WO2017059778A1

WO2017059778A1 - Method, device and system for detecting shell website

Info

Publication number: WO2017059778A1
Application number: PCT/CN2016/100734
Authority: WO
Inventors: 戚宏伟
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-10-08
Filing date: 2016-09-29
Publication date: 2017-04-13
Also published as: CN106571971B; CN106571971A

Abstract

Disclosed are a method, device and system for detecting a shell website. The method comprises: extracting a plurality of websites to be detected; invoking one or more shell website detection conditions from a website detection condition set, and using the one or more shell website detection conditions to determine whether any one website is a shell website; and outputting a website, of which a detection result is the shell website. The present invention solves the technical problem in the prior art that the easy occurrence of missing detection due to the use of the solution of performing artificial distinguishing to detect and clear a shell website results in a low accuracy rate of a detection result of the shell website.

Description

Method, device and system for detecting empty shell website

The present application claims the priority of the Chinese Patent Application No. 20151064692, filed on Oct. 08, 2015, the entire disclosure of which is incorporated herein by reference.

Technical field

The present invention relates to the field of computers, and in particular to a method, device and system for detecting a shell website.

Background technique

The empty shell website means that in the industrial and informational filing system, the historical record information of the sponsor of the website contains the main body information and the website information, but there is no access information (that is, the website only has the record number, but the actual use space IP address of the website changes. The website sponsor did not transfer the filing information to the new access service provider.)

For example, Alibaba Cloud as a website access service provider, the organizer of the website "website" submitted a filing application to the Ministry of Industry and Information Technology through the Alibaba Cloud filing system, and obtained the registration number of the website issued by the Ministry of Industry and Information Technology. Under normal circumstances, the website " The website data of the website will be stored in the virtual space provided by Alibaba Cloud. However, the organizer of the website "website" privately selects the IP address of the changed access service provider, that is, the organizer of the website "website" has changed the access privately. At the same time, the sponsor of the website "website" did not transfer the filing information to the new access service provider. In the filing system of Alibaba Cloud and the filing information recorded in the system of the Ministry of Industry and Information, the website "website" The access provider is still Alibaba Cloud. In fact, the website “website” does not use any products of Alibaba Cloud. Then, the website “website” is a shell website for the access service provider Alibaba Cloud.

In the existing detection technology of the empty shell website, it is often used to identify the empty shell website, that is, according to the experience of the customer service personnel of the access provider, the empty shell website is found, and then the empty shell website is cleaned up.

It should be noted that the above problems occur after manually detecting the empty shell website:

(1) In the case that the number of websites registered through the accessor's filing system exceeds a certain number, the manual detection of the empty shell website is likely to be missed, resulting in a low accuracy rate of the shell website detection results.

(2) Manual detection of empty shell websites takes a long period of time and is inefficient, which cannot meet the demand.

In view of the above-mentioned prior art, the manual resolution method for detecting and cleaning the empty shell website is easy to miss, which leads to the technical problem of low accuracy of the detection result of the empty shell website, and no effective solution has been proposed yet.

Summary of the invention

The embodiment of the invention provides a method, a device and a system for detecting a shell website, so as to at least solve the problem that the prior art adopts a manual resolution method to detect and clean the shell website, which is easy to miss detection, resulting in the detection result of the shell website. Technical problems with low accuracy.

According to an aspect of an embodiment of the present invention, a method for detecting a empty shell website includes: extracting a plurality of websites to be detected; calling one or more empty shell website detection conditions from the website detection condition set, and using one Or multiple empty shell website detection conditions to determine whether any website is a shell website; the output test results are the website of the empty shell website.

According to another aspect of the embodiments of the present invention, there is provided an apparatus for detecting a private website, comprising: an extracting unit, configured to extract a plurality of websites to be detected; and an invoking unit, configured to invoke one from the website detecting condition set Or multiple empty shell websites detect conditions and use one or more empty shell website detection conditions to determine whether any one website is an empty shell website; an output unit for outputting a website whose detection result is a shell website.

According to another aspect of the embodiments of the present invention, a system for detecting a shell website is further provided, including: a record server for storing information of a plurality of websites; a detection server, establishing a communication relationship with the record server, for recording from the record The server extracts multiple websites to be detected, invokes one or more empty shell website detection conditions from the website detection condition collection, and uses one or more empty shell website detection conditions to determine whether any one website is an empty shell website; The server is also used to output a website whose detection result is an empty shell website.

In the embodiment of the present invention, a plurality of websites to be detected are extracted; one or more empty website detection conditions are invoked from the website detection condition set, and one or more empty website detection conditions are used to determine whether any one website is It is an empty shell website; the output test results are the website of the empty shell website. The technical problem that the prior art adopts the manual resolution method to detect and clean the empty shell website is easy to miss, which leads to the low accuracy of the detection result of the empty shell website.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a block diagram showing the hardware structure of a method for detecting a shell website according to an embodiment of the present invention;

2 is a flow chart of a method of detecting a empty shell website in accordance with an embodiment of the present invention;

3 is a schematic diagram of an apparatus for detecting a shell website according to an embodiment of the present invention;

4 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

5 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

6 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

7 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

8 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

9 is a schematic diagram of an optional apparatus for detecting a shell website, in accordance with an embodiment of the present invention;

10 is a schematic diagram of an optional apparatus for detecting a shell website according to an embodiment of the present invention;

11 is a schematic diagram of an optional apparatus for detecting a shell website according to an embodiment of the present invention;

12 is a schematic diagram of a system for detecting a shell website according to an embodiment of the present invention;

FIG. 13 is a structural block diagram of a computer terminal according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. It is to be understood that the data so used may be interchanged where appropriate, so that the embodiments of the invention described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

The terms referred to in this application are explained as follows:

Empty shell website: In the industrial and informational filing system, the historical record information of the organizer of the website contains the main body information and the website information, but there is no access information (that is, the website only has the record number, but because the website actually uses the space IP address) The change, the website sponsor did not transfer the filing information to the new access service provider).

ODPS: (Open Data Processing Service), the development of data processing services, is Alibaba Cloud's independent research and development, providing TB/PB-level data, real-time non-demanding distributed processing capabilities, used in data analysis, mining, business intelligence and other fields. .

OTS: (Open Table Service), an open structured data service, is a NoSQL service, oriented to Structured data and semi-structured data provide massive storage and real-time query capabilities with strong consistency, high concurrency, low latency, and support for flexible data models.

HBASE: (Hadoop Database) is a high-reliability, high-performance, column-oriented, scalable distributed storage system that uses HBASE technology to build large-scale structured storage clusters on inexpensive PC Servers.

Example 1

In accordance with an embodiment of the present invention, an embodiment of a method of detecting a shell website is also provided, it being noted that the steps illustrated in the flowchart of the figures may be performed in a computer system such as a set of computer executable instructions And, although the logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

The method embodiment provided in Embodiment 1 of the present application can be executed in a mobile terminal, a computer terminal or the like. Taking a computer terminal as an example, FIG. 1 is a block diagram showing a hardware structure of a computer terminal for detecting a method of a shell website according to an embodiment of the present invention. As shown in FIG. 1, computer terminal 10 may include one or more (only one shown) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) A memory 104 for storing data, and a transmission module 106 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device. For example, computer terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.

The memory 104 can be used to store software programs and modules of the application software, such as the program instructions/modules corresponding to the method for detecting the empty shell website in the embodiment of the present invention, and the processor 102 runs the software program and the module stored in the memory 104, thereby Perform various functional applications and data processing, that is, implement the vulnerability detection method of the above application. Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 106 is for receiving or transmitting data via a network. The network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

In the above operating environment, the present application provides a method for detecting a shell website as shown in FIG. 2. 2 is a flow chart of a method of processing website data according to a first embodiment of the present invention.

