WO2017193626A1 - 一种威胁检测方法、装置及网络系统 - Google Patents

一种威胁检测方法、装置及网络系统 Download PDF

Info

Publication number
WO2017193626A1
WO2017193626A1 PCT/CN2017/071149 CN2017071149W WO2017193626A1 WO 2017193626 A1 WO2017193626 A1 WO 2017193626A1 CN 2017071149 W CN2017071149 W CN 2017071149W WO 2017193626 A1 WO2017193626 A1 WO 2017193626A1
Authority
WO
WIPO (PCT)
Prior art keywords
code
display page
page
display
page group
Prior art date
Application number
PCT/CN2017/071149
Other languages
English (en)
French (fr)
Inventor
陈甲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2018540440A priority Critical patent/JP6585853B2/ja
Priority to ES17795253T priority patent/ES2764672T3/es
Priority to EP17795253.8A priority patent/EP3306510B1/en
Publication of WO2017193626A1 publication Critical patent/WO2017193626A1/zh
Priority to US15/866,236 priority patent/US11036849B2/en
Priority to US17/103,247 priority patent/US11604872B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a threat detection method, apparatus, and network system.
  • a sandbox is a virtual execution environment created on a computer and can also be considered a copy of the operating system. Regardless of which suspicious file is opened in the sandbox, the operation of the suspicious file on the computer's hard disk and the registry in the operating system is directed to the temporary folder.
  • the suspicious file has an attack code such as a Trojan virus or an ad plugin
  • the scope of the attack is limited to the virtual environment and does not affect the real operating system.
  • the files that have been run in the sandbox are automatically cleared and the computer is not poisoned. Therefore, the user can determine if the location file has an attack code by running an unknown file in the sandbox.
  • the detection principle of the Web sandbox is to simulate the real environment of the user's browser, and to detect and analyze the behavior of the current page during the loading process, and finally to determine whether the current page has a threatening behavior to the user's system environment.
  • the time-delay loading technique means that when a user loads a Uniform/Universal Resource Locator (URL), the web server does not return all the content of the URL identifier once, but only obtains it from the database first. Some of the content is returned to the user. At this time, the user only sees the content returned by the web server in the browser interface. Only when the user continues to browse the webpage backwards, the resource and page loading of downloading the subsequent page (hereinafter referred to as: lazy loading page) are triggered. And rendering processing.
  • URL Uniform/Universal Resource Locator
  • lazy loading technology can become a commonly used technology by reducing network throughput and speeding up user browser loading, reducing user latency and improving user experience.
  • the attack code embedded in the lazy loading page cannot be detected, causing the web sandbox to be missed.
  • the embodiment of the present application provides a threat detection method, apparatus, and network system, which can solve the problem of missed detection of a Web sandbox in a scenario of lazy loading.
  • the embodiment of the present application provides a threat detection method.
  • a threat detection device loads a uniform resource locator URL in a browser of a web sandbox, first obtains a page code of a first display page group of the URL identifier from the web server.
  • the page code of the first display page group includes a monitoring code
  • the monitoring code is used to obtain and monitor the value of the displayed variable
  • the displayed variable The value is used to indicate the size of the display page displayed between the first display page of the first display page group and the currently displayed page in the display area of the browser
  • the threat detecting device Placing a preset dynamic code in the page code of the first display page group that is obtained, and parsing and executing the page code of the first display page group including the preset dynamic code, and sequentially displaying the first display page group Display page, the preset dynamic code is used to trigger the switching from the current display page to the next display page of the current display page, and then, at When the threat detecting device detects that the value of the displayed variable is greater than or equal to the preset value, the threat detecting device sends a request message carrying the display page group identifier to the web server, to request the web server to acquire the second display page group.
  • the page display code, the first display page in the second display page group is the last display page of the last display page in the first display page group, and the preset value is greater than or equal to the first display page of the first display page group.
  • the size occupied by the display area of the browser is smaller than the overall size occupied by the first display page group in the display area of the browser.
  • the threat detecting device receives the response message sent by the web server in response to the request message.
  • the response message includes a page code of the second display page group, and detects in the sandbox whether the page code of the second display page group acquired by the sandbox carries the attack code.
  • the preset dynamic code is used to trigger the threat detection device to switch from the current display page to the next display page of the current display page, that is, the preset dynamic code can automatically display the current display page to the subsequent display page.
  • the function of scrolling which is equivalent to the process of human-computer interaction. Since the preset dynamic code is used to automatically scroll the current display page to the next display page, the threat detecting device in the embodiment of the present application displays the preset dynamic display when displaying the last displayed page in the first display page group. The threat detecting device needs to continue to display the first display page in the second display page group, thereby triggering the threat detecting device to acquire the page code of the second display page group, thereby causing the threat detecting device to be in the Web sandbox.
  • the threat detection device can also detect whether the attack code is carried in the lazy loaded page code in the web sandbox, thereby avoiding the missed detection of the web sandbox.
  • the threat detecting apparatus in the embodiment of the present application may receive, by using a socket socket interface, a page code of the first display page group sent by the web server.
  • the threat detecting device may embed the preset dynamic code into the page code of the first display page group when receiving the page code of the first display page group through the Socket interface.
  • the setting hook program is linked to the network layer protocol processing function of the Web sandbox in the embodiment of the present application, and the hook program is configured to intercept the page code of the first display page group.
  • the threat detection device implants the preset dynamic code into the page code of the first display page group.
  • the hook program is hooked into the browser kernel of the web sandbox in the threat detection device, and the hook program is used to intercept the page code of the first display page group.
  • the threat detection device implants the preset dynamic code into the page code of the first display page group.
  • the threat detecting apparatus in the embodiment of the present application can implant the preset dynamic code into the first display page group at different times, and the implantation timing is flexible.
  • the dynamic code in the embodiment of the present application is placed at the end of the page code of the first display page group.
  • the threat detection device places the preset dynamic code at the end of the page code of the first display page group, which does not affect the existing structure of the page code of the first display page group, and is convenient for the developer to recognize, and is also implemented in the code implementation. easier.
  • an embodiment of the present application provides a threat detection apparatus, where the threat detection apparatus includes: a processing unit, a display unit, a sending unit, and a receiving unit.
  • the processing unit configured to: when loading the uniform resource locator URL in the browser of the web sandbox, obtain the page code of the first display page group and the first display page group of the URL identifier from the web server in the display area of the browser
  • the overall size of the page, the page code of the first display page group contains a monitoring code, which is used to obtain and monitor the value of the displayed variable, the value of the displayed variable is used to indicate in the display area of the browser, a size of a display page displayed between the first display page of the display page group and the currently displayed display page, and a preset dynamic code for embedding the page code in the first display page group
  • the preset dynamic code is used to trigger a subsequent display page that switches from the current display page to the current display page, and a page code for parsing and executing the first display page group including the preset dynamic code.
  • the display unit is configured to sequentially display the display page in the first display page group according to the page code of the first display page group including the preset dynamic code parsed and executed by the processing unit.
