述网页浏览请求返回的响应信息。
进一步地，所述将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：通过所述网页浏览请求，获取攻击规则中的目标攻击规则，其中，所述攻击规则中包含篡改关键字、篡改前的信息表达式和篡改后的信息表达式，所述目标攻击规则包含的所述篡改前的信息表达式与所述网页浏览请求相对应；遍历所述目标攻击规则，确定所述响应信息中的响应头关键字是否与所述目标攻击规则中的篡改关键字相匹配；若所述响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配，确定所述响应信息中的响应头内容是否与该条目标攻击规则中的篡改后的信息表达式相匹配；若所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，确定所述 网页浏览请求受到网络攻击。
进一步地，所述信息表达式为：URL地址表达式、渠道号表达式或媒体类型表达式。
根据本公开实施例的第二方面，提供一种安全的网络数据传输方法，应用于浏览器客户端，所述安全的网络数据传输方法包括：获取网络根据网页浏览请求返回的反馈信息；将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
进一步地，所述通过安全方式进行网络数据的传输包括：将所述网页浏览请求加密后发送至代理服务器，以供所述代理服务器解密加密后的网页浏览请求后，对解密后的网页浏览请求进行域名解析，并访问与域名解析结果相对应的目标服务器，获取与所述解密后的网页浏览请求对应的网络数据，并且加密所述网络数据；接收所述代理服务器返回的加密后的网络数据。
进一步地，所述安全的网络数据传输方法还包括：确定所述网页浏览请求受到网络攻击后，丢弃所述域名解析信息。
根据本公开实施例的第三方面，提供一种安全的网络数据传输方法，应用于规则配置服务器，所述安全的网络数据传输方法包括：根据接收到的操作，制定攻击规则；将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
进一步地，所述将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击，包括：获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址；从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则；将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
根据本公开实施例的第四方面，提供一种网络攻击判断装置，应用于浏览器客户端，所述网络攻击判断装置包括：反馈信息获取模块，用于获取网络根据网页浏览请求返回的反馈信息；确定模块，用于将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
进一步地，所述反馈信息为域名解析信息或响应信息。
进一步地，所述确定模块包括：IP地址合法性确定单元，用于根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；网络攻击确定单元，用于根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
根据本公开实施例的第五方面，提供一种安全的网络数据传输装置，应用于浏览器客户端，所述安全的网络数据传输装置包括：反馈信息获取模块，用于获取网络根据网页浏览请求返回的反馈信息；确定模块，用于 将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；传输模块，用于确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
根据本公开实施例的第六方面，提供一种安全的网络数据传输装置，应用于规则配置服务器，所述安全的网络数据传输装置包括：攻击规则制定模块，用于根据接收到的操作，制定攻击规则；攻击规则传输模块，用于将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
进一步地，所述攻击规则传输模块，具体用于获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址；从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则；将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
根据本公开实施例的第七方面，提供一种安全的网络数据传输系统，包括：规则配置服务器、代理服务器以及用户终端，所述用户终端设置有浏览器客户端，其中，所述规则配置服务器用于根据接收到的操作，制定攻击规则，并将所述攻击规则传输至用户终端的浏览器客户端；所述用户终端的浏览器客户端用于获取网络根据网页浏览请求返回的反馈信息后，将所述攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击， 则与所述代理服务器之间通过安全方式进行网络数据的传输。
进一步地，所述规则配置服务器，具体用于根据接收到的操作，制定攻击规则，获取用户终端的浏览器客户端传输的网页浏览请求，根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址，用于从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则，并将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端；
所述用户终端的浏览器客户端，具体用于获取网络根据网页浏览请求返回的域名解析信息，并将所述规则配置服务器传输的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击，则与所述代理服务器之间通过安全方式进行网络数据的传输。
根据本公开实施例的第八方面，提供一种具有处理器可执行的非易失的程序代码的计算机可读介质，所述程序代码在被所述处理器执行时使所述处理器执行以下方法：
获取网络根据网页浏览请求返回的反馈信息；
将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
本公开的实施例提供的技术方案可以包括以下有益效果：
本申请公开一种网络攻击判断方法、安全的网络数据传输方法及相应装置。该申请中，浏览器客户端获取规则配置服务器制定的攻击规则，并 在获取网络根据网页浏览请求返回的反馈信息后，根据所述攻击规则与反馈信息的对比结果，确定所述网页浏览请求是否受到网络攻击，从而解决现有技术中，无法识别网络攻击的问题。并且，浏览器客户端在确定受到网络攻击后，通过安全方式进行网络数据的传输，能够避免网络攻击的影响，提高网络数据传输的安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明的实施例，并与说明书一起用于解释本发明的原理。
图1是根据一示例性实施例示出的一种电子设备的结构框图；
图2是根据一示例性实施例示出的一种网络攻击判断方法的工作流程示意图；
图3是根据一示例性实施例示出的一种网络攻击判断方法中，确定IP地址的合法性的工作流程示意图；
图4是根据一示例性实施例示出的一种网络攻击判断方法中，确定网页浏览请求是否受到网络攻击的工作流程示意图；
图5是根据一示例性实施例示出的一种安全的网络数据传输方法的工作流程示意图；
图6是根据一示例性实施例示出的一种安全的网络数据传输方法中攻击规则的结构示意图；
图7是根据一示例性实施例示出的一种安全的网络数据传输方法的工 作流程示意图；
图8是根据一示例性实施例示出的一种安全的网络数据传输方法的工作流程示意图；
图9根据一示例性实施例示出的一种网络攻击判断装置的结构示意图；
图10根据一示例性实施例示出的一种网络攻击判断装置的结构示意图；
图11根据一示例性实施例示出的一种安全的网络数据传输装置的结构示意图；
图12根据一示例性实施例示出的一种安全的网络数据传输装置的结构示意图；
图13根据一示例性实施例示出的一种安全的网络数据传输装置的结构示意图；
图14根据一示例性实施例示出的一种安全的网络数据传输装置的结构示意图；
图15根据一示例性实施例示出的一种安全的网络数据传输系统的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本发明相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本发明的一些方面相一致的装置和方法的例子。
为了解决现有技术在浏览网页过程中，在受到网络攻击时，浏览器无法识别网络攻击，另外，浏览器往往无法获取到正确的IP地址，从而无法获取所需的网页数据，导致用户无法浏览所需的信息的问题，本申请公开一种网络攻击判断方法、安全的网络数据传输方法及相应装置。
图1示出了一种可应用于本申请实施例中的电子设备100的结构框图。该电子设备可以是用户终端，也可以是服务器。如图1所示，电子设备100可以包括存储器102、存储控制器103、处理器104和网络模块105。
存储器102、存储控制器103、处理器104、网络模块105各元件之间直接或间接地电连接，以实现数据的传输或交互。例如，这些元件之间可以通过一条或多条通讯总线或信号总线实现电连接。所述网络攻击判断方法、安全的网络数据传输方法包括至少一个可以以软件或固件(firmware)的形式存储于存储器102中的软件功能模块，例如所述查询词相似度计算装置或查询词搜索装置包括的软件功能模块或计算机程序。
存储器102可以存储各种软件程序以及模块，如本申请实施例提供的查询词相似度计算方法及装置对应的程序指令/模块或者查询词搜索方法及装置对应的程序指令/模块，处理器104通过运行存储在存储器102中的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现本申请实施例中的查询词相似度的计算方法或查询词搜索方法。存储器102可以包括但不限于随机存取存储器(Random Access Memory，RAM)，只读存储器(Read Only Memory，ROM)，可编程只读存储器(Programmable Read-Only Memory，PROM)，可擦除只读存储器(Erasable Programmable Read-Only  Memory，EPROM)，电可擦除只读存储器(Electric Erasable Programmable Read-Only Memory，EEPROM)等。
处理器104可以是一种集成电路芯片，具有信号处理能力。上述处理器可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。其可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
网络模块105用于接收以及发送网络信号。上述网络信号可包括无线信号或者有线信号。
可以理解，图1所示的结构仅为示意，服务器100还可以包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。图1中所示的各组件可以采用硬件、软件或其组合实现。