As shown in FIG. 2, the method for processing website data may include the following implementation steps:

Step A, extracting a plurality of websites to be detected.

In the above step A of the present application, the plurality of websites to be detected may be stored in a filing system of the website access provider, and the website sponsor may back up the website information to the filing system of the website access provider when the website is created, In the above-mentioned website access provider's filing system, the website information of a plurality of websites may be stored. Under normal circumstances, the website data of the filing website in the above filing system is saved in the virtual network of the access provider server provided by the website access provider. In space.

It should be noted that, in the present application, the detection of the empty shell website solution can be implemented by using a special detection server, that is, the website access provider can use the detection server to obtain the website of the above-mentioned large number of websites from the filing system of the website access provider. Information, and then detect the empty shell website.

For example, when Alibaba Cloud detects the empty shell website in the Alibaba Cloud filing system, the website sponsor will select Alibaba Cloud as the website access provider when creating the website. The website sponsor can file the filing with Alibaba Cloud's filing system. The information will include information about each website (such as the website's website provider information). Under normal circumstances, the website successfully registered in the Alibaba Cloud Filing System will save the website data in the access provider's server, ie Ali. Cloud access provider server, but in some cases, some website sponsors will change the IP address of the website access provider privately. For example, the founder "U1" of the website "W1" will privately access the IP address of the website access provider. Replaced with the IP address of "a certain cloud", then this creates a situation: in the filing system of Alibaba Cloud, the access provider of the website "W1" is Alibaba Cloud, but in fact, the actuality of the website "W1" The website access provider is the above-mentioned "a certain cloud". The above-mentioned website "W1" is an empty shell website for Alibaba Cloud. If Alibaba Cloud detects the above-mentioned empty shell website, it can use the detection server first. Ali cloud filing system to be detected in multiple sites, to further detect shell website.

It should be noted that the reason for the formation of the above-mentioned empty shell website is not limited to the website sponsor changing the IP address of the website access provider, and the website itself is stopped from being established, and a hollow shell website is also formed.

Step B: Invoking one or more empty shell detection conditions from the website detection condition set, and using one or more empty shell website detection conditions to determine whether any one website is an empty shell website.

In the foregoing step B of the present application, a website detection condition set may be preset in the detection server, and the website detection condition set may include one or more empty shell website detection conditions, and the detection server may invoke the one or more detections. The condition is to detect a plurality of websites to be detected to detect the empty website in the website to be detected.

As an example, Alibaba Cloud detects the empty shell website in the Alibaba Cloud filing system. Alibaba Cloud's detection server can pre-store one or more empty shell website detection conditions. It should be noted that the website detection condition collection can be based on actual conditions. The condition of the empty shell website is increased or decreased or changed. After Alibaba Cloud's detection server extracts multiple websites from Alibaba Cloud's filing system, it can call the detection conditions of one or more of the above-mentioned empty shell websites to detect the above conditions. The website is screened to filter out empty shell sites.

In step C, the output detection result is a website of the empty shell website.

In the above step C of the present application, after detecting the plurality of websites extracted from the access agent filing system according to the above-mentioned empty shell website detecting condition, the detecting server may determine the legal website and the empty shell website, and the detecting server may output the matching. The empty shell website that detects the conditions can be processed by the staff.

In the solution disclosed in the first embodiment of the present application, if the website access provider wants to clean up the empty shell website in the filing server, the detecting server may first extract information of multiple websites in the filing system, and then detect the condition through the preset website. The detection conditions of one or more empty shell websites in the collection are detected on the plurality of websites, and finally the detection server outputs a website whose detection result is a shell website. It is easy to notice that since the access provider only needs to send a detection instruction to the detection server during the process of determining the empty shell website by the detection server, the detection server can automatically call the preset empty shell website detection condition to judge a large number of websites, so The solution provided by the embodiment of the present invention does not require a large amount of manpower to identify the empty shell website. At the same time, the detection server automatically identifies the empty shell website from multiple websites, and the number of identifications is not limited, so that the detection server can be realized not only The automatic and batch realization of the identification of the empty shell website avoids the short period of the manual identification of the empty shell website in the prior art, and the solution for identifying the empty shell website provided by the present application is called by detecting one or more tests through the detection server. The conditions for the detection of the website, the accuracy of the detection of the empty shell website is greatly increased, therefore, it can ensure accurate and rapid implementation of empty shell websites detected in a large number of websites. Therefore, the solution of the first embodiment provided by the present application solves the technical problem that the prior art adopts the manual resolution method to detect and clean the empty shell website, which is easy to miss detection, and leads to low accuracy of the detection result of the empty shell website.

In an optional embodiment provided by the present application, step B, calling one or more empty shell website detection conditions from the website detection condition set, and using one or more empty shell website detection conditions to determine whether any one website is The steps for an empty shell website can include:

Step S141, the empty shell website detection condition in the website detection condition set in step B above may be invoked according to a predetermined calling rule, wherein the predetermined calling rule includes any one or more of the following rules: calling order, calling quantity, and calling Types of.

In the above step S141 of the present application, the detection server may invoke the website detection condition set according to the calling rule. Specifically, the preset number may be specified in the calling rule, and the detecting server invokes a preset number of empty shell website detecting conditions in the website detecting condition set; and the preset empty shell website detecting condition may also be specified in the calling rule. Type, the detecting server may call the empty shell website detecting condition that meets the preset type in the above-mentioned website detecting condition set; in the above calling rule, the preset order may also be specified, that is, when the shell website detection is performed, multiple empty shell websites are The execution order of the detection conditions.

For example, Alibaba Cloud's detection server can call a number of empty shell website detection conditions in a pre-stored website detection condition set according to a preset calling rule, for example, in the case of Alibaba Cloud detection of the empty cloud website in the Alibaba Cloud filing system. The website detection condition set includes five empty shell website detection conditions, and the Alibaba Cloud detection server can call any number of arbitrary website detection conditions of the above five empty shell website detection conditions according to the predetermined calling rule, and execute the empty shell. When the website is detected, multiple empty shell detection conditions can be executed according to the calling order in the calling rule.

In an optional embodiment provided by the present application, in step B, after any one of the plurality of empty shell website detection conditions determines that the first website of the plurality of websites is a shell website, This embodiment further includes the following steps:

Step S142, using other empty shell website conditions in the plurality of empty shell website detection conditions to determine whether the first website is a shell website, and determining that the first website is a shell website when all the shell website detection conditions determine that the first website is a shell website, The first website is an empty website. Otherwise, if any of the empty website detection conditions determines that the first website is not a shell website, the first website is determined to be a legitimate website.

In the above step S142 of the present application, after determining that the first website is an empty shell website by calling any one of the website detection condition detection conditions, the other website detection conditions in the website detection condition set may be further called. To continue to determine the above first website, it should be noted that the first website is finally determined only if each of the empty website detection conditions in the website detection condition set determines that the first website is a hollow website. The empty website is output, otherwise the first website is a legitimate website, that is, if one of the website detection condition sets determines that the first website is not a shell website, the first website is finally confirmed as a legitimate website.

For example, Alibaba Cloud's server detects the empty shell website in the Alibaba Cloud filing system. Alibaba Cloud's server makes a shell judgment on the website "W1". The website detection condition set in the Alibaba Cloud detection server can contain 5 empty shells. Website detection conditions (such as condition A, condition B, condition C, condition D, condition E), when the Alibaba Cloud detection server performs the detection of the empty shell website, it can call the condition A to the website "W1" according to the predetermined calling rule. Judging, condition A determines that the website "W1" is a shell website, and at this time, the detection server continues to call the remaining conditions to continue the determination of the website "W1", and if the conditions B to E determine the website " W1" is an empty shell The website, the detection server determines that the website "W1" is a shell website and outputs it. If condition A to condition E determines that the website "W1" is a shell website, condition E determines that the website "W1" is not a shell website. The detection server determines that the above website "W1" is a legitimate website.