  • the sending unit is configured to: when the processing unit detects that the value of the displayed variable is greater than or equal to the preset value, send a request message to the web server, where the request message is used to request the web server to obtain the page code of the second display page group.
  • the first display page in the second display page group is the last display page of the last display page in the first display page group, and the preset value is greater than or equal to the first display page of the first display page group in the browser.
  • the size occupied by the display area is smaller than the overall size of the first display page group in the display area of the browser.
  • the receiving unit is configured to receive a response message sent by the web server, where the response message includes a page code of the second display page group.
  • the processing unit is further configured to detect, in the web sandbox, whether an attack code is carried in a page code of the second display page group received by the receiving unit.
  • the dynamic code preset in the embodiment of the present application is used to trigger the switching from the current display page to the next display page of the current display page, that is, the preset dynamic code can implement the function that the current display page automatically scrolls to the subsequent display page.
  • the threat detecting apparatus in the embodiment of the present application implants a preset dynamic code in the page code of the first display page group that is acquired, so that the threat detecting apparatus can automatically display all the display pages in the first display page group in sequence. .
  • the threat detecting device is triggered to interact with the web server to obtain the page code of the second display page group, so that the threat detecting device can detect the second in the web sandbox. Whether the attack code is carried in the page code of the page group is displayed, which avoids the missed detection of the web sandbox.
  • the processing unit is configured to receive, by using a socket Socket interface, a page code of the first display page group identified by the URL sent by the web server.
  • the hook program is linked to the network layer protocol processing function of the web sandbox, and the hook program is configured to intercept the page code of the first display page group, and the processing unit is specifically configured to obtain the first display in the hook program.
  • the preset dynamic code is implanted into the page code of the first display page group.
  • the hooking program hooks the browser kernel of the web sandbox, and the hook program is configured to intercept the page code of the first display page group, and the processing unit is specifically configured to obtain the first display page group in the hook program.
  • the page code is populated with the preset dynamic code into the page code of the first display page group.
  • the preset dynamic code in the embodiment of the present application is placed at the end of the page code of the first display page group.
  • another embodiment of the present application provides a computer readable storage medium including one or more program codes; when the processor of the threat detecting device executes the program code, the threat detection The apparatus performs the threat detection method as described in any of the above aspects and various alternative implementations thereof.
  • another embodiment of the present application provides a network system, including at least one threat detection apparatus and a web server according to any of the foregoing aspects and various alternative implementations, each of the at least one threat detection apparatus Each threat detection device is connected to the web server via a network.
  • the web server is configured to send, according to the request sent by the threat detecting device, a corresponding page code to the threat detecting device, so that the threat detecting device detects the page code of the received display page group in the web sandbox. Whether there is an attack code in it.
  • the web server sends the page code of the first display page group of the URL identifier to the threat detecting device according to the uniform resource locator URL sent by the threat detecting device, and the web server sends the request for the request according to the threat detecting device.
  • the request message of the page code of the second display page group sends the page code of the second display page group to the threat detecting device.
  • FIG. 1 is a schematic structural diagram 1 of a network system according to an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram 2 of a network system according to an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram 3 of a network system according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a threat detection method according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram 1 of a threat detecting apparatus according to an embodiment of the present disclosure.
  • FIG. 6 is a second schematic structural diagram of a threat detecting apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a network system according to an embodiment of the present application.
  • Embodiments of the present application can be implemented as a computer implemented process (method), a computing system, or an article of manufacture such as a computer program product or computer readable medium.
  • the computer program product can be a computer storage medium readable by a computer system and encoding a computer program comprising instructions for causing a computer or computing system to perform the example processes.
  • the computer readable storage medium is a non-transitory computer readable memory device.
  • a computer readable storage medium may be implemented via one or more of volatile computer memory, nonvolatile memory, a hard drive, a flash drive, a floppy disk or a compact disk and the like.
  • the embodiment of the present application provides a threat detection method, and the URL identifier obtained by the threat detecting device is obtained.
  • a preset dynamic code for triggering switching from the current display page to the next display page of the current display page is embedded in the page code of the first display page group, so that the threat detecting device can automatically display the first display page group in sequence All the display pages in the display, and under the action of automatically displaying the page scrolling function, the interaction between the threat detecting device and the web server is implemented to obtain the page code of the second display page group, thereby making the threat detecting device Checking whether the attack code is carried in the page code of the second display page group in the web sandbox avoids the missed detection of the web sandbox.
  • the threat detecting device in the embodiment of the present application may be a user terminal in which a Web sandbox is built in, or may be a security detecting device in which a Web sandbox is established, and the security detecting device is located between the Web server and the user terminal. It can be a dedicated bypass detection device with a built-in web sandbox.
  • the dedicated bypass detection device with the built-in Web sandbox may be a dedicated bypass detection device with a Web sandbox established in the virtual operating system, or a dedicated bypass detection device with a Web sandbox established in the real operating system. .
  • the user terminal may be a wireless terminal or a wired terminal.
  • the wireless terminal can be a device that provides voice and/or data connectivity to the user, a handheld device with wireless connectivity, or other processing device that is connected to the wireless modem.
  • the wireless terminal can communicate with one or more core networks via a radio access network (e.g., RAN, Radio Access Network).
  • the wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, or can be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that is connected to the wireless device.
  • Incoming exchange language and/or data for example, Personal Communication Service (PCS), cordless telephone, Session Initiation Protocol (SIP) telephone, Wireless Local Loop (WLL) station, personal digital assistant (PDA, Personal Digital Assistant) and other devices.
  • PCS Personal Communication Service
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • a wireless terminal may also be referred to as a User Agent, User Device, or User Equipment.
  • the threat detection method provided by the embodiment of the present application is applied to a network system.
  • the network system includes at least one threat check Test device and web server.
  • the threat detecting device is a user terminal in which a web sandbox is built
  • the structure of the network system to which the threat detecting method provided by the embodiment of the present application is applied is as shown in FIG. 1 .
  • the network system includes a web server 10 and at least one user terminal 11 internally built with a web sandbox 12, and the web server 10 is connected to each user terminal 11 via a network.
  • the web server 10 stores information such as text and media, such as audio, video, images, graphics, illustrations, and tables.
  • the web server 10 mainly provides content or services to the user terminal 11, for example, the web server 10 transmits a page code corresponding to a certain URL to the user terminal 11.
  • the web server 10 in the embodiment of the present application may be a computing device that executes one or more software programs in a networked environment, or may be executed on one or more computing devices that are regarded as web servers on the network.
  • the virtual web server, the virtual web server is implemented by a software program.
  • a web sandbox 12 is established in the user terminal 11, and the user terminal 11 can communicate with the web sandbox 12 established therein by a predefined communication protocol.
  • the user terminal 11 may request the web server 10 to obtain the page code through the web sandbox 12, wherein the content represented by the page code may include various components of the website, such as images, text components, media, or any combination thereof.
  • the user terminal 11 can detect in the Web sandbox 12 whether the page code sent to the Web server 10 carries the attack code.
  • the network in the embodiment of the present application may be any network architecture provided by wired or wireless technology.