参见图2所示的工作流程示意图，在第一实施例中，本申请公开一种网络攻击判断方法，该方法应用于浏览器客户端，所述网络攻击判断方法包括：
步骤S11、获取网络根据网页浏览请求返回的反馈信息。
如果浏览器客户端在请求网页数据的过程中受到了网络攻击，网络返回的反馈数据可能被篡改，则在获取网络返回的反馈信息后，可以通过对反馈信息做出进一步的数据处理，来判断浏览器客户端在请求网页数据的过程中是否受到了网络攻击。网络攻击可能发生于网络中的不同节点，则 所述反馈信息可以，但不限于为域名解析信息和网络根据所述网页浏览请求返回的响应信息。
所述域名解析信息可以从域名解析服务器返回。例如，若需要浏览网页，浏览器客户端会根据用户网页浏览请求的操作产生网页浏览请求，在将所述网页浏览请求传输至网页服务器之前，需要获取域名解析服务器对所述网页浏览请求的域名解析信息。所述响应信息可以由目标服务器返回，例如，若需要浏览网页，浏览器客户端会产生网页浏览请求，并将所述网页浏览请求传输至目标服务器，在传输过程中，网络会返回所述网页浏览请求对应的响应信息。
步骤S12、将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
本申请中，通过规则配置服务器制定各条攻击规则，并由所述规则配置服务器将各条攻击规则传输至浏览器客户端。
在获取到所述反馈信息后，可以通过检验反馈信息是否被篡改或者出现数据错误来判断浏览器客户端在请求网页数据的过程中是否收到网络攻击。例如，域名解析服务器在解析网页浏览请求的过程中，有可能受到网络攻击，导致域名解析出现错误；或者，在将所述域名解析信息传输至浏览器客户端的过程中，受到网络攻击，导致域名解析信息中的IP地址被篡改。这都会导致所述域名解析信息中包含的IP地址为错误的IP地址，从而导致浏览器客户端无法获取到正确的IP地址，从而无法获取所需的网页数据。再例如，在浏览器发出网页浏览请求后，网络中的节点将本次网页浏 览请求重定向至非法的目的地址，或者修改网络浏览请求对应的渠道号等。
本申请公开的网络攻击判断方法，应用于浏览器客户端，在该方法中，所述浏览器客户端在获取网络根据网页浏览请求返回的反馈信息后，将攻击规则与所述反馈信息进行匹配对比，根据对比结果判断所述网页浏览请求是否受到网络攻击，从而能够识别是否受到网络攻击。
进一步的，当通过检验域名解析信息来判断是否收到网络攻击时，所述将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：
首先、根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性。
然后、根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
通过上述操作，能够基于域名解析信息中包含的IP地址的合法性，确定网页浏览请求是否受到网络攻击。
另外，参见图3，所述根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性，包括以下步骤：
步骤S121、通过所述网页浏览请求，获取所述攻击规则中的目标攻击规则，其中，所述攻击规则中包含域名、IP地址和规则类型标识，所述目标攻击规则包含的域名与所述网页浏览请求待访问的域名相同。
其中，所述攻击规则中包含的规则类型标识用于表明该域名对应下的 IP地址是否合法，若所述规则类型标识为合法标识，则确定该域名对应的IP地址合法，若所述规则类型为非法标识，则确定该域名对应的IP地址非法。
步骤S122、遍历所述目标攻击规则，确定所述域名解析信息中包含的IP地址是否包含在所述目标攻击规则中，若是，执行步骤S123的操作，若否，执行步骤S124的操作。
步骤S123、若所述域名解析信息中包含的IP地址包含在所述目标攻击规则中，判断所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识是否为合法标识，若是，执行步骤S124的操作，若否，执行步骤S125的操作。
步骤S124、确定所述IP地址合法。
步骤S125、所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，确定所述IP地址非法。
上述步骤S121至步骤S125，公开一种根据攻击规则与域名信息，确定域名解析信息中包含的IP地址的合法性的方法。该方法中，在获取目标攻击规则后，若所述域名解析信息中包含的IP地址并未包含在所述目标攻击规则中，则确定所述域名解析信息中包含的IP地址合法，或者，若域名解析信息中包含的IP地址包含在所述目标攻击规则中，则进一步根据所述目标攻击规则确定所述域名解析信息中包含的IP地址是否合法，其中，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为合法标识，则确定所述IP地址合法，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，则确定所述 IP地址非法，从而能够根据攻击规则与域名解析信息，确定域名解析信息中包含的IP地址是否合法，以便根据所述IP地址是否合法，来确定网页浏览请求是否受到网络攻击。
其中，所述攻击规则可以为多种形式。在其中一种形式中，所述攻击规则的形式为：“域名|规则类型|IP地址”。其中，“|”起到分隔作用，规则类型可采用“0”和“1”，其中，“0”为非法标识，“1”为合法标识。当然，所述攻击规则还可以为其他任意包含有域名、规则类型和IP地址的形式，本申请对此不做限定，并且，规则类型包含合法标识和非法标识两种类型，这两种标识也可采用其他字符，本申请对此不做限定。
在以下陈述中，以一个攻击规则的具体实例说明根据攻击规则与域名解析信息，确定网页浏览请求是否受到网络攻击的工作流程。
在该攻击规则的示例中，设定其中一条攻击规则为“m.baidu.com|1|61.135.185.17”，另一条攻击规则为“m.baidu.com|0|61.135.185.18”，“0”为非法标识，“1”为合法标识，而网页浏览请求待访问的网页为百度网站，在获取网络根据网页浏览请求返回的域名解析信息后，获取攻击规则中的目标攻击规则，其中，所述目标攻击规则为包含有“m.baidu.com”这一域名的攻击规则，这种情况下，“m.baidu.com|1|61.135.185.17”和“m.baidu.com|0|61.135.185.18”均为目标攻击规则；然后，判断域名解析信息中包含的IP地址是否包含在各条目标攻击规则中，若所有目标攻击规则中均不包含所述域名解析信息中包含的IP地址，则确定所述域名解析信息中包含的IP地址合法，该网页浏览请求未受到网络攻击；若所述域名解析信息中包含的IP地址为 “61.135.185.17”，由于在目标攻击规则中，该IP地址对应的规则类型标识为合法标识，则确定该域名解析信息中包含的IP地址合法，网页浏览请求未受到网络攻击；若所述域名解析信息中包含的IP地址为“61.135.185.18”，由于在目标攻击规则中，该IP地址对应的规则类型标识为非法标识，则确定该域名解析信息中包含的IP地址是非法的，网页浏览请求受到网络攻击。
另外，浏览器客户端接收到的攻击规则往往有多条。其中，一个域名对应的攻击规则可能包含多条，这种情况下，同一域名对应的攻击规则可设置为“域名|规则类型1|IP地址1|规则类型2|IP地址2……|规则类型n|IP地址n”的形式，如“m.baidu.com|1|61.135.185.17|0|115.239.210.14”，这一攻击规则表示，若网页浏览请求待访问的域名为“m.baidu.com”，则解析出的“61.135.185.17”这一IP地址是合法的，解析出的“115.239.210.14”这一IP地址是非法的。
另外，不同域名的攻击规则可设置在一起，并采用分隔符隔开，例如，可设置成“域名1|规则类型1|IP地址1^^域名2|规则类型2|IP地址2……^^域名n|规则类型n|IP地址n”，其中“^^”为隔离不同域名的攻击规则的分隔符，当然，还可以选用其他形式的分隔符，本申请对此不做限定。这种情况下，“m.baidu.com|1|61.135.185.17|0|115.239.210.14^^m.sogou.com|0|202.91.232.39”这一攻击规则表示，若网页浏览请求待访问的域名为“m.baidu.com”，若域名解析信息中包含的IP地址为“61.135.185.17”，则该IP地址合法，网页浏览请求未受到网络攻击，若域名解析信息中包含 的IP地址为“115.239.210.14”，则该IP地址非法，网页浏览请求受到网络攻击。相应的，若网页浏览请求待访问的域名为“m.sogou.com”，且域名解析信息中包含的IP地址为“202.91.232.39”，则该IP地址非法，网页浏览请求受到网络攻击。
另外，若通过所述网页浏览请求，无法获取攻击规则中的目标攻击规则，也就是说，在攻击规则中，不存在目标攻击规则，这种情况下，通常认为所述域名解析信息中包含的IP地址合法，网页浏览请求未受到网络攻击。
上述内容介绍了通过检验域名解析信息来判断是否收到网络攻击，此外，如图4所示，当通过响应信息来判断是否受到网络攻击时，所述将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：
步骤S131、通过所述网页浏览请求，判断攻击规则中是否存在目标攻击规则，若是，执行步骤S132的操作，若否，执行步骤S135的操作。其中，所述攻击规则中包含篡改关键字、篡改前的信息表达式和篡改后的信息表达式，所述目标攻击规则包含的所述篡改前的信息表达式与所述网页浏览请求相对应。
步骤S132、若确定所述攻击规则中存在目标攻击规则，在获取所述目标攻击规则后，遍历所述目标攻击规则，判断所述响应信息中的响应头关键字是否与所述目标攻击规则中的篡改关键字相匹配，若是，执行步骤S133的操作，若否，执行步骤S135的操作。
所述响应信息包括响应头和响应头主体，并且，所述响应头由响应头 关键字和响应头内容构成。
另外，根据网络攻击类型的不同，篡改关键字不同。例如，若本次网络攻击是将网页浏览器对应的网址重定向至另一网址，以使浏览器客户端浏览被重定向后的网址，这种情况下，篡改关键字往往为“location”等字段。“location”等字段可以表示在网络攻击的类型为网址重定向时，网络浏览请求被重新定位到的网络地址。通常情况下，若所述响应头关键字中包含有该篡改关键字，则认为响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配。
步骤S133、若所述响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配，判断所述响应信息中的响应头内容是否与该条目标攻击规则中的篡改后的信息表达式相匹配，若是，执行步骤S134的操作，若否，执行步骤S135的操作。
步骤S134、若所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，确定所述网页浏览请求受到网络攻击。
其中，所述篡改后的信息表达式与所述篡改前的信息表达式不相同。
步骤S135、确定所述网页浏览请求未受到网络攻击。