In an optional embodiment provided by the present application, the foregoing empty shell website detection condition may include any one or more of the following types: whether any one website is in the white list, whether it is in the record or in the record change, at the scheduled time. Whether there is an access record, whether it is registered, and whether there is report information in the analysis result.

In the above embodiment, the empty shell website detection condition set may include the above four conditions, the first condition: whether any website is in the white list; the second condition: whether any website is in the record or in the record change; Condition: Whether there is an access record for any website; Fourth condition: Whether any website is registered and whether the report has the report information. The detecting server may invoke the above four conditions according to a certain predetermined rule. In the case that the predetermined rule is a sequential call, the detecting server may sequentially invoke the first condition to the fourth condition, and it should be noted that each of the above four conditions The conditions can be judged individually by any website (the first website) as a shell website, but the detection server determines that the first website is a shell website only if the four conditions determine that the first website is a shell website. That is, if the above four conditions have a condition that the first website is not a shell website, the detection server determines that the first website is a legitimate website.

It should be noted that when the detection server invokes the empty shell website detection condition, the above four conditions may be invoked according to a preset rule.

The detecting server may determine whether the first website is empty according to whether the first website is in the white list, whether it is in the record or in the filing change, whether there is an access record within a predetermined time, whether it is registered, and whether the parsing result has the report information. Shell website.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is to detect whether any one website is in the white list, the step of using the empty shell website detecting condition to determine whether any one website is an empty shell website includes: :

In step S1411, the website information of any website is read.

In the above step S1411, the website information of any one of the websites may be the domain name of the website, and the detection server may read the website domain name of the first website of the plurality of websites to be detected.

In step S1412, it is determined whether the website information of any one website matches the website information saved in the white list.

In step S1413, if the matching is successful, it is determined that any one website is a legitimate website.

In the above step S1412 to step S1413, the domain name of the plurality of legitimate websites may be pre-stored in the white list, and the detecting server first reads the domain name of the first website, and then combines the domain name of the first website with the plurality of the white list. The domain name of the French website is matched. In the case that the matching is successful, the first website is a whitelist website, and the detection server determines that the first website is a legitimate website.

It should be noted that if the domain name of the first website fails to match the domain name saved in the white list, the detection server determines that the first website exists as a risk of the empty website, and calls other judgment conditions to continue to determine the first website. The first website is finally determined to be a shell website only when all the judgment conditions determine that the first website is a shell website.

For example, Alibaba Cloud detects the empty shell website in the Alibaba Cloud filing system. In the Alibaba Cloud detection server, there is a white list pre-stored. The white list stores a website that has a cooperative relationship with Alibaba Cloud. Alibaba Cloud will be whitelisted. The website defaults to a legitimate website to prevent large customers from mishandling themselves, causing the websites of large customers to be mistakenly cleaned up because of the conditions of the empty shell website. When Alibaba Cloud's detection server makes a shell judgment on the website "W1", Alibaba Cloud's detection server can read the domain name of the website "W1", and then the domain name of "W1" is the same as the domain name of multiple legitimate websites in the whitelist. Matching is performed. In the case where the matching is successful, the above-mentioned website "W1" of Alibaba Cloud's detection server is a whitelisted website. If the match fails, the detection server determines that the website "W1" exists as a risk of the empty website, and then the detection server continues to call other determination conditions to determine the website "W1" until each determination condition determines the website "W1" For the empty shell website, the detection server determines that the website "W1" is an empty shell website.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is to detect whether any one website has an access record within a predetermined time, the empty shell website detecting condition is used to determine whether any one website is an empty shell website. The steps can include:

Step S1414: Acquire an access log of the domain name recorded by the plurality of websites in the server.

In step S1415, the access log is queried according to the domain name of any website to check whether an access record is recorded within a predetermined time.

In the above step S1415, the detecting server may obtain the access log corresponding to the domain name of the plurality of websites from the plurality of websites in the website server, and the access log of each domain name may be queried from the access log, and the detecting server may Check whether each domain name has an access record within a predetermined time.

In step S1416, if an access record is recorded within a predetermined time, it is determined that any one website is a legitimate website.

In the above step S1416, if the first website of the plurality of websites records the access record within the predetermined time period, the detecting server determines the first website as the legitimate website.

It should be noted that if the domain name of the first website does not have an access record within a predetermined time, the detection server determines that the first website exists as a risk of the empty website, and then calls other judgment conditions to continue the determination of the first website. The first website is only finalized when all the judgment conditions determine that the first website is a shell website. Determined to be an empty shell website.

For example, when Alibaba Cloud detects the empty shell website in the Alibaba Cloud filing system, Alibaba Cloud's detection server can query the website "W1" from the website server according to the domain name of the first website when determining the website "W1". The computer access log, from the above access log, can query whether the domain name of the website "W1" has an access record at the scheduled time. If the domain name of the website "W1" exists in the access record within 60 days, the detection server will "the website" W1" is determined to be a legitimate website. If the domain name of the website "W1" does not have an access record within 60 days, the detection server determines that the website "W1" exists as a risk of the empty website, and the detection server continues to call other determination conditions to determine the website "W1" until each The judgment conditions all determine that the website "W1" is a shell website, and the detection server determines the website "W1" as a shell website. It should be noted that the detection server can use the verification website "W1" for the existence of the access record. The ODPS performs data cleaning and then stores the cleaned data in the OTS to provide quick access to external devices.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is to detect any one website as a record or a record change, the empty shell website detecting condition is used to determine whether any one website is an empty shell website. The steps include:

In step S1417, the website information of any website is read, wherein the website information includes: the filing status of the domain name of any one website.

In step S1418, it is determined whether the filing status of the domain name of any one website is in the record or in the record change.

In the above step S1418, the detecting server may read the filing status of the first website domain name from the access service provider's filing system according to the domain name of the first website, and the filing system may store the filing status of the plurality of website domain names in the filing system, and detect The server can determine whether the filing status of the domain name of the first website is in the record or in the record change.

In step S1419, if the filing status of the domain name of any website is in the filing or the filing change, it is determined that any website is a legitimate website.

In the above step S1419, when the filing status of the domain name of the first website is in the filing or the filing change, the detecting server determines that the first website is an illegal website.

It should be noted that if the filing status of the domain name of the first website is neither in the filing nor in the filing change, the detecting server determines that the first website exists as a risk of the empty website, and then calls other judgment conditions. The first website continues to determine that the first website is finally determined to be a shell website only when all the judgment conditions determine that the first website is a shell website.

For example, when Alibaba Cloud detects the empty shell website in the Alibaba Cloud filing system, Alibaba Cloud's detection server can read the domain name of the website “W1” when it determines the website “W1”, and then query the website from the filing system. W1" Whether the filing status of the domain name is in the record or the record change, in the case that the filing status of the website "W1" is in the record or the record change, the Alibaba Cloud detection server determines that the website "W1" is a legitimate website. If the domain name of the website "W1" is neither in the record nor in the case of the record change, the detection server determines that the website "W1" exists as a risk of the empty shell website, and the detection server will continue to call other judgment conditions. The website "W1" judges until the determination condition determines that the website "W1" is a empty shell website, and the detection server determines the website "W1" as the empty shell website.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is whether the any one website is registered and whether the parsing result has the report information, the empty shell website detecting condition is used to determine any The steps for whether a website is an empty shell include:

In step S1420, the website information of any website is read.

Step S1421: Query whether there is information matching the website information of any one website in the registration information table.

In step S1422, if the matching is successful, the type of the any one of the websites is determined according to whether there is any report information according to the result of any website parsing.