  • the threat detecting device is a security device in which a web sandbox is built
  • the structure of the network system to which the threat detecting method provided by the embodiment of the present application is applied is as shown in FIG. 2 .
  • the network system includes a web server 20, a security device 21 internally built with a web sandbox 23, and at least one user terminal 22, and the web server 20 and the security device 21 are connected through a network, and the security device 21 and each user The terminals 22 are connected by a network.
  • the functions that the web server 20 can implement in the embodiment of the present application are the same as those implemented by the web server 10 in the previous example, and are not described in detail herein.
  • a security sandbox 23 is established in the security device 21, and the security device 21 can communicate with the Web sandbox 23 established therein by a predefined communication protocol.
  • the secure device 21 can request the web server 20 to acquire the page code through the web sandbox 23.
  • the security device 21 can detect in the web sandbox 23 whether or not the attack code is carried in the page code sent to the web server 20 to it.
  • the user terminal 22 interacts with the security device 21 to obtain a detection result of the security device 23 detecting whether an attack code is carried in a certain page code.
  • the threat detection device is a dedicated bypass detection device with a Web sandbox built therein
  • the structure of the network system to which the threat detection method provided by the embodiment of the present application is applied is as shown in FIG. 3 .
  • the network system includes a web server 30, a switch 31, a dedicated bypass detecting device 32 internally built with a web sandbox, and at least one user terminal 33.
  • the web server 30 and the switch 31 are connected through a network, and the switch 31 and The dedicated bypass detecting devices 32 are connected by a network, and the switch 31 is connected to each user terminal 33 via a network.
  • the switch 31 When the switch 31 detects the request message including the URL sent by the user terminal 33 to the web server 30, the switch 31 mirrors the request, copies a request message including the URL, and transmits it to the dedicated bypass detecting device 32.
  • the switch 31 in the embodiment of the present application can be replaced by a router.
  • the web sandbox inside the dedicated bypass detection device 32 may be established in the virtual operating system of the dedicated bypass detection device or may be established in the real operating system of the dedicated bypass detection device. Through a predefined communication protocol, the dedicated bypass detection device 32 can communicate with its internally established web sandbox. After acquiring the request message including the URL, the dedicated bypass detecting device 32 may request the web server 30 to obtain the page code corresponding to the URL through its internal web sandbox. The dedicated bypass detection device 32 can detect in its web sandbox whether or not the attack code is carried in the page code sent to it by the web server 30.
  • a threat detection method, apparatus, and network system provided by the embodiments of the present application are applicable to a scenario of delay loading.
  • FIG. 4 is a schematic flowchart of a threat detection method according to an embodiment of the present application.
  • the threat detection method may be applied to a network system shown in any one of FIG. 1 to FIG. 3.
  • the threat detection method includes:
  • the threat detecting device acquires, from the web server, the page code of the first display page group identified by the URL and the first display page group in the display area of the browser. total measurement.
  • the page code of the first display page group contains a monitoring code for obtaining and monitoring the value of the displayed variable.
  • the value of the displayed variable is used to indicate the size of the displayed page displayed between the first display page of the first display page group and the currently displayed page in the display area of the browser.
  • the threat detection device implants a preset dynamic code in a page code of the first display page group.
  • the preset dynamic code is used to trigger the switching from the current display page to the next display page of the current display page, that is, the preset dynamic code can realize the function that the current display page automatically scrolls to the subsequent display page, the function, etc.
  • the price is the process of human-computer interaction.
  • the threat detection device parses and executes a page code of the first display page group including the preset dynamic code, and sequentially displays the display page in the first display page group.
  • the threat detecting device When it is detected that the value of the displayed variable is greater than or equal to the preset value, the threat detecting device sends a request message to the web server for requesting the web server to obtain the page code of the second display page group.
  • the first display page in the second display page group is the last display page of the last display page in the first display page group. That is to say, the threat detection device first displays all the display pages in the first display page group, and then displays all the display pages in the second display page group.
  • the preset value is greater than or equal to the size of the first display page of the first display page group in the display area of the browser, and is smaller than the overall size of the first display page group in the display area of the browser.
  • the web server sends a response message carrying the page code of the second display page group to the threat detection device.
  • the threat detection device detects, in the web sandbox, whether the attack code is carried in the page code of the second display page group.
  • a client capable of parsing a web page is built in, and the client is a common browser or other application integrated with a built-in browser.
  • An application is a computer program that is developed to run on an operating system in order to complete a particular task or tasks.
  • the application capable of parsing the web page in the embodiment of the present application is an application compatible with the system installed in the web sandbox of the threat detecting device.
  • the embodiment of the present application is described by taking a browser built in the web sandbox of the threat detecting device as an example.
  • the process of the threat detecting device opening a webpage through a browser in its real operating system can be regarded as a communication process between the browser and the web server in the threat detecting device.
  • the browser when the browser loads a URL, the browser first acquires a part of all page codes corresponding to the URL from the web server, and loads the obtained page code. Only when the user pulls down the scroll bar or triggers the display page to slide down, the browser in the threat detection device will continue to communicate with the web server to retrieve and load the subsequent page code.
  • each segment of the page code after the segmentation is referred to as a page code in the embodiment of the present application.
  • the web server returns a page code corresponding to the request message to the threat detecting device according to the request message sent by the threat detecting device.
  • the content represented by the page code returned by the web server each time can be displayed in at least one display page, and therefore, the page code returned by the web server each time is the page code of the display page group.
  • the display page group in the embodiment of the present application is composed of at least one display page.
  • the web server splits all the page codes corresponding to the URLs in the prior art. For details, refer to the description of the prior art.
  • the page code of the first display page group identified by the URL is obtained from the web server.
  • the page code of the first display page group is a part of all the page codes corresponding to the URL, and the page code of the first display page group is the first time the threat detection device obtains the page when the browser loads the URL in the embodiment of the present application. Code.
  • the threat detecting device in the embodiment of the present application loads the URL in the browser of the web sandbox, the page code of the first display page group and the first display page group of the URL identifier are obtained from the web server in the browser.
  • the method for the threat detection device web server to obtain the page code of the first display page group identified by the URL is that the threat detection device sends a request message carrying the URL to the web server, and the web server sends the page of the first display page group to the threat detection device according to the URL. Code.
  • the page code of the first display page group may be represented by a JavaScript scripting language, or may be expressed by a VBScript (Visual Basic Script) scripting language, and may also be represented by any other scripting language for supporting webpage content.
  • VBScript Visual Basic Script
  • the application examples are not specifically limited thereto.
  • the threat detecting device After acquiring the page code of the first display page group from the web server, the threat detecting device also acquires the overall size occupied by the first display page group in the display area of the browser.
  • the overall size of the first display page group in the display area of the browser in the embodiment of the present application may be the height value of the visible area of the webpage occupied by the first display page group in the display area of the browser, The value of the visible area width of the webpage occupied by the first display page group in the display area of the browser, and the full text width value of the webpage of the first display page group in the display area of the browser. This example does not specifically limit this.
  • the threat detection device can obtain, by using the document.body.clientWidth interface, that the first display page group is visible in the browser display area.