通过步骤S131至步骤S135的操作，能够根据攻击规则与反馈信息，确定网页浏览请求是否受到网络攻击。根据上述操作可知，攻击规则中包含有篡改关键字、篡改前的信息表达式和篡改后的信息表达式，若某一攻击规则中，篡改前的信息表达式与网页浏览请求相对应，篡改关键字与所述响应信息中的响应头关键字相匹配，并且篡改后的信息表达式与响应信息中的响应头内容相匹配，则说明本次网页浏览请求受到网络攻击。
根据网络攻击的类型的不同，信息表达式也包括多种类型。例如，所述信息表达式为：URL地址表达式、渠道号表达式或媒体类型表达式，或者，所述信息表达式也可以为其他类型，本申请对此不做限定。
若篡改前的信息表达式和篡改后的信息表达式均为URL地址表达式，则说明受到网络攻击后，网页浏览请求的访问地址被重定向至其他的URL地址；若篡改前的信息表达式和篡改后的信息表达式均为渠道号表达式，则说明受到网络攻击后，网页浏览请求中的渠道号被篡改；若篡改前的信息表达式和篡改后的信息表达式均为媒体类型表达式，则说明受到网络攻击后，网页浏览请求中的媒体类型表达式被篡改。
例如，网页浏览请求表明本次待访问的网页页面为百度网站的页面，则目标攻击规则中包含的篡改前的信息表达式包含百度网站的URL地址，若响应头信息中的响应头关键字包含重定向关键字，所述响应头内容中包含的URL地址为其他网页的URL地址，并且与目标攻击规则中包含的篡改后的URL地址相匹配，则可以确定网页浏览请求受到网络攻击，网页浏览请求被重定向至其他网页页面，浏览器将无法访问百度网站。
在以下陈述中，以一个攻击规则的具体实例说明根据攻击规则与反馈信息，确定网页浏览请求是否受到网络攻击的工作流程。
在该攻击规则的示例中，设定该攻击规则为“rescode|301|location|.*m.baidu.com.*from＝1009719a|location|.*m.sogou.com.*”，其中，“rescode”、“301”和“location”为篡改关键字，“.*m.baidu.com.*from＝1009719a”为篡改前的信息表达式，“.*m.sogou.com.*”为篡改后的信息表达式，该信息表达式为URL(Uniform  Resource Locator，统一资源定位符)地址，并用“|”分隔，其中，“rescode”为“response code”的简写，表示网页浏览请求的服务器返回代码，“301”和“location”表示重定向，“.*m.baidu.com.*from＝1009719a”表示受到网络攻击前，浏览器客户端的目的是要访问百度网站，“.*m.sogou.com.*”表示受到网络攻击后，浏览器客户端被重定向至访问搜狗网站。
另外，本申请的第二实施例中，公开一种安全的网络数据传输方法，该方法应用于浏览器客户端。参见图5所示的工作流程示意图，所述安全的网络数据传输方法包括：
步骤S21、获取网络根据网页浏览请求返回的反馈信息。
当用户需要访问浏览器时，会对所述浏览器进行操作，如触控所述浏览器等，所述浏览器在接收到操作后，会产生相应的网页浏览请求，并由网络根据所述网页浏览请求返回相应的反馈信息。所述反馈在网络传输过程中，往往会受到网络攻击，导致所述浏览器客户端无法获取正确的反馈信息。网络攻击可能发生于网络中的不同节点，则所述反馈信息可以，但不限于为域名解析信息和网络根据所述网页浏览请求返回的响应信息。例如，若需要浏览网页，浏览器客户端会根据用户网页浏览请求的操作产生网页浏览请求，在将所述网页浏览请求传输至网页服务器之前，需要获取域名解析服务器对所述网页浏览请求的域名解析信息。所述响应信息可以由目标服务器返回，例如，若需要浏览网页，浏览器客户端会产生网页浏览请求，并将所述网页浏览请求传输至目标服务器，在传输过程中，网络会返回所述网页浏览请求对应的响应信息。
步骤S22、将获取到的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
当通过检验域名解析信息来判断是否受到网络攻击时，所述将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击时，可首先根据步骤S121至步骤S125的方法确定域名解析信息中包含的IP地址的合法性，然后再根据IP地址的合法性，确定网页浏览请求是否受到网络攻击，此处不再赘述。此外，当通过检验反馈信息来判断是否受到网络攻击时，所述将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击的方法，可参见步骤S131至步骤S135，此处不再赘述。
步骤S23、确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
上述步骤S21至步骤S23公开一种安全的网络数据传输方法，该方法中浏览器客户端在获取网络根据网页浏览请求返回的反馈信息后，将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果判断网页浏览请求是否受到网络攻击，并在根据对比结果，确定网页浏览请求受到网络攻击后，通过安全方式进行网络数据的传输；若根据对比结果，确定网页浏览请求未受到网络攻击，则按照传统技术进行网络数据的传输。通过安全方式进行网络数据的传输，能够避免网络攻击的侵害，从而解决现有技术中存在的，受到网络攻击后，网页浏览请求被篡改的问题，并且，能够减少安全隐患。
例如，当浏览器客户端在获取网络根据网页浏览请求返回的域名解析信息后，将预先获取的攻击规则与所述域名解析信息进行匹配对比，根据对比结果判断网页浏览请求是否受到网络攻击，并在根据对比结果，确定网页浏览请求受到网络攻击后，通过安全方式进行网络数据的传输；若根据对比结果，确定网页浏览请求未受到网络攻击，则根据域名解析信息获取待访问的IP地址，访问IP地址对应的目的服务器，进行网络数据的传输。通过安全方式进行网络数据的传输，能够避免网络攻击的侵害，从而解决现有技术中存在的，受到网络攻击后，浏览器客户端无法获取到正确的IP地址，进一步导致浏览器客户端无法获取所需的网页数据，导致用户无法浏览所需的信息的问题，能够使浏览器客户端显示网页浏览请求对应的网页数据，满足用户的浏览需求。
进一步的，步骤S23中所述的通过安全方式进行网络数据的传输，包括以下步骤：
首先，浏览器客户端将所述网页浏览请求加密后发送至代理服务器，以供所述代理服务器解密加密后的网页浏览请求后，对解密后的网页浏览请求进行域名解析，并访问与域名解析结果相对应的目标服务器，获取与所述解密后的网页浏览请求对应的网络数据，并且加密所述网络数据。
然后，接收所述代理服务器返回的加密后的网络数据。
浏览器客户端和代理服务器之间预先设置有私有协议，即预设协议，通过所述预设协议能够规定浏览器客户端和代理服务器之间的加解密方法。浏览器客户端根据与网络代理服务器之间的预设协议对网页浏览请求进行加密，并将加密后的网页浏览请求传输至代理服务器。所述代理服务 器在获取所述加密后的网页浏览请求后，根据预设协议进行解密，并在获取解密后的网页浏览请求后，对解密后的网页浏览请求进行域名解析，访问域名解析结果对应的目标服务器，在获取网络数据后，所述代理服务器根据预设协议加密所述网络数据，并将加密后的网络数据传输至浏览器客户端。所述浏览器客户端接收到加密后的网络数据后，根据预设协议对其进行解密，并显示解密后的网络数据，以便用户浏览。
由于浏览器客户端和代理服务器之间传输的数据经过加密，因此不会受到网络攻击的影响，从而能够使浏览器客户端获取到正确的网页数据。
另外，浏览器客户端在接收到所述规则配置服务器传输的攻击规则后，还可以对接收到的攻击规则进行格式解析，若经过格式解析，确定接收到的攻击规则不符合预设格式，则丢弃不符合预设格式的攻击规则。
例如，若每条攻击规则的形式设置为“域名|规则类型|IP地址”，浏览器客户端判断规则配置服务器传输的攻击规则若符合上述预设格式，若符合，则存储该条攻击规则；若不符合，则丢弃该条攻击规则，以节省存储空间。此外，在其中一种实现形式中，还可以设置每条攻击规则的格式为“key1|rule1|key2|rule2|keyn|rulen”的形式，n为自然数。若一条攻击规则为：“rescode|301|location|.*m.baidu.com.*from＝1009719a|location|.*m.sogou.com.*”，该条攻击规则表示，将访问“baidu.com”的网页浏览请求重定向至“sogou.com”这一目的地址。在该条攻击规则中，key1为rescode，rule1为301，key2为location，rule2为“.*m.baidu.com.*from＝1009719a”，key3为location，rule3为 “.*m.so.com.*”，并采用“|”进行间隔，则认为该条攻击规则符合格式。
这种情况下，浏览器客户端在接收到规则配置服务器传输的攻击规则后，判断该条攻击规则是否符合“key1|rule1|key2|rule2|keyn|rulen”的形式，若符合，则存储所述攻击规则，若不符合，则丢弃该条攻击规则，以节省存储空间。当然，在其他实现形式中，所述攻击规则还可以设置为其他的多种形式，如“key1：rule1；key2：rule2；keyn：rulen”等，本申请对此不做限定。
进一步的，本申请公开的所述安全的网络数据传输方法还包括：确定所述网页浏览请求受到网络攻击后，丢弃所述域名解析信息。
若网页浏览请求受到网络攻击，浏览器客户端接收到的域名解析信息会受到网络攻击的影响。例如，所述域名解析信息为网络根据所述网页浏览请求返回的域名解析信息，则所述域名解析信息中包含的IP地址往往是错误的。因此，丢弃所述域名解析信息，从而减少存储空间。
以下以多个具体例子描述本申请的优势：
在现有技术中，浏览器客户端在需要浏览百度网站时，有时会受到网络攻击，接收到错误的域名解析信息，所述错误的域名解析信息中包含的IP地址为360网站的IP地址。例如，浏览器客户端和域名服务器之间的一个网络节点发生DNS劫持，把域名解析服务器解析出的“m.baidu.com”这一域名对应的IP地址修改为360网站的IP地址。这种情况下，所述浏览器客户端会访问所述360网站。本申请公开的安全的网络数据传输方法，会根据攻击规则确定网页浏览请求受到网络攻击，从而通过安全方式进行网络数据的传输，使浏览器客户端能够访问到正确的百度网站。
另外，为了便于对比，浏览器客户端在接收到攻击规则后，可对攻击规则进行解析，使每条攻击规则形成如图6所示的数据结构，该数据结构为一种二维的数据结构。该二维的数据结构中，将各个域名作为索引，用于指示各个域名的规则列表。为了能够应对多种类型的攻击规则，规则配置服务器根据浏览器的访问需求配置有多条攻击规则，例如，浏览器在访问百度网站时，可能会碰到跳转至360网站或其他广告网站的网络攻击；浏览器在访问某一购物网站时，可能会碰到跳转至其他购物网站的网络攻击。规则配置器据此配置多条攻击规则，浏览器客户端在接收到该攻击规则后，可根据各条攻击规则包含的域名,将攻击规则解析为图6所示的二维的数据结构。
本申请公开的针对网络攻击的防护方法能够应用于多种应用场景，对多种类型的网络攻击进行防护。