In the above steps S1420 to S1422, the website information of any one of the websites may be the domain name of the website, and the detection server may read the domain name and registration information of the first website after reading the domain name of the first website from the filing system. The multiple domain names in the table are matched. The domain name in the registration information table may be the domain name of the registered website. If the matching is successful, the detection server determines the first according to the analysis result of the first website. A website is a legitimate website or a shell website.

It should be noted here that if the matching fails, then the detection condition of the empty shell website invoked by the detection server directly determines that the first website has the risk of becoming a shell website. If the success is successful, the detection server continues to determine whether the first website is a legitimate website or a shell website based on the results of the parsing of the first website.

In an optional embodiment provided by the present application, if the matching is successful, the step of determining the type of the any one of the websites according to whether the result of any one of the website parsings is determined by the step of the website parsing may include:

In step S14221, if the IP address of any website is the same as the IP address already recorded by the access provider server, it is determined that any website is a normal website.

In step S14222, if the IP address of any website is different from the IP address already recorded by the access provider server, it is determined that any website is an empty website.

In the above steps S14221 to S14222, if the IP address after the domain name resolution of any one of the above websites (for example, the first website) belongs to the IP address recorded in the access provider server, the detection server invokes The detection condition of the empty shell website determines that the first website is a normal website. If the IP address after the domain name resolution of the first website is not the IP address of the data access provider server, the detection condition of the empty shell detected by the detection server is determined. The first website mentioned above is a look at the empty website.

In an optional embodiment provided by the present application, after the step of extracting a plurality of websites to be detected, the method provided in this embodiment may further include:

Step S18, the website information of the plurality of websites is sequentially written into the data queue by starting at least n data distribution threads.

Step S19: sequentially, by starting at least m detection threads, sequentially reading website information of a plurality of websites from the data queue, wherein m and n are automatically adjusted according to a preset total detection time, where m is greater than or equal to n, and m and n For natural numbers.

In the above steps S18 to S19, the cleaning server may include a data distribution function module and a verification function module. The data distribution function module may start n data distribution threads by default, and the n data distribution threads may simultaneously send data queues. The website information of the plurality of websites is stored, and then the verification function module starts m detection threads by default, and the m detection threads can read the website information of the plurality of websites from the data queue, and then perform detection to determine the empty shell website. It should be noted that this scheme can use BlockingQueue (bounded blocking queue supported by array) as the data queue.

For example, Alibaba Cloud's detection server can start two data distribution threads by default each time. The above two data distribution threads can simultaneously send to the BlockingQueue (supported by the array). Constantly storing data in the boundary blocking queue, that is, information of multiple websites, and then detecting that the server starts five verification threads by default, and each of the above five verification threads can take data from the above BlockingQueue, and then perform verification. , identify the empty shell website.

In an optional embodiment provided by the present application, the website information of each website further includes a terminal address of the sponsor of each website, and in step C, after outputting the website whose detection result is a shell website, the embodiment provides The method can also include:

In step S20, the alarm information is sent to the terminal address of the sponsor determined to be the empty shell website, wherein the alarm information includes at least the domain name of the empty shell website.

In the above step S20, the detecting server may send an alarm message to the organizer of the first website after determining that the first website is a shell website, and the alarm information is used to remind the founder of the shell website to adjust the shell website. For example, the alarm information may prompt the user of the empty shell website to handle the filing and access.

Still taking Alibaba Cloud to detect the empty shell website in the Alibaba Cloud filing system, Alibaba Cloud's detection server is determining After the website "W1" is an empty shell website, the detection server can send audio to the mobile phone of the website sponsor "U1" of the website "W1", which can be a suggested adjustment scheme for the empty shell website, and a user who cannot send audio. You can send mail. After successfully sending the alarm information, Alibaba Cloud's detection server can generate a transmission report and send it to the message center to ensure that the customer has received the alarm information. For customers who cannot be notified, the detection server transfers to the manual customer service.

In an optional embodiment provided by the present application, after the sending the alarm information to the terminal address of the sponsor determined to be the empty shell website in step S20, the method provided in this embodiment may include:

In step S21, after the preset duration is reached, step A to step C are repeatedly executed to obtain a website that is determined to be a shell website again.

In the above step S21, after the detection server sends the alarm information to the sponsor of the empty shell website, the detection scheme of the shell website of the above steps A to C can be performed again after the preset duration, and then the determination is made again. The empty shell website, it should be noted that, in the above step S20, the cleaning server has notified the organizer of the empty shell website (for example, the first website), and if the organizer of the first website does not adjust the website in time, the first The website will be identified as a shell website again.

In step S22, the website determined to be the empty shell website is recorded as the website to be cleaned up.

In step S23, the domain name of the website to be cleaned is sent to the target server.

In the above step S23, the target server may be a server of the communication authority. In a case where the first website is determined to be a website to be cleaned, the detecting server may send the domain name of the first website to the communication authority, and the communication is performed. The Authority will cancel the access to the first website.

The solution of the present application is described in detail below in a preferred embodiment:

As shown in Figure 3, Alibaba Cloud can clean up the empty shell website in the Alibaba Cloud filing system by the following steps:

Step S30, a scheme for performing data extraction, which can extract a plurality of websites to be checked.

Specifically, Alibaba Cloud's cleaning server can extract information of the website to be verified from Alibaba Cloud's filing system. It should be noted that the cleaning server can automatically extract the website information data of the website to be verified during the non-business peak period to reduce the impact on the normal business of Alibaba Cloud. It should also be noted that the cleaning server can extract the newly filed data of the last 90 days when it is extracted, so as to avoid the new filing customer being cleaned up by mistake, which can improve security. It should be noted that, in the information of the plurality of websites extracted by the cleaning server from the filing system, the domain name of each website, the website address of each website, the filing status of each website, and the like may be included, preferably, In the empty shell website determining step S31, the present embodiment determines the empty shell website by the domain name of each website.

In step S31, it is determined which of the plurality of websites to be checked are empty shell websites.

The determining scheme of the above-mentioned empty shell website may include an optional solution, which may include the following implementation steps:

Step S311, obtaining the domain name of each website to start verification, and checking whether the website belongs to the empty shell website based on the domain name of each website.

Specifically, Alibaba Cloud's cleaning server may extract the domain names of multiple websites from the above website information and determine the empty shell website according to the domain name.

Step S312, determining whether there is a domain name whitelist for the domain name of any website to be verified.

Specifically, the domain name whitelist may include a domain name of a large client that needs to be maintained in cooperation with Alibaba Cloud. If the domain name has a whitelist, step S318 is performed. If the domain name does not exist in the whitelist, step S313 is performed. . It should be noted that if the whitelist domain name is not cleaned, it can prevent the fault caused by the customer's misoperation being cleaned up.

In step S313, it is determined whether there is an access record for the domain name of any website to be verified.

Specifically, the cleaning server can obtain the domain name access log of all the computer rooms in the website server, and merge into the top-level domain name. If the domain name of the website exists in the access record within 60 days, step S318 is performed, and the domain name of the website does not exist within 60 days. In the case of recording, step S314 is performed. It should be noted that this step does not clean up the access records of the website's domain name within 60 days. It should also be noted that the judgment of the access record involves big data cleaning, the existing ODPS can be used for data cleaning, the data storage is cleaned to the OTS to provide high concurrent fast access, and the ODPS can be replaced with other big data processing technologies. , OTS can be replaced with HBASE.

In step S314, it is determined whether the status of the domain name of any website to be verified is in the record or in the record change.

Specifically, the cleaning server may further determine whether the domain name of any one of the verified websites is in the record or the record change, and in the case that the domain name of any website to be verified is in the record or the record change, step S318 is performed, and any one is to be checked. If the status of the domain name of the website is neither in the filing nor in the case of the filing change, step S315 is performed.

In step S315, it is determined whether the domain name of any website to be verified is registered.