  • the area width value is obtained by the document.body.clientHeight interface to obtain the height value of the visible area of the webpage occupied by the first display page group in the display area of the browser, and the first display page group obtained by the document.body.scrollWidth interface is browsed.
  • the definitions of the document.body.clientWidth interface, the document.body.clientHeight interface, and the document.body.scrollWidth interface can be referred to the browser communication protocol, and will not be described in detail here.
  • the embodiment of the present application can establish a Cartesian coordinate system at any position in the display screen of the threat detecting device, and the Cartesian coordinate system includes an X-axis and a Y-axis.
  • the direction parallel to the X-axis of the Cartesian coordinate system in any one of the first display page groups may be defined as a width (or height), and the direction parallel to the Y-axis of the Cartesian coordinate system may be defined in the display page. Is the height (or width).
  • the threat detection device after the threat detection device acquires the page code of the first display page group, the threat detection device implants a preset dynamic code in the page code of the first display page group that is acquired, that is, the threat detection device executes S401. .
  • the scripting language used in the dynamic code preset in the embodiment of the present application may be the same as the scripting language used in the page code of the first display page group, and may be different, which is not specifically limited in the embodiment of the present application. In the embodiment of the present application, it is only required that the page code of the first display page group and the preset dynamic code can be recognized by the threat detecting device.
  • the preset dynamic code may be the following code:
  • the threat detecting apparatus in the embodiment of the present application may place the preset dynamic code in the page code of the first display page group on the premise that the corresponding relationship of the labels in the page code of the first display page group is not affected. After any script paragraph in the paragraph.
  • the threat detecting means places the preset dynamic code at the end of the page code of the first display page group. This It does not affect the original structure of the page code of the first display page group, and is also convenient for developers to recognize. In addition, in practical applications, the implementation of the code is relatively simple.
  • the process of the threat detection apparatus in the embodiment of the present application for embedding the preset dynamic code in the page code of the first display page group may be sent by the web server through the socket interface.
  • the threat detecting device implants the preset dynamic code into the page code of the first display page group.
  • the process by which the threat detection device loads the URL in the browser of the web sandbox can be regarded as a communication process between the browser and the web server in the threat detection device.
  • the browser creates a Socket interface with the web server, and sends an HTTP request message to the web server according to the Hypertext Transfer Protocol (HTTP) specification; the web server parses the HTTP sent by the browser according to the HTTP specification. Requesting a message and sending a response message to the browser, the response message containing the page code, such as a JavaScript document; the browser parsing the page code in the response message and rendering it into a corresponding hypertext markup language (HTML, HyperText Markup) Language) page.
  • HTML HyperText Markup Language
  • the threat detection device in the embodiment of the present application receives the response message sent by the web server through the Socket interface, it first determines whether the response message contains the page code of the first display page group, and if so, the threat detection The device implants a preset dynamic code in the page code of the first display page group.
  • the threat detecting device in the embodiment of the present application is provided with a hook program, and the hook program is linked to the network layer protocol processing function of the web sandbox of the threat detecting device, where the hook program is used to intercept the page of the first display page group.
  • Code The process of the preset detection of the dynamic code in the page code of the first display page group in the threat detecting apparatus in the embodiment of the present application may be that when the hook program acquires the page code of the first display page group, the threat detecting device will The preset dynamic code is embedded in the page code of the first display page group.
  • the Web sandbox is equivalent to a copy of the operating system of the threat detection device, and therefore, the Web sandbox also contains various communication protocol layers.
  • the network layer of the Web sandbox in the embodiment of the present application is a protocol layer having the function of the network layer in the Transmission Control Protocol/Internet Protocol (TCP/IP) model.
  • TCP/IP Transmission Control Protocol/Internet Protocol
  • the NF_IP_LOCAL_IN hook program of the Linux netfilter mechanism is set in the threat detection device, and the NF_IP_LOCAL_IN hook program is linked to the network layer protocol processing function of the Web sandbox.
  • the threat detection device implants the preset dynamic code into the page code of the first display page group.
  • the threat detecting device in the embodiment of the present application is provided with a hook program, and the hook program hooks the browser kernel of the web sandbox, and the hook program is configured to intercept the page code of the first display page group.
  • the process of the preset detection of the dynamic code in the page code of the first display page group in the threat detecting apparatus in the embodiment of the present application may be that when the hook program acquires the page code of the first display page group, the threat detecting device will The preset dynamic code is embedded in the page code of the first display page group.
  • the browser in the web sandbox starts parsing and rendering the page code of the first display page group, and hooks the web
  • the threat detecting device implants the preset dynamic code into the page code of the first display page group.
  • the browser kernel of the Webkit browser There is a void Resource Loader::did Receive Data (Resource Handle*, const char*data, int length, int encoded DataLength) interface, and the threat detection device is provided with a hooker program hooking the browser kernel of the Webkit browser.
  • the hook program obtains the page code of the first display page group from the data parameter in the interface of the void Resource Loader::did Receive Data (Resource Handle*, const char*data, int length, int encoded DataLength)
  • the threat detecting device is The preset dynamic code is embedded in the page code of the first display page group pointed to by the data parameter.
  • the threat detecting device can obtain the page code of the first display page group including the preset dynamic code.
  • the threat detecting device After the threat detecting device obtains the page code of the first display page group including the preset dynamic code, the threat detecting device parses and executes the page code of the first display page group including the preset dynamic code, and sequentially displays the first display.
  • the display page in the page group that is, the threat detecting device executes S402.
  • the dynamic code preset in the embodiment of the present application is used to trigger the switching from the current display page to the next display page of the current display page, that is, the preset dynamic code can implement the function that the current display page automatically scrolls to the subsequent display page. This function is equivalent to the process of human-computer interaction.
  • the first display page group is composed of at least one display page. Therefore, when the threat detecting device parses and executes the page code of the first display page group including the preset dynamic code, the threat detecting device sequentially The display page in the first display page group is displayed.
  • the threat detecting device parses and executes the page code of the first display page group including the preset dynamic code
  • the threat detecting device monitors the change of the value of the displayed variable.
  • the value of the displayed variable is used to indicate that the display page of the first display page group of the first display page group is displayed in the display area of the browser. size. It is easy to understand that when the threat detecting device sequentially displays the displayed page in the first display page group, the value of the displayed variable gradually increases.
  • the value of the displayed variable may indicate the width of the visible area of the webpage occupied by the displayed display page in the display area of the browser, or may indicate that the displayed page of the displayed page is visible in the display area of the browser. Area height value.
  • the threat detecting device detects that the value of the displayed variable is greater than or equal to the preset value, the threat detecting device sends a request message to the web server, that is, the threat detecting device performs S403.
  • the request message sent by the threat detection device carries a display page group identifier, and the web server determines, according to the display page group identifier, which page number of the display page group the threat detection device needs to obtain.
  • the display page group identifier may be an identifier of the first display page group, or may be an identifier of the second display page group, which is not specifically limited in this embodiment of the present application. If the request message in the embodiment of the present application carries the identifier of the first display page group, the web server searches for the page code of the second display page group after the first display page group identified by the identifier of the first display page group. And return the page code of the second display page group. If the request message in the embodiment of the present application carries the identifier of the second display page group, the web server searches for the page code of the second display page group identified by the identifier of the second display page group and returns it.