在其中一种应用场景中，网络攻击使网页浏览请求中的目的地址被篡改，使其被重定向至非法目的地址。在现有技术中，浏览器客户端只能去访问被重定向的所述非法目的地址。而在本申请中，浏览器客户端能够识别该网络攻击，通过代理服务器获取所需的网页数据。例如，若该次网络攻击将访问百度的网页浏览请求，被重定向至访问360网站，这种情况下，响应信息中的响应头中包含如“301”或“302”，以及“location”等重定向字段，并包含有360网站的URL地址。浏览器客户端在接收到网络返回的响应信息后，根据网页浏览请求中包含的待访问的目的地址，及百度的URL地址，查找攻击规则中的目标攻击规则，其中，所述目标攻击规则中包含的篡改前的URL地址表达式与网页浏览请求中包含的百度的URL地址相对 应；然后，遍历目标攻击规则，判断响应头信息中的响应头关键字中是否与各条目标攻击规则中的篡改关键字相匹配，所述篡改关键字即为“301”或“302”，以及“location”等重定向字段。若响应信息中的响应头关键字与某一条或某几条目标攻击规则中的篡改关键字相匹配，则继续判断响应头内容是否与该目标攻击规则中的篡改后的信息表达式相匹配，篡改后的信息表达式为被重定向后的网站地址，在该例中，所述篡改后的信息表达式为360网站的URL地址，在所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配的情况下，则确定所述网页浏览请求受到网络攻击，网页浏览请求被篡改，使其重定向至360网站，需要通过安全代理服务器获取所需的网页数据，从而避免了网络攻击的影响。
在另一种应用场景中，一些非法运营商将正常的网页浏览请求重定向至自己的广告页面。现有技术中，浏览器只能够访问该运营商的广告。而本申请中，浏览器客户端能够识别这种状况，获取所需的网页数据。例如，造成印度尼西亚白屏的原因,就是因为运营商进行网络攻击，将用户正常的网页浏览请求，跳转到一个广告页面，而该广告加载比较慢，会有十几秒的白屏，从而出现白屏情况。这种情况下，若某一条或某几条攻击规则中包含的篡改前的URL地址表达式为网页浏览请求对应的目的地址，响应头关键字与其中一条目标攻击规则中的篡改关键字相对应，均包含“301”或“302”，以及“location”等重定向字段，并且，响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，均对应到该广告页面的URL地址，则确定网页浏览请求被重定向至广告页面，受到网络攻击，需要通过安全代理服务器获取所需的网页数据，从而使浏览器客户端显示正常的网 页数据，减少印度尼西亚的白屏情况。
在另一种应用场景中，一些非法商户在某些网络节点篡改网页浏览请求中包含的渠道号，达到自己盈利的目的。现有技术中，浏览器客户端只能任由渠道号被篡改，而本申请中，浏览器客户端能够识别这种状况。例如，某些商户将浏览器客户端访问百度的渠道号“from＝2001c”改为该商户自己的渠道号，这种情况下，若某一条或某几条攻击规则包含的篡改前的渠道号与该网页浏览请求中包含的渠道号相同，则确定该攻击规则为目标攻击规则，若响应信息的关键字与其中一条目标攻击规则中的篡改关键字相匹配，且响应头内容与该目标攻击规则中的篡改后的渠道号表达式相匹配，则确定本次网页浏览请求受到网络攻击，需要通过安全代理服务器获取所需的网页数据，从而避免了网络攻击的影响。
在本申请的第三实施例中，公开一种安全的网络数据传输方法，该方法应用于规则配置服务器。参见图7所示的工作流程示意图，所述安全的网络数据传输方法包括以下步骤：
步骤S31、根据接收到的操作，制定攻击规则。
步骤S32、获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址。
其中，步骤S31和步骤S32在执行时没有严格的时间顺序，也可同时执行，或者，先执行步骤S32的操作，再执行步骤S31的操作。
步骤S33、从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则。
在访问同一域名时，不同地区和运营商所对应的IP地址往往是不同的。 这种情况下，规则配置服务器需要根据网页浏览请求获取所述浏览器客户端待访问的IP地址，在制定攻击规则后，所述规则配置服务器从所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则。
步骤S34、将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
其中，所述浏览器客户端根据攻击规则判断是否受到网络攻击的方法，可首先根据步骤S121至步骤S125的方法确定域名解析信息中包含的IP地址的合法性，然后再根据IP地址的合法性，确定网页浏览请求是否受到网络攻击，此处不再赘述。
通过步骤S31至步骤S34的操作，规则配置服务器能够制定攻击规则，从中获取与浏览器客户端待访问的IP地址所指示的地区和运行商对应的攻击规则，并将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端。并且，所述浏览器客户端根据接收到的攻击规则判断是否受到网络攻击，在确定受到网络攻击的情况下，通过安全方式进行网络数据的传输，避免网络攻击的影响。
在本申请的第四实施例中，公开一种安全的网络数据传输方法，该方法应用于规则配置服务器。参见图8所示的工作流程示意图，所述安全的网络数据传输方法包括以下步骤：
步骤S41、根据接收到的操作，制定攻击规则。
该方法中，预先对各种类型的网络攻击进行统计分析，制定各种类型网络攻击对应的攻击规则。
步骤S42、将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
其中，所述浏览器客户端根据攻击规则判断是否受到网络攻击的方法，可参见步骤S131至步骤S135，此处不再赘述。
通过步骤S41至步骤S42的操作，规则配置服务器能够制定与各种类型的网络攻击相对应的攻击规则，并将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据接收到的攻击规则判断是否受到网络攻击，所述浏览器客户端在确定受到网络攻击的情况下，通过安全方式进行网络数据的传输，避免网络攻击的影响。
相应的，本申请的第五实施例中，公开一种网络攻击判断装置，所述网络攻击判断装置应用于浏览器客户端。参见图9示的结构示意图，所述网络攻击判断装置包括：反馈获取模块110和确定模块120。
所述反馈信息获取模块110，用于获取网络根据网页浏览请求返回的反馈信息；
所述确定模块120，用于将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
其中，所述反馈信息为网络根据所述网页浏览请求返回的响应信息。
作为一种实施方式，所述确定模块120可以包括：获取单元、第一确定单元、第二确定单元和第三确定单元。
其中，所述获取单元，用于通过所述网页浏览请求，获取攻击规则中的目标攻击规则，其中，所述攻击规则中包含篡改关键字、篡改前的信息 表达式和篡改后的信息表达式，所述目标攻击规则包含的所述篡改前的信息表达式与所述网页浏览请求相对应；
所述第一确定单元，用于遍历所述目标攻击规则，确定所述响应信息中的响应头关键字是否与所述目标攻击规则中的篡改关键字相匹配；
所述第二确定单元，用于若所述响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配，确定所述响应信息中的响应头内容是否与该条目标攻击规则中的篡改后的信息表达式相匹配；
所述第三确定单元，用于若所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，确定所述网页浏览请求受到网络攻击。
进一步的，所述信息表达式为：URL地址表达式、渠道号表达式或媒体类型表达式。
该实施例中，所述网络攻击判断装置获取规则配置服务器制定的攻击规则，并在获取网络根据网页浏览请求返回的反馈信息后，根据所述攻击规则与反馈信息的对比结果，确定所述网页浏览请求是否受到网络攻击，从而解决现有技术中，无法识别网络攻击的问题。
相应的，本申请的第六实施例中，公开一种网络攻击判断装置，所述网络攻击判断装置应用于浏览器客户端。参见图10示的结构示意图，所述网络攻击判断装置包括：域名解析信息获取模块130和确定模块140。
所述域名解析信息获取模块130，用于获取网络根据网页浏览请求返回的域名解析信息；
所述确定模块140，用于将获取到的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中， 所述攻击规则是由规则配置服务器发送的。
进一步的，所述确定模块140包括：IP地址合法性确定单元和网络攻击确定单元。
其中，IP地址合法性确定单元，用于根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；
所述网络攻击确定单元，用于根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
进一步的，所述IP地址合法性确定单元包括：目标攻击规则获取子单元、目标攻击规则遍历子单元、第一确定子单元和第二确定子单元。
其中，所述目标攻击规则获取子单元用于通过所述网页浏览请求，获取所述攻击规则中的目标攻击规则，其中，所述攻击规则中包含域名、IP地址和规则类型标识，所述目标攻击规则包含的域名与所述网页浏览请求待访问的域名相同；
所述目标攻击规则遍历子单元用于遍历所述目标攻击规则，确定所述域名解析信息中包含的IP地址是否包含在所述目标攻击规则中；
所述第一确定子单元，用于若所述域名解析信息中包含的IP地址未包含在所述目标攻击规则中，确定所述域名解析信息中包含的IP地址合法；
所述第二确定子单元，用于若所述域名解析信息中包含的IP地址包含在所述目标攻击规则中，根据所述目标攻击规则确定所述域名解析信息中包含的IP地址是否合法，其中，若所述域名解析信息中包含的IP地址在所 述目标攻击规则中对应的规则类型标识为合法标识，则确定所述IP地址合法，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，则确定所述IP地址非法。
该实施例中，所述网络攻击判断装置获取规则配置服务器制定的攻击规则，并在获取网络根据网页浏览请求返回的域名解析信息后，根据所述攻击规则与域名解析信息的对比结果，确定所述网页浏览请求是否受到网络攻击，从而解决现有技术中，无法识别网络攻击的问题。
相应的，本申请的第七实施例公开一种安全的网络数据传输装置，应用于浏览器客户端。参见图11所示的机构示意图，所述安全的网络数据传输装置包括：域名解析信息获取模块210、确定模块220和传输模块230。
其中，所述域名解析信息获取模块210，用于获取网络根据网页浏览请求返回的域名解析信息；
所述确定模块220，用于将获取到的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；
所述传输模块230，用于确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
进一步的，所述确定模块220包括：IP地址合法性确定单元和网络攻击确定单元。
其中，IP地址合法性确定单元，用于根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；
所述网络攻击确定单元，用于根据所述域名解析信息中包含的IP地址 的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