Specifically, the cleaning server may further determine whether the domain name of any website to be verified is registered. If the domain name is not registered, step S317 is performed. If the domain name of any website to be checked is already registered, step S316 is performed.

Step S316, parsing the domain name, and determining whether the parsed IP belongs to Alibaba Cloud.

Specifically, the cleanup server can parse the domain name (direct domain name resolution or www domain name resolution). The cleaning server determines whether the IP address of the domain name belongs to Alibaba Cloud. If it belongs to Alibaba Cloud, step S318 is performed. If the parsed IP does not belong to Alibaba Cloud, step S317 is performed.

In step S317, any website to be verified is determined as an empty shell website.

In step S318, any website to be verified is determined as a normal website.

It should be noted that the execution order of the foregoing steps S311 to S318 is a preferred embodiment of the solution. In the process of performing the empty shell determination, the present embodiment may also change the execution sequence of the steps S311 to S318. It should be noted that step S311 to step S318 can be cyclically executed for a predetermined time, for example, 5 days, through the above-mentioned loop protection measures, the false positive rate of the empty shell website is reduced, and the accuracy of the existing data is ensured, and the maximum is improved. safety.

Step S32, notifying the customer of the website information determined to be the empty shell website.

Specifically, the cleaning server may notify the client in batches of the domain name determined to be the empty shell website, that is, the sponsor of the empty shell website. It should be noted that the cleaning server obtains the contact information of the customer's mobile phone number mailbox, and notifies the customer to make adjustments through the above contact information. The cleaning server can automatically call the customer's mobile phone number, and then play the website that the customer needs to adjust and the specific adjustment plan. For customers who cannot be called, the cleaning server can send an adjustment plan to the customer's mailbox. After the cleanup server notifies the client, the cleanup server will call back the message center to ensure that the customer has received the adjustment notice, so that the customer is not cleaned up without knowing, and the unreachable client can be manually processed.

In step S33, the client of the empty shell website rectifies the empty shell website.

Specifically, after receiving the rectification plan sent by the cleaning server, the customer may rectify the empty shell website according to the above rectification plan.

In step S34, the cleaning server performs a review and cleanup on the website determined as the empty shell website.

Specifically, after notifying the client for five natural days, the cleaning server re-checks the website determined as the empty website website according to step S311 to step S318, and does not clean up the website that the customer has adjusted and is not adjusted, or Adjust the unqualified website (again identified as a shell website), clean up the server to generate a message and submit it to the management office, and cancel the access operation to the empty shell website.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Through the description of the above embodiments, those skilled in the art can clearly understand the above embodiments according to the above embodiments. The method can be implemented by means of software plus a necessary general hardware platform, and of course, through hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present invention.

Example 2

According to an embodiment of the present invention, there is further provided a device for detecting a shell website for implementing the method for detecting a shell website. As shown in FIG. 4, the apparatus includes: an extracting unit 40, an invoking unit 42, and an output unit 44. .

The extracting unit 40 is configured to extract a plurality of websites to be detected. The calling unit 42 is configured to invoke one or more empty shell website detection conditions from the website detection condition set, and use one or more empty shell website detection conditions to determine whether any one website is an empty shell website; the output unit 44 uses The website that outputs the test results for the empty shell website.

It should be noted that the extracting unit 40, the extracting unit 40, the calling unit 42, and the output unit 44 correspond to the steps A to C in the first embodiment, and the examples and application scenarios implemented by the three units and corresponding steps. The same, but not limited to, the content disclosed in the above embodiment 1. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

As can be seen from the above, in the solution disclosed in the second embodiment of the present application, if the website access provider wants to clean up the empty shell website in the filing server, the detecting server may first extract information of multiple websites in the filing system, and then preset The detection condition of one or more empty shell websites in the website detection condition collection detects the above multiple websites, and finally the detection server outputs the website whose detection result is an empty shell website. It is easy to notice that since the access provider only needs to send a detection instruction to the detection server during the process of determining the empty shell website by the detection server, the detection server can automatically call the preset empty shell website detection condition to judge a large number of websites, so The solution provided by the embodiment of the present invention does not require a large amount of manpower to identify the empty shell website. At the same time, the detection server automatically identifies the empty shell website from multiple websites, and the number of identifications is not limited, so that the detection server can be realized not only The automatic and batch realization of the identification of the empty shell website avoids the short period of the manual identification of the empty shell website in the prior art, and the solution for identifying the empty shell website provided by the present application is called by detecting one or more tests through the detection server. The conditions for the detection of the website, the accuracy of the detection of the empty shell website is greatly increased, therefore, it can ensure accurate and rapid implementation of empty shell websites detected in a large number of websites. Therefore, the solution of the foregoing embodiment 2 provided by the present application solves the technical problem that the prior art adopts the manual resolution method to detect and clean the empty shell website, which is easy to miss detection, and leads to low accuracy of the detection result of the empty shell website.

Optionally, as shown in FIG. 5, the calling unit 42 may include: calling the module 421.

The calling module 421 is configured to invoke the empty shell website detection condition in the website detection condition set according to the predetermined calling rule, wherein the predetermined calling rule includes any one or more of the following rules: the calling order, the calling quantity, and the calling type.

It should be noted that the calling module 421 corresponds to the step S141 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, as shown in FIG. 6, the calling unit 42 may further include: a determining module 422.

The determining module 422 is configured to determine whether the first website is an empty shell website by using other empty shell website conditions in the plurality of empty shell website detecting conditions, and determining that the first website is a shell website in all the shell website detecting conditions. In the case, it is determined that the first website is an empty website, otherwise, in the case that any of the empty website detection conditions determines that the first website is not a shell website, the first website is determined to be a legitimate website.

It should be noted that the calling module 422 corresponds to the step S142 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, the empty shell website detection condition includes any one or more of the following types: whether any one website is in the white list, whether it is in the record or in the record change, whether there is an access record within a predetermined time, whether it is registered, and parsing The result is whether there is a report information.

Optionally, as shown in FIG. 7, the calling unit 42 may further include: an obtaining module 423, a querying module 424, and a second determining module 425.

The obtaining module 423 is configured to obtain an access log of a domain name recorded by multiple websites in the server. The querying module 424 is configured to query, in the access log, whether the access record is recorded within a predetermined time according to the domain name of any website. The second determining module 425 is configured to determine that any one website is a legitimate website if an access record is recorded within a predetermined time.

It should be noted that the obtaining module 423, the querying module 424, and the second determining module 425 correspond to the steps S1414 to S1416 in the first embodiment, and the three modules are the same as the examples and application scenarios implemented by the corresponding steps, but It is not limited to the contents disclosed in the above embodiment 1. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, as shown in FIG. 8, the calling unit 42 may further include: a second reading module 426, a second determining module 427, and a third determining module 428.

The second reading module 426 is configured to read website information of any website, where the website information packet Included: the filing status of the domain name of any website; the second determining module 427 is configured to determine whether the filing status of the domain name of any one website is in the filing or the filing change; the third determining module 428 is used on any website. If the filing status of the domain name is in the case of filing or filing change, it is determined that any website is a legitimate website.

It should be noted that the second reading module 426, the second determining module 427, and the third determining module 428 correspond to the steps S1417 to S1419 in the first embodiment, and the three modules and the corresponding steps are implemented by the steps and The application scenario is the same, but is not limited to the content disclosed in the first embodiment. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, as shown in FIG. 9, the calling unit 42 may further include: a third reading module 429, a second query module 430, and a fourth determining module 431.

The third reading module 429 is configured to read website information of any website; the second query module 430 is configured to query, in the registration information table, whether there is information matching the website information of any one website; The determining module 431 is configured to determine the type of any website according to whether the result of any one of the website parsing has the report information if the matching is successful.