  • the display page group identifier carried in the request message is the identifier of the second display page group
  • the display page group identifier may be the display order of the second display page group in all the displayed page groups, or may be The index information of the page group is displayed in the second embodiment, which is not specifically limited in this embodiment.
  • the request message may be To carry the opcode of get page2.
  • the web server sends a response message in response to the request message to the threat detecting device, where the response message carries the page code of the second display page group, that is, execution S404.
  • the threat detection device can obtain the page code of the second display page group.
  • the threat detecting device detects whether the attack code is carried in the page code of the second display page group in the web sandbox, that is, the threat detecting device executes S405.
  • the process of detecting whether the attack code is carried in the page code of the second display page group in the web sandbox may refer to the detection principle of the existing web sandbox, and details are not described herein again.
  • the page code of the second display page group belongs to the delay-loaded page code. Therefore, using the threat detection method provided by the present application, the threat detection device can detect whether the attack code is carried in the lazy loading page, thereby avoiding the missed detection of the web sandbox. .
  • the threat detecting device After the threat detecting device obtains the page code of the second display page group, the page code of the first display page group and the page code of the second display page group are merged into the same page code, and the threat detecting device continues to run at this time. Preset dynamic code. Therefore, the threat detection device will continue to automatically switch the display page.
  • the threat detecting device automatically switches the display page, triggering the threat detecting device to continue interacting with the web server, acquiring the page code of the subsequent displayed page group, and detecting the page code of the subsequent displayed page group until all the displays corresponding to the URL are detected. The page is loaded and the process ends.
  • the preset dynamic code is the code shown in the above example
  • the preset dynamic code shown in the above example as long as the value of the variable currentLocate is smaller than the value of the variable pageHeight, the current display page is automatically scrolled to the next one. Show page.
  • the threat detection device obtains the page code of the second display page group, the value of the variable pageHeight obtained by the threat detection device also increases, and therefore, the threat detection device continues to automatically switch the display page.
  • the threat detection device can obtain the lazy loaded page code in the web sandbox, so that the lazy loaded page code can be detected in the web sandbox to carry the attack.
  • the code avoids the missed detection of the web sandbox.
  • the embodiment of the present application provides a threat detecting apparatus 1 for performing the steps performed by the threat detecting apparatus in the above threat detecting method.
  • the threat detecting device 1 may include a module corresponding to the corresponding step.
  • the threat detecting apparatus 1 includes a processing unit 50, a display unit 51, a transmitting unit 52, and a receiving unit 53.
  • the processing unit 50 is configured to: when the uniform resource locator URL is loaded in the browser of the web sandbox, obtain the page code of the first display page group of the URL identifier from the web server, and the first display page group is The overall size occupied by the display area of the browser, the page code of the first display page group includes a monitoring code for acquiring and monitoring the value of the displayed variable, and the value of the displayed variable is used for Representing, in a display area of the browser, a size occupied by a display page displayed between a first display page of the first display page group and a currently displayed page, and Pre-set dynamic code is embedded in the page code of the first display page group, and the preset dynamic code is used to trigger switching from the current display page to the next display page of the current display page, and for parsing And executing a page code of the first display page group including the preset dynamic code.
  • a display unit 51 configured to perform, according to the processing unit 50, the first dynamic code including the preset A page code of the page group is displayed, and the display page in the first display page group is sequentially displayed.
  • the sending unit 52 is configured to send a request message to the web server when the processing unit 50 detects that the value of the displayed variable is greater than or equal to a preset value by using the monitoring code, where the request message is used to send
  • the web server requests to obtain a page code of a second display page group, where a first display page of the second display page group is a last display page of a last display page of the first display page group,
  • the preset value is greater than or equal to the size of the first display page of the first display page group in the display area of the browser, and is smaller than the display area of the first display page group in the browser The overall size of the account.
  • the receiving unit 53 is configured to receive a response message sent by the web server, where the response message includes a page code of the second display page group.
  • the processing unit 50 is further configured to detect, in the web sandbox, whether the attack code is carried in the page code of the second display page group received by the receiving unit 53.
  • processing unit 50 is specifically configured to receive, by using a socket Socket interface, a page code of the first display page group of the URL identifier sent by the web server.
  • the threat detecting apparatus 1 in the embodiment of the present application is configured to set a network layer protocol processing function of the web sandbox by using a hook program, where the hook program is configured to intercept a page code of the first display page group,
  • the processing unit 50 is configured to: when the hook program acquires the page code of the first display page group, insert the preset dynamic code into a page code of the first display page group .
  • the threat detecting apparatus 1 in the embodiment of the present application sets a hook program to hook the browser kernel of the web sandbox, and the hook program is configured to intercept the page code of the first display page group,
  • the processing unit 50 is configured to: when the hook program acquires the page code of the first display page group, insert the preset dynamic code into the page code of the first display page group.
  • the preset dynamic code is placed at the end of the page code of the first display page group.
  • the threat detecting apparatus 1 of the embodiment of the present application is only logically divided according to the functions implemented by the threat detecting apparatus 1. In practical applications, the superposition or splitting of the above units can be performed.
  • the functions implemented by the threat detecting apparatus 1 provided by the embodiment of the present application are in one-to-one correspondence with the threat detecting method provided by the foregoing embodiment.
  • the more detailed processing flow implemented by the threat detecting apparatus 1 is already in the foregoing method embodiment. A detailed description will not be described in detail here.
  • the threat detecting apparatus includes an interface circuit 60, a processor 61, a memory 62, a system bus 63, and a screen 64.
  • the interface circuit 60, the processor 61, the memory 62 and the screen 64 are connected by the system bus 63, and communication with each other is completed.
  • the structure of the threat detecting device shown in FIG. 6 is not a limitation on the threat detecting device, and may include more or less components than those illustrated, or combine some components or different components. Arrangement.
  • the threat detecting device when the threat detecting device operates, the threat detecting device performs the threat detecting method of the embodiment shown in FIG. 4.
  • the threat detecting device performs the threat detecting method of the embodiment shown in FIG. 4.
  • a web sandbox is established in the threat detecting apparatus in the embodiment of the present application.
  • the interface circuit 60 in the embodiment of the present application may be the transmitting unit 52 in the previous embodiment, or may be the receiving unit 53 in the previous embodiment.
  • the interface circuit 60 is configured to implement a communication connection between the threat detecting device and the web server.
  • the memory 62 in the embodiment of the present application may be the processing unit 50 in the previous embodiment.
  • the memory 62 can be used to store software programs and application modules
  • the processor 61 executes various functional applications and data processing of the threat detecting device by running software programs stored in the memory 62 and application modules.
  • the memory 62 may mainly include a storage program area 620 and a storage data area 621, wherein the storage program area 620 may store an operating system, an application required for at least one function, such as a send request message function, and the like; and the storage data area 621 may store the web server.
  • the page code sent such as the page code of the first display page group and the page code of the second display page group.