进一步的，所述IP地址合法性确定单元包括：目标攻击规则获取子单元、目标攻击规则遍历子单元、第一确定子单元和第二确定子单元。
其中，所述目标攻击规则获取子单元用于通过所述网页浏览请求，获取所述攻击规则中的目标攻击规则，其中，所述攻击规则中包含域名、IP地址和规则类型标识，所述目标攻击规则包含的域名与所述网页浏览请求待访问的域名相同；
所述目标攻击规则遍历子单元用于遍历所述目标攻击规则，确定所述域名解析信息中包含的IP地址是否包含在所述目标攻击规则中；
所述第一确定子单元，用于若所述域名解析信息中包含的IP地址未包含在所述目标攻击规则中，确定所述域名解析信息中包含的IP地址合法；
所述第二确定子单元，用于若所述域名解析信息中包含的IP地址包含在所述目标攻击规则中，根据所述目标攻击规则确定所述域名解析信息中包含的IP地址是否合法，其中，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为合法标识，则确定所述IP地址合法，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，则确定所述IP地址非法。
进一步的，所述传输模块230包括：发送单元和接收单元。
其中，所述发送单元，用于将所述网页浏览请求加密后发送至代理服务器，以供所述代理服务器解密加密后的网页浏览请求后，对解密后的网 页浏览请求进行域名解析，并访问与域名解析结果相对应的目标服务器，获取与所述解密后的网页浏览请求对应的网络数据，并且加密所述网络数据；
所述接收单元，用于接收所述代理服务器返回的加密后的网络数据。
进一步的，所述安全的网络数据传输装置还包括：丢弃模块，所述丢弃模块用于确定所述网页浏览请求受到网络攻击后，丢弃所述域名解析信息。
该实施例中，所述安全的网络数据传输装置获取规则配置服务器制定的攻击规则，并在获取网络根据网页浏览请求返回的域名解析信息后，根据所述攻击规则与域名解析信息的对比结果，根据对比结果判断网页浏览请求是否受到网络攻击，并在根据对比结果，确定网页浏览请求受到网络攻击后，通过安全方式进行网络数据的传输；若根据对比结果，确定网页浏览请求未受到网络攻击，则按照传统技术进行网络数据的传输。通过安全方式进行网络数据的传输，能够避免网络攻击的侵害，从而解决现有技术中存在的，受到网络攻击后，无法获取正确的IP地址，进一步导致浏览器客户端无法获取所需的网页数据，导致用户无法浏览所需的信息的问题，能够使浏览器客户端显示网页浏览请求对应的网页数据，满足用户的浏览需求。
相应的，申请的第八实施例公开一种安全的网络数据传输装置，应用于浏览器客户端。参见图12所示的结构示意图，所述安全的网络数据传输装置包括：反馈信息获取模块240、判断模块250和传输模块260。
其中，所述反馈信息获取模块240，用于向目标服务器发送网页浏览请 求后，获取网络根据所述网页浏览请求返回的反馈信息；
所述判断模块250，用于将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；
所述传输模块260，用于确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
其中，所述反馈信息通常为网络根据所述网页浏览请求返回的响应信息。
进一步的，所述判断模块220包括：获取单元、第一确定单元、第二确定单元和第三确定单元。
其中，所述获取单元，用于通过所述网页浏览请求，获取攻击规则中的目标攻击规则，其中，所述攻击规则中包含篡改关键字、篡改前的信息表达式和篡改后的信息表达式，所述目标攻击规则包含的所述篡改前的信息表达式与所述网页浏览请求相对应；
所述第一确定单元，用于遍历所述目标攻击规则，确定所述响应信息中的响应头关键字是否与所述目标攻击规则中的篡改关键字相匹配；
所述第二确定单元，用于若所述响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配，确定所述响应信息中的响应头内容是否与该条目标攻击规则中的篡改后的信息表达式相匹配；
所述第三确定单元，用于若所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，确定所述网页浏览请求受到网络攻击。
进一步的，所述传输模块260包括：发送单元和接收单元。
其中，所述发送单元，用于将网页浏览请求加密后发送至代理服务器，以供所述代理服务器解密所述加密后的网页浏览请求后，去目标服务器获取所述网页浏览请求对应的网络数据，并且加密所述网络数据；
所述接收单元，用于接收所述代理服务器返回的加密后的网络数据。
进一步的，所述安全的网络数据传输装置还包括：丢弃模块，所述丢弃模块用于确定所述网页浏览请求受到网络攻击后，丢弃所述反馈信息。
该实施例中，所述安全的网络数据传输装置获取规则配置服务器制定的攻击规则，并在获取网络根据网页浏览请求返回的反馈信息后，根据所述攻击规则与反馈信息的对比结果，根据对比结果判断网页浏览请求是否受到网络攻击，并在根据对比结果，确定网页浏览请求受到网络攻击后，通过安全方式进行网络数据的传输；若根据对比结果，确定网页浏览请求未受到网络攻击，则按照传统技术进行网络数据的传输。通过安全方式进行网络数据的传输，能够避免网络攻击的侵害，从而解决现有技术中存在的，受到网络攻击后，网页浏览请求被篡改的问题，并且，能够避免出现安全隐患。
相应的，申请的第九实施例公开一种安全的网络数据传输装置，所述安全的网络数据传输装置应用于规则配置服务器。参见图13所示的结构示意图，所述安全的网络数据传输装置包括：攻击规则制定模块310和攻击规则传输模块320。
其中，所述攻击规则制定模块310，用于根据接收到的操作，制定攻击规则；
所述攻击规则传输模块320，用于将所述攻击规则传输至浏览器客户 端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
通过所述安全的网络数据传输装置，能够制定与各种类型的网络攻击相对应的攻击规则，并将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据接收到的攻击规则判断是否受到网络攻击，所述浏览器客户端在确定受到网络攻击的情况下，通过安全方式进行网络数据的传输，避免网络攻击的影响。
相应的，申请的第十实施例公开一种安全的网络数据传输装置，所述安全的网络数据传输装置应用于规则配置服务器。参见图14示的结构示意图，所述安全的网络数据传输装置包括：攻击规则制定模块340、IP地址获取模块350、攻击规则查询模块360和攻击规则传输模块370。
其中，所述攻击规则制定模块340，用于根据接收到的操作，制定攻击规则；
所述IP地址获取模块350，用于获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址；
所述攻击规则查询模块360，用于从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则；
所述攻击规则传输模块370，用于将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
通过所述安全的网络数据传输装置，能够制定攻击规则，并能够根据地区和运营商，确定与待访问的IP地址对应的攻击规则，将所述IP地址对应的攻击规则传输至浏览器，以便所述浏览器客户端根据接收到的攻击规 则判断是否受到网络攻击，所述浏览器客户端在确定受到网络攻击的情况下，通过安全方式进行网络数据的传输，避免网络攻击的影响。
本申请的第十实施例公开一种针对网络攻击的防护系统。参见图9所示的结构示意图，所述针对网络攻击的防护系统包括：规则配置服务器100、用户终端200，以及代理服务器300，所述用户终端200设置有浏览器客户端。
其中，所述规则配置服务器100用于根据接收到的操作，制定攻击规则，并将所述攻击规则传输至用户终端200的浏览器客户端；
作为一种实施方式，所述规则配置服务器，可以用于根据接收到的操作，制定攻击规则，获取用户终端的浏览器客户端传输的网页浏览请求，根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址，用于从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则，并将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端。
所述用户终端的浏览器客户端用于获取网络根据网页浏览请求返回的反馈信息后，将所述攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击，则与所述代理服务器之间通过安全方式进行网络数据的传输。
作为一种实施方式，所述用户终端的浏览器客户端，可以用于获取网络根据网页浏览请求返回的域名解析信息，并将所述规则配置服务器传输的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击，则与所述代理服务器之间通过安全方式进行网络数据的传输。
在通过安全方式进行网络数据的传输时，所述用户终端200的浏览器客户端按照与代理服务器300之间的预设协议，对网页浏览请求加密，并将加密后的网页浏览请求传输至所述代理服务器300，所述代理服务器300接收加密后的网页浏览请求后，根据所述预设协议对所述加密后的网页浏览请求进行解密，并将解密后的网页浏览请求传输至目标服务器，通过目标服务器获取与所述解密后的网页浏览请求相对应的网页数据，然后根据所述预设协议将网页数据加密后传输至所述用户终端200的浏览器客户端。所述浏览器客户端根据所述预设协议解密所述网页数据后，显示与解密后的网页数据相对应的网页内容。
该实施例公开的网络攻击的防护系统能够判断网页浏览请求是否受到网络攻击，并在确定受到网络攻击的情况下，浏览器客户端和代理服务器之间通过安全通道进行网络数据的传输，从而不会受到网络攻击的影响。进一步的，还能够减少网络攻击带来的安全隐患。
该实施例公开的网络攻击的防护系统能够判断网页浏览请求是否受到网络攻击，并在确定受到网络攻击的情况下，浏览器客户端和代理服务器之间通过安全通道进行网络数据的传输，从而不会受到网络攻击的影响。进一步的，还能够减少网络攻击带来的安全隐患。
另外，浏览器客户端和代理服务器之间传输数据的通道，可命名为安全代理通道。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
此外，根据本发明的方法还可以实现为一种计算机程序产品，该计算 机程序产品包括具有处理器可执行的非易失的程序代码的计算机可读介质。在该计算机可读介质上存储有用于执行本发明的方法中限定的上述功能的计算机程序。例如，可以执行获取网络根据网页浏览请求返回的反馈信息；将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明的其它实施方案。本申请旨在涵盖本发明的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明的真正范围和精神由下面的权利要求指出。
应当理解的是，本发明并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明的范围仅由所附的权利要求来限制。