It should be noted that the third reading module 429, the second query module 430, and the fourth determining module 431 correspond to the steps S1420 to S1422 in the first embodiment, and the three modules and the corresponding steps are implemented by the corresponding steps. The application scenario is the same, but is not limited to the content disclosed in the first embodiment. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, the fourth determining module 431 further includes a sub-determining module 4311.

The fifth determining module 432 is configured to determine the type of any website according to the IP address resolved by the domain name of any website; wherein the IP address of any website is the same as the IP address already recorded by the access provider server. In the case of any website, it is determined that any website is a normal website; if the IP address of any website is different from the IP address already recorded by the access server, it is determined that any website is an empty website.

It should be noted that the sub-determination module 4311 corresponds to the step S14221 to the step S14222 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the content disclosed in the first embodiment. . It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Optionally, the apparatus provided in this embodiment, as shown in FIG. 11, may further include: a data distribution unit 46, and a detecting unit 48.

The data distribution unit 46 is configured to sequentially write the website information of the plurality of websites into the data queue by starting at least the n data distribution threads, and the detecting unit 48 is configured to: according to the at least m detection threads, start from the data queue The website information of a plurality of websites is read at a time; wherein m and n are automatically adjusted according to a preset total detection time, m is greater than or equal to n, and m and n are natural numbers.

It should be noted that the data distribution unit 46, the detecting unit 48 corresponds to the step S18 to the step S19 in the first embodiment, and the module is the same as the example and the application scenario implemented by the corresponding steps, but is not limited to the first embodiment. The content disclosed. It should be noted that the above module can be operated as part of the device in the computer terminal 10 provided in the first embodiment.

Example 3

According to an embodiment of the present invention, a system for detecting a shell website for implementing the method for detecting a shell website is further provided. As shown in FIG. 12, the system includes: a record server 1200, and a detection server 1210.

The record server 1200 is configured to store information of a plurality of websites; the detection server 1210 establishes a communication relationship with the record server, and is configured to call one of the website detection condition sets after extracting a plurality of websites to be detected from the record server. Or multiple empty shell websites detect conditions and use one or more empty shell website detection conditions to determine whether any one website is an empty shell website, and output a website whose detection result is an empty shell website.

In an optional embodiment provided by the application, the detecting server 1210 is further configured to invoke the empty shell website detecting condition in the website detecting condition set according to the predetermined calling rule, wherein the predetermined calling rule includes any one or more of the following: Rules: Call order, number of calls, and type of call.

In an optional embodiment provided by the present application, the detecting server 1210 is further configured to determine, by using any one of a plurality of empty shell website detecting conditions, that the first website of the plurality of websites is an empty shell website. After that, using the other empty shell website conditions in the multiple shell website detection conditions to determine whether the first website is an empty shell website, and in the case that all the empty shell website detection conditions determine that the first website is a hollow shell website, the first A website is an empty website. Otherwise, if any of the empty website detection conditions determines that the first website is not a shell website, the first website is determined to be a legitimate website.

In an optional embodiment provided by the present application, the empty shell website detection condition includes any one or more of the following types: whether any one website is in the white list, whether it is in the record or in the record change, is it within a predetermined time period? There is an access record, whether it is registered, and whether there is report information for the result of the analysis.

Therefore, in the solution disclosed in the third embodiment of the present application, if the website access provider wants to clean up the empty shell website in the filing server, the detecting server may first extract information of multiple websites in the filing system, and then preset The detection condition of one or more empty shell websites in the website detection condition collection detects the above multiple websites, and finally the detection server outputs the website whose detection result is an empty shell website. It is easy to notice that since the access provider only needs to send a detection instruction to the detection server during the process of determining the empty shell website by the detection server, the detection server can A large number of websites are determined by automatically calling the preset empty shell website detection condition. Therefore, the solution provided by the embodiment of the present invention does not require a large amount of manpower to identify the empty shell website, and at the same time, the detection server automatically uses multiple The website identifies the empty shell website, and the number of identifications is not limited. This not only realizes that the detection server can automatically and batchly realize the identification of the empty shell website, and avoids the defect that the prior art manually identifies the empty shell website, and this application is long. The solution for identifying the empty shell website is because the detection server detects the website by calling one or more detection conditions, and the accuracy of the detection of the empty shell website is greatly increased, so that accurate and rapid implementation can be ensured in a large number of websites. A shell website was detected. Therefore, the solution of the foregoing embodiment 3 provided by the present application solves the technical problem that the prior art adopts the manual resolution method to detect and clean the empty shell website, which is easy to miss detection, and leads to low accuracy of the detection result of the empty shell website.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is to detect whether any one website is in the white list, the detecting server 1210 is configured to read website information of any one website; Whether the website information matches the website information saved in the white list; if the matching is successful, the above detection server 1210 determines that any one website is a legitimate website.

In an optional embodiment provided by the present application, when the empty shell website detecting condition is to detect whether any one website has an access record within a predetermined time, the detecting server 1210 is configured to acquire a domain name recorded by multiple websites in the server. The access log; in the access log according to the domain name of any website, whether the access record is recorded within the predetermined time; if the access record is recorded within the predetermined time, the detection server 1210 determines that any website is a legitimate website.

In an optional embodiment provided by the present application, when the detecting condition of the empty shell website is to detect any one of the websites as a record or a change in the record, the detecting server 1210 is configured to read the website information of any website, wherein The website information includes: the status of the registration of the domain name of any website; whether the filing status of the domain name of any website is in the record or the record change; in the case where the filing status of the domain name of any website is in the record or in the case of the record change The above detection server 1210 determines that any one website is a legitimate website.

In an optional embodiment provided by the present application, when the empty shell website detects whether the website is registered and whether the report has the report information, the detection server 1210 is configured to read the website information of any website; In the registration information table, it is queried whether there is information matching the website information of any one website; in the case that the matching is successful, the detection server 1210 determines the type of any website according to whether the result of any website analysis has the report information. .

In an optional embodiment provided by the present application, the detecting server 1210 is further configured to determine that any website is legal if the IP address of any website is the same as the IP address already recorded by the access provider server. The website detecting server 1210 determines that any one website is an empty shell website, in the case where the IP address of any one website is different from the IP address already recorded by the access provider server.

In an optional embodiment provided by the present application, the detecting server 1210 is further configured to sequentially write website information of multiple websites into the data queue by starting at least n data distribution threads; by starting at least m detection threads from The data queue sequentially reads website information of a plurality of websites; wherein, m and n are automatically adjusted according to a preset total detection time, m is greater than or equal to n, and m and n are natural numbers.

In an optional embodiment provided by the application, the website information of each website further includes a terminal address of the sponsor of each website, wherein after detecting the website whose detection result is a shell website, the detection server 1210 further And sending the alarm information to the terminal address of the sponsor determined to be the empty shell website, wherein the alarm information includes at least the domain name of the empty shell website.

In an optional embodiment provided by the present application, after sending the alarm information to the terminal address of the sponsor determined to be the empty shell website, the detecting server 1210 is further configured to repeatedly perform step A after the preset duration is reached. Go to step C, obtain the website that is determined to be the empty shell website again; record the website that is determined to be the empty shell website again as the website to be cleaned; and send the domain name of the website to be cleaned to the target server.

Example 4

Embodiments of the present invention may provide a computer terminal, which may be any one of computer terminal groups. Optionally, in this embodiment, the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.

Optionally, in this embodiment, the computer terminal may be located in at least one network device of the plurality of network devices of the computer network.

In this embodiment, the computer terminal may execute the program code of the following steps in the vulnerability detection method of the application: extracting multiple websites to be detected; and calling one or more empty shell detection conditions from the website detection condition set, and Use one or more empty shell detection conditions to determine whether any website is a shell site; output a website that detects the result as a shell site.

Optionally, FIG. 13 is a structural block diagram of a computer terminal according to an embodiment of the present invention. As shown in FIG. 13, the computer terminal A may include one or more (only one shown in the figure) processor 510, memory 530, and transmission device 550.