  • the memory 62 may include a volatile memory, such as a high-speed random access memory (RAM), and the memory 62 may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, Or other volatile solid-state storage devices, which are not specifically limited in this embodiment of the present application.
  • a volatile memory such as a high-speed random access memory (RAM)
  • the memory 62 may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, Or other volatile solid-state storage devices, which are not specifically limited in this embodiment of the present application.
  • the processor 61 in the embodiment of the present application may be the processing unit 50 in the previous embodiment.
  • the processor 61 is a control center of the threat detecting device.
  • the processor 61 connects various portions of the entire threat detection device using various interfaces and lines, performs threats by running or executing software programs and/or application modules stored in the memory 62, and recalling data stored in the memory 62.
  • the various functions and processing data of the device are detected to provide overall monitoring of the threat detection device.
  • the processor 61 can be a central processing unit (CPU).
  • the processor 61 may also be other general-purpose processors, digital signal processing (DSP), or other programmable logic devices or transistor logic devices, discrete hardware components, and the like, which are not specifically limited in this embodiment of the present application.
  • DSP digital signal processing
  • the general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the system bus 63 can include a data bus, a power bus, a control bus, a signal status bus, and the like.
  • the screen 64 in the embodiment of the present application may be the display unit 51 in the previous embodiment.
  • the embodiment of the present application provides a threat detection apparatus.
  • the threat detection apparatus stores a preset dynamic code, where the preset dynamic code is used to trigger the threat detection apparatus to switch from the current display page to the next display page of the current display page. Therefore, when the threat detecting device runs the page code of the first display page group and the preset dynamic code, the display page in the first display page group is sequentially displayed, and the threat detecting device detects that the value of the displayed variable is greater than Or equal to the preset value, the threat detection device interacts with the web server to obtain the page code of the second display page group.
  • the threat detection device can also obtain the lazy loaded page code in the web sandbox, so that the threat detection device detects whether the lazy loaded page code carries the attack code in the web sandbox. This prevents the threat detection device from missing the lazy loaded page code in the web sandbox.
  • the threat detection method described in the embodiment shown in FIG. 4 can also be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product. Based on such understanding, those skilled in the art will appreciate that embodiments of the present application can be provided as a method, an electronic device, or a computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer readable storage media including program code, including but not limited to a USB flash drive, a removable hard drive, a read only memory (ROM) , Read-Only Memory), disk storage, CD-ROM, optical storage, etc.
  • program code including but not limited to a USB flash drive, a removable hard drive, a read only memory (ROM) , Read-Only Memory), disk storage, CD-ROM, optical storage, etc.
  • the embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium includes one or more program codes, when the processor in the threat detecting device executes the program code, the threat detecting device Perform the threat detection method shown in Figure 4.
  • the embodiment of the present application further provides a network system.
  • the network system includes at least one threat detecting apparatus and a web server as described in the foregoing embodiments.
  • the web server is configured to send, according to the request sent by the threat detecting device, a corresponding page code to the threat detecting device, so that the threat detecting device detects, in the web sandbox, whether the page code of the received display page group is carried in the web sandbox. There is an attack code.