Claims (21)

  1. 一种网络攻击判断方法，其特征在于，应用于浏览器客户端，所述网络攻击判断方法包括：
    获取网络根据网页浏览请求返回的反馈信息；
    将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
  2. 根据权利要求1所述的方法，其特征在于，所述反馈信息为域名解析信息。
  3. 根据权利要求2所述的方法，其特征在于，所述将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：
    根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；
    根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性，包括：
    通过所述网页浏览请求，获取所述攻击规则中的目标攻击规则，其中， 所述攻击规则中包含域名、IP地址和规则类型标识，所述目标攻击规则包含的域名与所述网页浏览请求待访问的域名相同；
    遍历所述目标攻击规则，确定所述域名解析信息中包含的IP地址是否包含在所述目标攻击规则中；
    若所述域名解析信息中包含的IP地址未包含在所述目标攻击规则中，确定所述域名解析信息中包含的IP地址合法；
    若所述域名解析信息中包含的IP地址包含在所述目标攻击规则中，根据所述目标攻击规则确定所述域名解析信息中包含的IP地址是否合法，其中，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为合法标识，则确定所述IP地址合法，若所述域名解析信息中包含的IP地址在所述目标攻击规则中对应的规则类型标识为非法标识，则确定所述IP地址非法。
  5. 根据权利要求1所述的方法，其特征在于，所述反馈信息为网络根据所述网页浏览请求返回的响应信息。
  6. 根据权利要求5所述的方法，其特征在于，所述将预先获取的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，包括：
    通过所述网页浏览请求，获取攻击规则中的目标攻击规则，其中，所述攻击规则中包含篡改关键字、篡改前的信息表达式和篡改后的信息表达式，所述目标攻击规则包含的所述篡改前的信息表达式与所述网页浏览请求相对应；
    遍历所述目标攻击规则，确定所述响应信息中的响应头关键字是否与 所述目标攻击规则中的篡改关键字相匹配；
    若所述响应信息中的响应头关键字与所述目标攻击规则中的篡改关键字相匹配，确定所述响应信息中的响应头内容是否与该条目标攻击规则中的篡改后的信息表达式相匹配；
    若所述响应头内容与该条目标攻击规则中的篡改后的信息表达式相匹配，确定所述网页浏览请求受到网络攻击。
  7. 根据权利要求6所述的方法，其特征在于，
    所述信息表达式为：URL地址表达式、渠道号表达式或媒体类型表达式。
  8. 一种安全的网络数据传输方法，其特征在于，应用于浏览器客户端，所述安全的网络数据传输方法包括：
    获取网络根据网页浏览请求返回的反馈信息；
    将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；
    确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
  9. 根据权利要求8所述的方法，其特征在于，所述通过安全方式进行网络数据的传输包括：
    将所述网页浏览请求加密后发送至代理服务器，以供所述代理服务器解密加密后的网页浏览请求后，对解密后的网页浏览请求进行域名解析，并访问与域名解析结果相对应的目标服务器，获取与所述解密后的网页浏览请求对应的网络数据，并且加密所述网络数据；
    接收所述代理服务器返回的加密后的网络数据。
  10. 根据权利要求8所述的方法，其特征在于，所述安全的网络数据传输方法还包括：
    确定所述网页浏览请求受到网络攻击后，丢弃所述域名解析信息。
  11. 一种安全的网络数据传输方法，其特征在于，应用于规则配置服务器，所述安全的网络数据传输方法包括：
    根据接收到的操作，制定攻击规则；
    将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
  12. 根据权利要求11所述的方法，其特征在于，所述将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击，包括：
    获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址；
    从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则；
    将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
  13. 一种网络攻击判断装置，其特征在于，应用于浏览器客户端，所述网络攻击判断装置包括：
    反馈信息获取模块，用于获取网络根据网页浏览请求返回的反馈信息；
    确定模块，用于将获取到的攻击规则与所述反馈信息进行匹配对比， 根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
  14. 根据权利要求13所述的装置，其特征在于，所述反馈信息为域名解析信息或响应信息。
  15. 根据权利要求13所述的装置，其特征在于，所述确定模块包括：
    IP地址合法性确定单元，用于根据所述攻击规则与所述域名解析信息，确定所述域名解析信息中包含的IP地址的合法性；
    网络攻击确定单元，用于根据所述域名解析信息中包含的IP地址的合法性，确定所述网页浏览请求是否受到网络攻击，其中，若所述IP地址合法，则确定所述网页浏览请求未受到网络攻击，若所述IP地址非法，则确定所述网页浏览请求受到网络攻击。
  16. 一种安全的网络数据传输装置，其特征在于，应用于浏览器客户端，所述安全的网络数据传输装置包括：
    反馈信息获取模块，用于获取网络根据网页浏览请求返回的反馈信息；
    确定模块，用于将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的；
    传输模块，用于确定所述网页浏览请求受到网络攻击，则通过安全方式进行网络数据的传输。
  17. 一种安全的网络数据传输装置，其特征在于，应用于规则配置服务器，所述安全的网络数据传输装置包括：
    攻击规则制定模块，用于根据接收到的操作，制定攻击规则；
    攻击规则传输模块，用于将所述攻击规则传输至浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
  18. 根据权利要求17所述的装置，其特征在于，所述攻击规则传输模块，具体用于获取浏览器客户端传输的网页浏览请求，并根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址；从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则；将所述IP地址指示的地区和运营商对应的攻击规则传输至所述浏览器客户端，以便所述浏览器客户端根据所述攻击规则判断是否受到网络攻击。
  19. 一种安全的网络数据传输系统，其特征在于，包括：规则配置服务器、代理服务器以及用户终端，所述用户终端设置有浏览器客户端，其中，
    所述规则配置服务器用于根据接收到的操作，制定攻击规则，并将所述攻击规则传输至用户终端的浏览器客户端；
    所述用户终端的浏览器客户端用于获取网络根据网页浏览请求返回的反馈信息后，将所述攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击，则与所述代理服务器之间通过安全方式进行网络数据的传输。
  20. 根据权利要求19所述的系统，其特征在于，所述规则配置服务器，具体用于根据接收到的操作，制定攻击规则，获取用户终端的浏览器客户端传输的网页浏览请求，根据所述网页浏览请求获取所述浏览器客户端待访问的IP地址，用于从制定的所述攻击规则中，查询所述IP地址指示的地区和运营商对应的攻击规则，并将所述IP地址指示的地区和运营商对应的 攻击规则传输至所述浏览器客户端；
    所述用户终端的浏览器客户端，具体用于获取网络根据网页浏览请求返回的域名解析信息，并将所述规则配置服务器传输的攻击规则与所述域名解析信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，若确定所述网页浏览请求受到网络攻击，则与所述代理服务器之间通过安全方式进行网络数据的传输。
  21. 一种具有处理器可执行的非易失的程序代码的计算机可读介质，所述程序代码在被所述处理器执行时使所述处理器执行以下方法：
    获取网络根据网页浏览请求返回的反馈信息；
    将获取到的攻击规则与所述反馈信息进行匹配对比，根据对比结果确定所述网页浏览请求是否受到网络攻击，其中，所述攻击规则是由规则配置服务器发送的。
PCT/CN2016/078843 2015-07-15 2016-04-08 网络攻击判断方法、安全的网络数据传输方法及相应装置 WO2017008543A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
RU2017114862A RU2685994C1 (ru) 2015-07-15 2016-04-08 Способ оценки сетевой атаки, способ безопасной передачи данных сети и соответствующее устройство
US15/505,835 US10574673B2 (en) 2015-07-15 2016-04-08 Network attack determination method, secure network data transmission method, and corresponding apparatus
US16/773,910 US11277418B2 (en) 2015-07-15 2020-01-27 Network attack determination method, secure network data transmission method, and corresponding apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201510416040.9 2015-07-15
CN201510416040.9A CN106341376A (zh) 2015-07-15 2015-07-15 网络攻击判断方法、安全的网络数据传输方法及相应装置
CN201510416039.6A CN106385395B (zh) 2015-07-15 2015-07-15 网络攻击判断方法、安全的网络数据传输方法及相应装置
CN201510416039.6 2015-07-15