The memory can be used to store software programs and modules, such as the security vulnerability detection method and the program instruction/module corresponding to the device in the embodiment of the present invention. The processor executes various functions by running a software program and a module stored in the memory. Application and data processing, that is, the detection method for implementing the above system vulnerability attack. Memory High speed random access memory may also be included, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, the memory can further include memory remotely located relative to the processor, which can be connected to terminal A via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The processor may invoke the memory stored information and the application by the transmission device to perform the following steps: Step A: extracting multiple websites to be detected; Step B: calling one or more empty shell websites from the website detection condition set Conditions, and use one or more empty shell website detection conditions to determine whether any website is an empty shell website; Step C: Output the website whose detection result is a shell website.

Optionally, the foregoing processor may further execute the following program code: invoke the empty shell website detection condition in the website detection condition set according to a predetermined calling rule, where the predetermined calling rule includes any one or more of the following rules: Order, number of calls, and type of call.

Optionally, the foregoing processor may further execute the following program code: in any one of the plurality of empty shell website detection conditions, the empty website detection condition determines that the first website of the plurality of websites is an empty shell website, and the use is performed. The other empty shell website conditions in the empty shell website detection condition determine whether the first website is a empty shell website, and if all the empty shell websites detect that the first website is a shell website, the first website is determined to be empty. The shell website, otherwise, in the case where any of the empty shell websites detects that the first website is not a shell website, the first website is determined to be a legitimate website.

Optionally, the processor may further execute the following program code: the empty shell website detection condition includes any one or more of the following types: whether any website is in the white list, whether it is in the record or in the record change, is scheduled Whether there is an access record, whether it is registered, and whether there is a report information in the analysis result.

Optionally, the foregoing processor may further execute the following program code: when the empty shell website detecting condition is to detect whether any website is in the white list, use the empty shell website detection condition to determine whether any one website is an empty shell website. The steps include: reading the website information of any website; determining whether the website information of any one website matches the website information saved in the white list; and if the matching is successful, determining that any one website is a legitimate website.

Optionally, the processor may further execute the following program code: when the empty shell website detecting condition is to detect whether any website has an access record within a predetermined time, use the empty shell website detection condition to determine whether any website is The steps of the empty shell website include: obtaining an access log of the domain name recorded by the plurality of websites in the server; querying in the access log according to the domain name of any website whether the access record is recorded within the predetermined time; if the access is recorded within the predetermined time Record and determine that any website is a legitimate website.

Optionally, the foregoing processor may further execute the following program code: when the empty shell website detection condition is to detect any one website as a record or a record change, use the empty shell website detection condition to determine whether any one website is empty. The steps of the shell website include: reading the website information of any website, wherein the website information includes: the filing status of the domain name of any one website; determining whether the filing status of the domain name of any one website is in the record or in the record change; When the filing status of a website's domain name is in the record or in the case of a record change, it is determined that any website is a legitimate website.

Optionally, the processor may further execute the following program code: when the empty shell website detects whether any website is registered and whether the parsing result has report information, use the shell detection condition to determine whether any website is The steps of the empty shell website include: reading the website information of any website; querying the registration information table whether there is information matching the website information of any one website; if the matching is successful, parsing according to any website The result is whether there is a report information to determine the type of any website.

Optionally, the foregoing processor may further execute the following program code: determining whether any type of the website is included according to whether the result of any website parsing has the report information: the IP address of the website and the access provider server have been If the recorded IP addresses are the same, it is determined that any website is a legitimate website; if the IP address of any website is different from the IP address already recorded by the access provider server, it is determined that any website is an empty website.

Optionally, the foregoing processor may further execute the following program code: after extracting a plurality of websites to be detected, the method further includes: sequentially initiating, by starting at least n data distribution threads, site information of the plurality of websites into the data queue. The website information of multiple websites is sequentially read from the data queue by starting at least m detection threads; wherein, m and n are automatically adjusted according to a preset total detection time, m is greater than or equal to n, and m and n are Natural number.

Optionally, the foregoing processor may further execute program code of the following steps: the website information of each website further includes a terminal address of a sponsor of each website, wherein after outputting the website whose detection result is a shell website, the method further The method includes: sending an alarm message to a terminal address of a sponsor determined to be a shell website, wherein the alarm information includes at least a domain name of the empty shell website.

Optionally, the foregoing processor may further execute the following program code: after sending the alarm information to the terminal address of the sponsor determined to be the empty shell website, the method further includes:

After the preset duration arrives, step A to step C are repeatedly performed to obtain a website that is determined to be the empty shell website again; the website that is determined to be the empty shell website is recorded as the website to be cleaned; the domain name of the website to be cleaned is sent to Target server.

With the embodiment of the present invention, a method for detecting a shell website is provided. By extracting multiple websites to be detected; One or more empty shell detection conditions are invoked from the website detection condition collection, and one or more empty website detection conditions are used to determine whether any website is an empty shell website; and the website whose detection result is an empty shell website is output. The technical problem that the prior art adopts the manual resolution method to detect and clean the empty shell website is easy to miss, which leads to the low accuracy of the detection result of the empty shell website.

A person skilled in the art can understand that the structure shown in FIG. 13 is only for illustration, and the computer terminal can also be a smart phone (such as an Android mobile phone, an iOS mobile phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (Mobile Internet Devices, MID). ), PAD and other terminal devices. FIG. 13 does not limit the structure of the above electronic device. For example, computer terminal 10 may also include more or fewer components (such as a network interface, display device, etc.) than shown in FIG. 13, or have a different configuration than that shown in FIG.

A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be completed by a program to instruct terminal device related hardware, and the program may be stored in a computer readable storage medium, and the storage medium may be Including: flash disk, read-only memory (ROM), random access memory (RAM), disk or optical disk.

Example 5

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be used to save the program code executed by the method for detecting the empty shell website provided in the first embodiment.

Optionally, in this embodiment, the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.

Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: extracting a plurality of websites to be detected; and calling one or more empty shell website detection conditions from the website detection condition set, And using the one or more empty shell website detection conditions to determine whether any one website is an empty shell website; and outputting the detection result to the website of the empty shell website.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the descriptions of the various embodiments are different, and the parts that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

In the several embodiments provided by the present application, it should be understood that the disclosed technical contents may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed. Alternatively, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interface, unit or module indirect. The coupling or communication connection can be in electrical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

A method for detecting a shell website, characterized in that it comprises:

Step A, extracting a plurality of websites to be detected;

Step B: Calling one or more empty shell website detection conditions from the website detection condition set, and using the one or more empty shell website detection conditions to determine whether any one website is an empty shell website;

In step C, the output detection result is the website of the empty shell website.
The method according to claim 1, wherein the empty shell website detection condition in the website detection condition set is invoked according to a predetermined calling rule, wherein the predetermined calling rule comprises any one or more of the following rules: Call order, number of calls, and type of call.
The method according to claim 1, wherein any one of the plurality of empty shell website detection conditions determines that the first website of the plurality of websites is the empty shell website Determining whether the first website is the empty website website by using the other empty shell website conditions in the plurality of empty shell website detection conditions, and determining that the first website is the In the case of the empty shell website, determining that the first website is the empty shell website, otherwise, in the case that the any one of the empty shell websites detects that the first website is not the empty website, The first website is a legal website.
The method according to any one of claims 1 to 3, wherein the empty shell website detection condition comprises any one or more of the following types: whether the any one of the websites is in the white list, whether it is in the record or not. Or whether there is an access record during the record change, whether it is registered, and whether there is report information in the analysis result.
The method according to claim 4, wherein when the empty shell website detecting condition is to detect whether the any one website is in a white list, the empty shell website detecting condition is used to determine whether any one website is The steps of the empty shell website include:

Reading the website information of any one of the websites;

Determining whether the website information of any one of the websites matches the website information saved in the white list;

In case the matching is successful, it is determined that any one of the websites is a legitimate website.
The method according to claim 4, wherein when the empty shell website detecting condition is to detect whether the any one website has an access record within a predetermined time, the empty shell website detecting condition is used to determine any one The steps for whether a website is an empty website include:

Obtaining an access log of the domain name recorded by the plurality of websites in the server;

Querying in the access log according to the domain name of any one of the websites whether to record in the predetermined time Have access records;

If the access record is recorded within the predetermined time, it is determined that the any one of the websites is a legitimate website.
The method according to claim 4, wherein when the empty shell website detecting condition is to detect that any one of the websites is in a record or a record change, the empty shell website detecting condition is used to determine any one website. The steps for an empty shell site include:

Reading the website information of any one of the websites, wherein the website information includes: a record status of the domain name of any one of the websites;

Determining whether the filing status of the domain name of any one of the websites is in the record or in the record change;

In a case where the filing status of the domain name of any one of the websites is in the filing or the filing change, it is determined that the any one of the websites is a legitimate website.
The method according to claim 4, wherein when the empty shell website detecting condition is whether the any one website is registered and whether the parsing result has report information, the empty shell website detecting condition is used to determine any The steps for whether a website is an empty shell include:

Reading the website information of any one of the websites;

Querying in the registration information table whether there is information matching the website information of any one of the websites;

In the case that the matching is successful, the type of the any one of the websites is determined according to whether the result of the analysis of any one of the websites has the report information.
The method according to claim 8, wherein determining the type of the any one of the websites according to whether the result of any one of the website parsings has the report information comprises:

If the IP address of any one of the websites is the same as the IP address already recorded by the access provider server, determining that any one of the websites is a legitimate website;

In a case where the IP address of any one of the websites is different from the IP address already recorded by the access provider server, it is determined that the any one of the websites is the empty website.
The method according to claim 1, wherein after extracting a plurality of websites to be detected, the method further comprises:

The website information of the plurality of websites is sequentially written into the data queue by starting at least n data distribution threads;

Reading website information of the plurality of websites sequentially from the data queue by starting at least m detection threads;

Wherein m and n are automatically adjusted according to a preset total detection time, m is greater than or equal to n, and m and n are natural numbers.
The method of claim 1 wherein the website information for each website further comprises said each The terminal address of the sponsor of the website, wherein after the output of the detection result is the website of the empty website, the method further includes:

Sending alarm information to a terminal address determined to be the sponsor of the empty shell website, wherein the alarm information includes at least a domain name of the empty shell website.
The method according to claim 1, wherein after the sending of the alarm information to the terminal address of the sponsor determined to be the empty shell website, the method further comprises:

After the preset duration arrives, the steps A to C are repeatedly performed to obtain a website that is determined to be the empty shell website again;

Recording the website that is determined to be the empty shell website again as the website to be cleaned;

Send the domain name of the website to be cleaned to the target server.
An apparatus for detecting a shell website, comprising:

An extracting unit, configured to extract a plurality of websites to be detected;

a calling unit, configured to invoke one or more empty shell website detection conditions from the website detection condition set, and use the one or more empty shell website detection conditions to determine whether any one website is an empty shell website;

An output unit, configured to output a website whose detection result is the empty shell website.
The device according to claim 13, wherein the calling unit comprises:

The calling module is configured to invoke the empty shell website detecting condition in the website detecting condition set according to a predetermined calling rule, wherein the predetermined calling rule includes any one or more of the following rules: calling order, calling quantity, and calling type .
The device according to claim 13, wherein the calling unit further comprises:

a determining module, configured to determine, after using the one of the plurality of empty shell website detection conditions, that the first website of the plurality of websites is the empty shell website, using the plurality of empty shells Determining, by the website detecting condition, other empty shell website conditions to determine whether the first website is the empty shell website, and determining that the first website is the empty shell website when all the empty website detecting conditions determine that the first website is the empty shell website, The first website is the empty website, otherwise, if the any of the empty website detection conditions determines that the first website is not the empty website, the first website is determined to be a legitimate website.
Apparatus according to any one of claims 13 to 15 wherein:

The empty shell website detection condition includes any one or more of the following types: whether the any one of the websites is in the white list, whether it is in the record or in the record change, whether there is an access record within a predetermined time, whether it is registered, and parsing The result is whether there is a report information.
The device according to claim 16, wherein the calling unit further comprises:

An obtaining module, configured to obtain an access log of the domain name recorded by the plurality of websites in the server;

a querying module, configured to query, in the access log, whether an access record is recorded within the predetermined time according to the domain name of any one of the websites;

And a second determining module, configured to determine that any one of the websites is a legitimate website if the access record is recorded within the predetermined time.
The device according to claim 16, wherein the calling unit comprises:

a second reading module, configured to read website information of any one of the websites, where the website information includes: a filing status of a domain name of any one of the websites;

a second determining module, configured to determine whether the filing status of the domain name of the any one of the websites is in the record or in the record change;

And a third determining module, configured to determine that any one of the websites is a legitimate website if the filing status of the domain name of the any one of the websites is in the filing or the filing change.
The device according to claim 16, wherein the calling unit comprises:

a third reading module, configured to read website information of any one of the websites;

a second query module, configured to query, in the registration information table, whether there is information that matches the website information of any one of the websites;

And a fourth determining module, configured to determine, according to whether the result of any one of the website parsings is reported, whether the type of the any one of the websites is determined, if the matching is successful.
The apparatus according to claim 19, wherein the fourth determining module comprises:

a sub-determination module, configured to determine, according to the IP address of the domain name of any one of the websites, the type of the any one of the websites; wherein, the IP address of the any one of the websites and the IP that has been recorded by the access provider server If the addresses are the same, it is determined that the any one of the websites is a normal website; and if the IP address of any one of the websites is different from the IP address already recorded by the access server, determining any one of the websites For the empty shell website.
The device according to claim 13, wherein the device further comprises:

a data distribution unit, configured to sequentially write website information of the plurality of websites into the data queue by starting at least n data distribution threads;

a detecting unit, configured to sequentially read website information of the plurality of websites from the data queue by starting at least m detecting threads; wherein, m and n are automatically adjusted according to a preset total detection time, where m is greater than or equal to n, And m and n are natural numbers.
A system for detecting a shell website, characterized in that the system comprises:

a filing server for storing information of a plurality of websites;

The detecting server establishes a communication relationship with the filing server, and after extracting a plurality of websites to be detected from the filing server, calling one or more empty shell website detecting conditions from the website detecting condition set, and using the Describe one or more empty shell website detection conditions to determine whether any one website is a shell website, and output a detection result to the website of the empty shell website.
The system according to claim 22, wherein the detecting server is further configured to invoke the empty shell website detecting condition in the website detecting condition set according to a predetermined calling rule, wherein the predetermined calling rule comprises the following Any one or more rules: call order, number of calls, and type of call.
The system according to claim 22, wherein said detecting server is further configured to determine a first one of said plurality of websites using any one of said plurality of empty shell website detecting conditions After the website is the empty shell website, use the other empty shell website conditions in the plurality of empty shell website detection conditions to determine whether the first website is the empty shell website, and the detection conditions are determined on all the empty shell websites. If the first website is the empty website, determining that the first website is the empty website, otherwise, detecting, by the any one of the empty website, that the first website is not the empty In the case of a shell website, it is determined that the first website is a legitimate website.
The system according to any one of claims 22 to 24, wherein the empty shell website detection condition comprises any one or more of the following types: whether the any one of the websites is in the white list, whether or not it is in the record. Or whether there is an access record during the record change, whether it is registered, and whether there is report information in the analysis result.