  • the web server sends the page code of the first display page group of the URL identifier to the threat detection device according to the uniform resource locator URL sent by the threat detection device; and the web server sends the second display according to the threat detection device.
  • the request message of the page code of the page group sends the page code of the second display page group to the threat detecting device.
  • the embodiment of the present application provides a network system.
  • the threat detection device in the network system stores a preset dynamic code, where the preset dynamic code is used to trigger the threat detection device to switch from the current display page to the current display page. a display page, therefore, when the threat detection device runs the page code of the first display page group and the preset dynamic code, the display page in the first display page group is sequentially displayed, and the displayed variable is detected by the threat detecting device. When the value is greater than or equal to the preset value, the threat detecting device interacts with the web server to obtain the page code of the second display page group.
  • the threat detection device can also obtain the lazy loaded page code in the web sandbox, so that the threat detection device detects whether the lazy loaded page code carries the attack code in the web sandbox. The detection of the lazy loaded page code by the threat detection device in the web sandbox is avoided.
  • the device embodiments described above are merely illustrative.
  • the division of modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

公开了一种威胁检测方法、装置及网络系统，涉及计算机技术领域，能够解决延迟加载的场景中Web沙箱的漏检问题。该方法包括：在Web沙箱的浏览器加载URL时，获取URL标识的第一显示页面组的页面代码和第一显示页面组在浏览器的显示区域中所占的整体尺寸；在第一显示页面组的页面代码中植入预设的动态代码；解析并执行包含预设的动态代码的第一显示页面组的页面代码；监测到已显示变量的数值大于或等于预设数值时发送请求消息，以请求获取第二显示页面组的页面代码；接收携带第二显示页面组的页面代码的响应消息；在Web沙箱中检测第二显示页面组的页面代码是否携带有攻击代码。

Description

一种威胁检测方法、装置及网络系统
本申请要求于2016年5月10日提交中国专利局、申请号为201610305868.1、发明名称为“一种威胁检测方法、装置及网络系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种威胁检测方法、装置及网络系统。
背景技术
随着计算机网络技术的发展与普及，越来越多的用户开始关注网络安全性问题，利用网络(Web)应用实现的网络攻击也频繁出现。例如，攻击者为了达到自己的攻击目的，往往通过各种手段将脚本、链接、图片、flash动画、插件等形式的攻击代码嵌入到动态页面所引用的数据库中，当用户的浏览器浏览到这部分攻击代码时，攻击者即可达到目的。
考虑到沙箱技术在攻击代码检测方面的优势，例如能够发现未知攻击、对运行沙箱的计算机本身的安全不会造成威胁等，人们将沙箱技术与浏览器技术相结合发展出Web沙箱，并利用Web沙箱对浏览器所访问的网页的安全性进行防护。沙箱是在计算机中创建一个虚拟执行环境，也可以被视为操作系统的副本。无论在沙箱中打开哪个可疑文件，该可疑文件对计算机的硬盘、操作系统中的注册表的操作都被定向指定到临时文件夹中。这样即便可疑文件带有木马病毒、广告插件等攻击代码，其影响范围也被限制在虚拟环境中的，不会影响真实的操作系统。随着沙箱的删除，沙箱中所运行过的文件也会自动清除，计算机也不会中毒。因此，用户可以通过在沙箱中运行某一未知文件，以确定该位置文件是否带有攻击代码。Web沙箱的检测原理是模拟用户浏览器的真实环境，并对当前页面在加载过程中发生的行为加以探测、分析，最终来判断当前页面是否对用户的系统环境有威胁行为。
由于现有的Web页面大量采用了延迟加载技术，使得Web沙箱对网页进行安全性检测时检测效果受到较大影响，特别是漏检现象比较严重。延时加载技术是指当用户使用浏览器加载一个统一资源定位符(URL，Uniform/Universal Resource Locator)时，Web服务器端不会一次性返回该URL标识的所有内容，仅会从数据库中先获取部分内容返回给用户。此时用户在浏览器界面中只会看到Web服务器本次返回的内容，只有当用户继续向后浏览网页时，才会触发下载后续页面(以下称为：延迟加载页面)的资源及页面加载和渲染处理。采用延迟加载技术后，可以降低网络吞吐和加速用户浏览器的加载速度，缩短用户等待时间从而提高用户体验，因此延迟加载技术成为一种被普遍使用的技术。然而，采用Web沙箱对网页进行安全性检测时，嵌入在延迟加载页面中的攻击代码无法被检测，造成Web沙箱的漏检问题。
发明内容
本申请的实施例提供一种威胁检测方法、装置及网络系统，能够解决延迟加载的场景中Web沙箱的漏检问题。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，本申请实施例提供一种威胁检测方法，威胁检测装置在Web沙箱的浏览器中加载统一资源定位符URL时，首先从Web服务器获取URL标识的第一显示页面组的页面代码和第一显示页面组在浏览器的显示区域中所占的整体尺寸，该第一显示页面组的页面代码包含监测代码，该监测代码用于获取并监测已显示变量的数值，该已显示变量的数值用于表示在浏览器的显示区域中，第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸，其次，该威胁检测装置在其获取到的第一显示页面组的页面代码中植入预设的动态代码，并解析并执行包含预设的动态代码的第一显示页面组的页面代码，依次显示第一显示页面组中的显示页面，预设的动态代码用于触发从当前显示页面切换至当前显示页面的后一显示页面，然后，在威胁检测装置监测到已显示变量的数值大于或等于预设数值时，该威胁检测装置向Web服务器发送携带显示页面组标识的请求消息，用以向所述Web服务器请求获取第二显示页面组的页面代码，第二显示页面组中的第一个显示页面为第一显示页面组中最后一个显示页面的后一显示页面，预设数值大于或等于第一显示页面组的第一个显示页面在浏览器的显示区域中所占的尺寸，且小于第一显示页面组在浏览器的显示区域中所占的整体尺寸，最后，该威胁检测装置接收Web服务器发送的响应于请求消息的响应消息，该响应消息包括第二显示页面组的页面代码，并在沙箱中检测其获取到的第二显示页面组的页面代码中是否携带有攻击代码。
本申请实施例中，预设的动态代码用于触发威胁检测装置从当前显示页面切换至当前显示页面的后一显示页面，即预设的动态代码可以实现当前显示页面自动向其后一显示页面滚动的功能，该功能等价于人机交互的过程。由于预设动态代码用于实现当前显示页面自动向其后一显示页面滚动，因此，本申请实施例中的威胁检测装置在显示第一显示页面组中最后一个显示页面时，在预设的动态代码的作用下，威胁检测装置需要继续显示第二显示页面组中的第一个显示页面，从而触发该威胁检测装置获取第二显示页面组的页面代码，进而使得该威胁检测装置在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码。这样，在延迟加载的场景中，威胁检测装置也可在Web沙箱中检测延迟加载的页面代码中是否携带攻击代码，避免了Web沙箱的漏检问题。
可选的，本申请实施例中威胁检测装置可以通过套接字Socket接口接收Web服务器发送的第一显示页面组的页面代码。
具体的，在这种场景中，威胁检测装置可以在其通过Socket接口接收第一显示页面组的页面代码时，将预设的动态代码植入至第一显示页面组的页面代码中。
可选的，设置钩子程序挂钩本申请实施例中Web沙箱的网络层协议处理函数，该钩子程序用于截获第一显示页面组的页面代码。这样，在钩子程序获取到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至第一显示页面组的页面代码中。
可选的，设置钩子程序挂钩威胁检测装置中Web沙箱的浏览器内核中，该钩子程序用于截获第一显示页面组的页面代码。这样，在钩子程序获取到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至第一显示页面组的页面代码中。
从上述描述可以看出，本申请实施例中的威胁检测装置可在不同时刻将预设的动态代码植入至第一显示页面组中，植入时机较为灵活。
可选的，本申请实施例中的动态代码被置于第一显示页面组的页面代码的末尾。
威胁检测装置将预设的动态代码置于第一显示页面组的页面代码的末尾，既不影响第一显示页面组的页面代码的已有结构，又便于开发人员的识别，在代码实现上也比较简单。