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US15/505,835 A-371-Of-International US10574673B2 (en) 2015-07-15 2016-04-08 Network attack determination method, secure network data transmission method, and corresponding apparatus
US16/773,910 Continuation US11277418B2 (en) 2015-07-15 2020-01-27 Network attack determination method, secure network data transmission method, and corresponding apparatus

Publications (1)

Publication Number Publication Date
WO2017008543A1 true WO2017008543A1 (zh) 2017-01-19

Family

ID=57756814

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/078843 WO2017008543A1 (zh) 2015-07-15 2016-04-08 网络攻击判断方法、安全的网络数据传输方法及相应装置

Country Status (3)

Country Link
US (2) US10574673B2 (zh)
RU (1) RU2685994C1 (zh)
WO (1) WO2017008543A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109800376A (zh) * 2018-12-21 2019-05-24 沈阳通用软件有限公司 一种通用的网页审计方法
CN110430288A (zh) * 2019-09-16 2019-11-08 腾讯科技（深圳）有限公司 节点访问方法、装置、计算机设备和存储介质
CN111355694A (zh) * 2018-12-24 2020-06-30 卓望数码技术（深圳）有限公司 一种网络数据校验方法、装置及系统
CN111600840A (zh) * 2020-04-16 2020-08-28 五八有限公司 一种dns劫持的处理方法及装置
CN112953907A (zh) * 2021-01-28 2021-06-11 中国工商银行股份有限公司 一种攻击行为的识别方法及装置
CN113206785A (zh) * 2021-05-28 2021-08-03 深圳市中科明望通信软件有限公司 网络请求方法及装置、终端设备、存储介质
CN115694885A (zh) * 2022-09-14 2023-02-03 华能信息技术有限公司 一种数据安全策略管理方法及系统

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11050783B2 (en) * 2018-01-31 2021-06-29 International Business Machines Corporation System and method for detecting client participation in malware activity
US10616255B1 (en) * 2018-02-20 2020-04-07 Facebook, Inc. Detecting cloaking of websites using content model executing on a mobile device
US11386214B2 (en) * 2018-12-13 2022-07-12 Sap Se Web application execution with secure element extension
US10824770B2 (en) * 2018-12-13 2020-11-03 Sap Se Web application execution with secure elements
US11539738B1 (en) * 2020-03-24 2022-12-27 Mcafee, Llc Methods, systems, and media for mitigating damage resulting from a website being an intermediary in a cyberattack
CN113177191A (zh) * 2021-04-16 2021-07-27 中国人民解放军战略支援部队信息工程大学 基于模糊匹配的固件函数相似性检测方法及系统
CN113194108B (zh) * 2021-07-02 2021-09-24 北京华云安信息技术有限公司 攻击工具选择方法、装置、设备和计算机可读存储介质
CN114039796B (zh) * 2021-11-26 2023-08-22 安天科技集团股份有限公司 网络攻击的确定方法、装置、计算机设备及存储介质
CN114173390B (zh) * 2021-12-06 2024-01-19 深圳Tcl新技术有限公司 网络控制方法、装置、电子设备及存储介质
CN116614321B (zh) * 2023-07-20 2023-10-20 北京立思辰安科技术有限公司 一种用于网络攻击的界面展示方法、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120304275A1 (en) * 2011-05-24 2012-11-29 International Business Machines Corporation Hierarchical rule development and binding for web application server firewall
CN103532912A (zh) * 2012-07-04 2014-01-22 中国电信股份有限公司 浏览器业务数据的处理方法和装置
CN104239577A (zh) * 2014-10-09 2014-12-24 北京奇虎科技有限公司 检测网页数据真伪的方法和装置
CN104348789A (zh) * 2013-07-30 2015-02-11 中国银联股份有限公司 用于防止跨站脚本攻击的Web服务器及方法

Family Cites Families (41)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7953671B2 (en) 1999-08-31 2011-05-31 American Express Travel Related Services Company, Inc. Methods and apparatus for conducting electronic transactions
US7685631B1 (en) * 2003-02-05 2010-03-23 Microsoft Corporation Authentication of a server by a client to prevent fraudulent user interfaces
US8375120B2 (en) * 2005-11-23 2013-02-12 Trend Micro Incorporated Domain name system security network
US7934253B2 (en) 2006-07-20 2011-04-26 Trustwave Holdings, Inc. System and method of securing web applications across an enterprise
US9654495B2 (en) 2006-12-01 2017-05-16 Websense, Llc System and method of analyzing web addresses
US7865589B2 (en) 2007-03-12 2011-01-04 Citrix Systems, Inc. Systems and methods for providing structured policy expressions to represent unstructured data in a network appliance
US8490148B2 (en) 2007-03-12 2013-07-16 Citrix Systems, Inc Systems and methods for managing application security profiles
US7853678B2 (en) 2007-03-12 2010-12-14 Citrix Systems, Inc. Systems and methods for configuring flow control of policy expressions
KR100995904B1 (ko) * 2007-12-18 2010-11-23 한국전자통신연구원 웹 서비스 방법 및 그 장치
US20100037317A1 (en) 2008-08-06 2010-02-11 Jeong Wook Oh Mehtod and system for security monitoring of the interface between a browser and an external browser module
US8811965B2 (en) * 2008-10-14 2014-08-19 Todd Michael Cohan System and method for automatic data security back-up and control for mobile devices
WO2010105184A2 (en) 2009-03-13 2010-09-16 Breach Security , Inc. A method and apparatus for phishing and leeching vulnerability detection
US8607340B2 (en) 2009-07-21 2013-12-10 Sophos Limited Host intrusion prevention system using software and user behavior analysis
US8510411B2 (en) * 2010-05-06 2013-08-13 Desvio, Inc. Method and system for monitoring and redirecting HTTP requests away from unintended web sites
US8631489B2 (en) * 2011-02-01 2014-01-14 Damballa, Inc. Method and system for detecting malicious domain names at an upper DNS hierarchy
RU2480937C2 (ru) * 2011-04-19 2013-04-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ уменьшения ложных срабатываний при определении сетевой атаки
CN102761500B (zh) 2011-04-26 2015-07-29 国基电子（上海）有限公司 防御网络钓鱼的网关及方法
CN102801574B (zh) * 2011-05-27 2016-08-31 阿里巴巴集团控股有限公司 一种网页链接的检测方法、装置和系统
US20140380477A1 (en) * 2011-12-30 2014-12-25 Beijing Qihoo Technology Company Limited Methods and devices for identifying tampered webpage and inentifying hijacked web address
US9609020B2 (en) 2012-01-06 2017-03-28 Optio Labs, Inc. Systems and methods to enforce security policies on the loading, linking, and execution of native code by mobile applications running inside of virtual machines
US9565120B2 (en) * 2012-01-30 2017-02-07 Broadcom Corporation Method and system for performing distributed deep-packet inspection
US8613089B1 (en) * 2012-08-07 2013-12-17 Cloudflare, Inc. Identifying a denial-of-service attack in a cloud-based proxy service
CN102902928B (zh) 2012-09-21 2017-02-15 杭州迪普科技有限公司 一种网页防篡改方法及装置
CN102957694B (zh) * 2012-10-25 2016-08-31 北京奇虎科技有限公司 一种判断钓鱼网站的方法及装置
US10164989B2 (en) * 2013-03-15 2018-12-25 Nominum, Inc. Distinguishing human-driven DNS queries from machine-to-machine DNS queries
US8739243B1 (en) * 2013-04-18 2014-05-27 Phantom Technologies, Inc. Selectively performing man in the middle decryption
US8997232B2 (en) * 2013-04-22 2015-03-31 Imperva, Inc. Iterative automatic generation of attribute values for rules of a web application layer attack detector
US9160718B2 (en) * 2013-05-23 2015-10-13 Iboss, Inc. Selectively performing man in the middle decryption
CN104219200B (zh) 2013-05-30 2017-10-17 杭州迪普科技股份有限公司 一种防范dns缓存攻击的装置和方法
US9973534B2 (en) 2013-11-04 2018-05-15 Lookout, Inc. Methods and systems for secure network connections
CN103605926A (zh) 2013-11-29 2014-02-26 北京奇虎科技有限公司 一种网页篡改的检测方法及装置
CN103744802B (zh) 2013-12-20 2017-05-24 北京奇安信科技有限公司 Sql注入攻击的识别方法及装置
CN103701804A (zh) * 2013-12-26 2014-04-02 北京奇虎科技有限公司 网络购物环境安全性检测方法及装置
CN104954346B (zh) 2014-03-31 2018-12-18 北京奇安信科技有限公司 基于对象分析的攻击识别方法及装置
US20150333930A1 (en) * 2014-05-15 2015-11-19 Akamai Technologies, Inc. Dynamic service function chaining
CN105338123B (zh) * 2014-05-28 2018-10-02 国际商业机器公司 用于在网络中解析域名的方法、装置和系统
US20160006760A1 (en) * 2014-07-02 2016-01-07 Microsoft Corporation Detecting and preventing phishing attacks
CN104079673B (zh) 2014-07-30 2018-12-07 北京奇虎科技有限公司 一种应用下载中防止dns劫持的方法、装置和系统
WO2016018369A1 (en) * 2014-07-31 2016-02-04 Hewlett-Packard Development Company, L.P. Remediating a security threat to a network
WO2016025827A1 (en) * 2014-08-15 2016-02-18 Interdigital Patent Holdings, Inc. Edge caching of https content via certificate delegation
CN104468865B (zh) 2014-12-25 2019-03-05 北京奇虎科技有限公司 域名解析控制、响应方法及相应的装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120304275A1 (en) * 2011-05-24 2012-11-29 International Business Machines Corporation Hierarchical rule development and binding for web application server firewall
CN103532912A (zh) * 2012-07-04 2014-01-22 中国电信股份有限公司 浏览器业务数据的处理方法和装置
CN104348789A (zh) * 2013-07-30 2015-02-11 中国银联股份有限公司 用于防止跨站脚本攻击的Web服务器及方法
CN104239577A (zh) * 2014-10-09 2014-12-24 北京奇虎科技有限公司 检测网页数据真伪的方法和装置

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109800376A (zh) * 2018-12-21 2019-05-24 沈阳通用软件有限公司 一种通用的网页审计方法
CN111355694A (zh) * 2018-12-24 2020-06-30 卓望数码技术（深圳）有限公司 一种网络数据校验方法、装置及系统
CN111355694B (zh) * 2018-12-24 2022-06-07 卓望数码技术（深圳）有限公司 一种网络数据校验方法、装置及系统
CN110430288A (zh) * 2019-09-16 2019-11-08 腾讯科技（深圳）有限公司 节点访问方法、装置、计算机设备和存储介质
CN110430288B (zh) * 2019-09-16 2022-07-29 腾讯科技（深圳）有限公司 节点访问方法、装置、计算机设备和存储介质
CN111600840A (zh) * 2020-04-16 2020-08-28 五八有限公司 一种dns劫持的处理方法及装置
CN111600840B (zh) * 2020-04-16 2022-03-04 五八有限公司 一种dns劫持的处理方法及装置
CN112953907A (zh) * 2021-01-28 2021-06-11 中国工商银行股份有限公司 一种攻击行为的识别方法及装置
CN112953907B (zh) * 2021-01-28 2023-08-08 中国工商银行股份有限公司 一种攻击行为的识别方法及装置
CN113206785A (zh) * 2021-05-28 2021-08-03 深圳市中科明望通信软件有限公司 网络请求方法及装置、终端设备、存储介质
CN115694885A (zh) * 2022-09-14 2023-02-03 华能信息技术有限公司 一种数据安全策略管理方法及系统

Also Published As

Publication number Publication date
US20200162490A1 (en) 2020-05-21
US11277418B2 (en) 2022-03-15
US10574673B2 (en) 2020-02-25
RU2685994C1 (ru) 2019-04-23
US20170279823A1 (en) 2017-09-28

Similar Documents

Publication Publication Date Title
WO2017008543A1 (zh) 网络攻击判断方法、安全的网络数据传输方法及相应装置
US11487903B2 (en) Systems and methods for controlling data exposure using artificial-intelligence-based modeling
US8676878B2 (en) Domain managing method, domain extending method and reference point controller electing method
US8051484B2 (en) Method and security system for indentifying and blocking web attacks by enforcing read-only parameters
US9712532B2 (en) Optimizing security seals on web pages
US20090063629A1 (en) Data transfer controlling method, content transfer controlling method, content processing information acquisition method and content transfer system
CN107046544B (zh) 一种识别对网站的非法访问请求的方法和装置
EP3830726B1 (en) Content policy based notification of application users about malicious browser plugins
US11785049B2 (en) Methods and systems for network security and privacy protection
US9258115B2 (en) Securing information exchanged via a network
CN113645226B (zh) 一种基于网关层的数据处理方法、装置、设备及存储介质
CN110113440B (zh) 一种请求响应方法、装置及终端
US20210126922A1 (en) Method and system to rate limit access to data endpoints with potential privacy risk
US20210075817A1 (en) Method and system for variable or static rate limiting of javascript functions with potential for privacy risk
CN109495362B (zh) 一种接入认证方法及装置
CN106385395B (zh) 网络攻击判断方法、安全的网络数据传输方法及相应装置
US20210136038A1 (en) Method and system for web filtering implementation consisting of integrated web extension and connected hardware device
US10764250B2 (en) Method and system for first party and third party detection and for the occlusion of network device TLS signatures
CN107026828A (zh) 一种基于互联网缓存的防盗链方法及互联网缓存
CN107667518B (zh) 电子设备的自动发现和上线
KR101792235B1 (ko) 네트워크 프린터의 취약점 점검 방법 및 시스템
CN106341376A (zh) 网络攻击判断方法、安全的网络数据传输方法及相应装置
WO2023160299A1 (zh) 一种设备物理身份认证方法、系统、装置及第一平台
US20210400083A1 (en) Method and system for privacy and security policy delivery
CN112260991B (zh) 一种鉴权管理方法和装置

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 15505835

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16823690

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017114862

Country of ref document: RU

122 Ep: pct application non-entry in european phase

Ref document number: 16823690

Country of ref document: EP

Kind code of ref document: A1