第二方面，本申请实施例提供一种威胁检测装置，该威胁检测装置包括：处理单元、显示单元、发送单元和接收单元。
具体的，本申请实施例提供的各个单元模块所实现的功能具体如下：
上述处理单元，用于在Web沙箱的浏览器中加载统一资源定位符URL时，从Web服务器获取URL标识的第一显示页面组的页面代码和第一显示页面组在浏览器的显示区域中所占的整体尺寸，第一显示页面组的页面代码包含监测代码，该监测代码用于获取并监测已显示变量的数值，该已显示变量的数值用于表示在浏览器的显示区域中，第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸，以及用于在第一显示页面组的页面代码中植入预设的动态代码，预设的动态代码用于触发从当前显示页面切换至当前显示页面的后一显示页面，以及用于解析并执行包含预设的动态代码的第一显示页面组的页面代码。
上述显示单元，用于根据上述处理单元解析并执行的包含预设的动态代码的第一显示页面组的页面代码，依次显示第一显示页面组中的显示页面。
上述发送单元，用于在上述处理单元监测到已显示变量的数值大于或等于预设数值时，向Web服务器发送请求消息，请求消息用以向Web服务器请求获取第二显示页面组的页面代码，第二显示页面组中的第一个显示页面为第一显示页面组中最后一个显示页面的后一显示页面，预设数值大于或等于第一显示页面组的第一个显示页面在浏览器的显示区域中所占的尺寸，且小于第一显示页面组在浏览器的显示区域中所占的整体尺寸。
上述接收单元，用于接收Web服务器发送的响应消息，响应消息包括第二显示页面组的页面代码。
上述处理单元，还用于在所述Web沙箱中检测上述接收单元接收到的所述第二显示页面组的页面代码中是否携带有攻击代码。
本申请实施例中预设的动态代码用于触发从当前显示页面切换至当前显示页面的后一显示页面，即预设的动态代码可以实现当前显示页面自动向其后一显示页面滚动的功能。本申请实施例中的威胁检测装置在其获取到的第一显示页面组的页面代码中植入预设的动态代码，使得该威胁检测装置可自动依次显示第一显示页面组中的所有显示页面。在已显示变量的数值大于或等于预设数值时，触发该威胁检测装置与Web服务器进行交互，以获取第二显示页面组的页面代码，从而使得威胁检测装置可在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码，避免了Web沙箱的漏检问题。
可选的，上述处理单元，具体用于通过套接字Socket接口接收Web服务器发送的URL标识的第一显示页面组的页面代码。
可选的，设置钩子程序挂钩Web沙箱的网络层协议处理函数，该钩子程序用于截获第一显示页面组的页面代码，则上述处理单元，具体用于在该钩子程序获取到第一显示页面组的页面代码时，将预设的动态代码植入至第一显示页面组的页面代码中。
可选的，设置钩子程序挂钩Web沙箱的浏览器内核，该钩子程序用于截获第一显示页面组的页面代码，则上述处理单元，具体用于在该钩子程序获取到第一显示页面组的页面代码时，将预设的动态代码植入至第一显示页面组的页面代码中。
可选的，本申请实施例中的预设的动态代码被置于第一显示页面组的页面代码的末尾。
第三方面，本申请另一实施例提供一种计算机可读存储介质，该计算机可读存储介质包括一个或多个程序代码；当威胁检测装置的处理器在执行该程序代码时，该威胁检测装置执行如上述任一方面及其各种可选实现方式中所述的威胁检测方法。
本申请实施例提供的计算机可读存储介质的技术效果可以参见上述任一方面及其各种可选实现方式所述的对应技术效果，此处不再赘述。
第四方面，本申请另一实施例提供一种网络系统，包括至少一个如上述任一方面及其各种可选实现方式所述的威胁检测装置以及Web服务器，至少一个威胁检测装置中的每个威胁检测装置均与Web服务器之间通过网络连接。
具体的，Web服务器，用于根据上述威胁检测装置发送的请求，向上述威胁检测装置发送相应的页面代码，以使得上述威胁检测装置在Web沙箱中检测其接收到的显示页面组的页面代码中是否携带有攻击代码。
可选的，Web服务器根据上述威胁检测装置发送的统一资源定位符URL，向上述威胁检测装置发送URL标识的第一显示页面组的页面代码；Web服务器根据上述威胁检测装置发送的用于请求获取第二显示页面组的页面代码的请求消息，向上述威胁检测装置发送第二显示页面组的页面代码。
本申请实施例提供的网络系统的技术效果可以参见上述任一方面及其各种可选实现方式所述的威胁检测装置执行的威胁检测方法中描述的威胁检测装置的技术效果，此处不再赘述。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例。
图1为本申请实施例提供的网络系统的组成结构示意图一；
图2为本申请实施例提供的网络系统的组成结构示意图二；
图3为本申请实施例提供的网络系统的组成结构示意图三；
图4为本申请实施例提供的威胁检测方法的流程示意图；
图5为本申请实施例提供的威胁检测装置的结构示意图一；
图6为本申请实施例提供的威胁检测装置的结构示意图二；
图7为本申请实施例提供的网络系统的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行详细地描述。
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、接口、技术之类的具体细节，以便透切理解本申请。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施例中也可以实现本申请。在其它情况中，省略对众所周知的装置、电路以 及方法的详细说明，以免不必要的细节妨碍本申请的描述。
此外，本申请的说明书和权利要求书及附图中的术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请的实施例可被实现为计算机实现的过程(方法)、计算系统、或者诸如计算机程序产品或计算机可读介质等制品。计算机程序产品可以是计算机系统可读并且编码包括用于使计算机或计算系统执行示例过程的指令的计算机程序的计算机存储介质。计算机可读存储介质是非瞬态的计算机可读存储器设备。例如，计算机可读存储介质可经由易失性计算机存储器、非易失性存储器、硬盘驱动器、闪存驱动器、软盘或紧致盘和类似介质中的一个或多个来实现。
其中，本申请实施例中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
此外，本申请的说明书和权利要求书及附图中的术语“第一”和“第二”等是用于区别不同对象，而不是用于限定特定顺序。
针对在延迟加载的场景中，Web沙箱对网页进行安全性检测时出现的Web沙箱的漏检问题，本申请实施例提供了一种威胁检测方法，威胁检测装置在其获取到的URL标识的第一显示页面组的页面代码中植入用于触发从当前显示页面切换至当前显示页面的后一显示页面的预设的动态代码，使得该威胁检测装置可自动依次显示第一显示页面组中的所有显示页面，并在自动向后一显示页面滚动功能的作用下，实现该威胁检测装置与Web服务器之间的交互，以获取第二显示页面组的页面代码，从而使得该威胁检测装置在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码，避免了Web沙箱的漏检问题。
本申请实施例中的威胁检测装置，可以是内部建立有Web沙箱的用户终端，也可以是内部建立有Web沙箱的安全检测设备，该安全检测设备位于Web服务器与用户终端之间，还可以是内部建立有Web沙箱的专用旁路检测设备。其中，内部建立有Web沙箱的专用旁路检测设备可以是虚拟操作系统中建立有Web沙箱的专用旁路检测设备，也可以是真实操作系统中建立有Web沙箱的专用旁路检测设备。
其中，用户终端可以是无线终端也可以是有线终端。无线终端可以是指向用户提供语音和/或数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。无线终端可以经无线接入网(例如，RAN，Radio Access Network)与一个或多个核心网进行通信。无线终端可以是移动终端，如移动电话(或称为“蜂窝”电话)和具有移动终端的计算机，也可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据，例如，个人通信业务(PCS，Personal Communication Service)电话、无绳电话、会话发起协议(SIP)话机、无线本地环路(WLL，Wireless Local Loop)站、个人数字助理(PDA，Personal Digital Assistant)等设备。无线终端也可以称为用户代理(User Agent)、用户设备(User Device)、或用户装备(User Equipment)。
本申请实施例提供的威胁检测方法应用于网络系统。该网络系统包括至少一个威胁检 测装置和Web服务器。
可选的，结合上述描述，若威胁检测装置是内部建立有Web沙箱的用户终端，则本申请实施例提供的威胁检测方法所应用的网络系统的结构如图1所示。参见图1，该网络系统包括Web服务器10和至少一个内部建立有Web沙箱12的用户终端11，Web服务器10与每个用户终端11之间通过网络连接。
Web服务器10存储有文本和媒体等信息，例如音频、视频、图像、图表、图示和表格等。Web服务器10主要为用户终端11提供内容或服务，例如，Web服务器10向用户终端11发送与某一URL相对应的页面代码。
可选的，本申请实施例中的Web服务器10可以是在联网环境中执行一个或多个软件程序的计算设备，也可以是被视为网络上的Web服务器的一个或多个计算设备上执行的虚拟Web服务器，虚拟Web服务器通过软件程序实现。
用户终端11中建立有Web沙箱12，通过预定义的通信协议，用户终端11可与其内部建立的Web沙箱12进行通信。用户终端11可以通过Web沙箱12向Web服务器10请求获取页面代码，其中，页面代码所表示的内容可包括网站的各个组件，例如图像、文本组件、媒体或上述任意组合。用户终端11可以在Web沙箱12中检测Web服务器10向其发送的页面代码是否携带攻击代码。
本申请实施例中的网络可以是通过有线或无线技术提供的任何网络架构。
可选的，结合上述描述，若威胁检测装置是内部建立有Web沙箱的安全设备，则本申请实施例提供的威胁检测方法所应用的网络系统的结构如图2所示。参见图2，该网络系统包括Web服务器20、内部建立有Web沙箱23的安全设备21以及至少一个用户终端22，Web服务器20与安全设备21之间通过网络连接，安全设备21与每个用户终端22之间通过网络连接。
本申请实施例中Web服务器20所能实现的功能与上一示例中Web服务器10所实现的功能相同，此处不再详细赘述。
安全设备21中建立有Web沙箱23，通过预定义的通信协议，安全设备21可与其内部建立的Web沙箱23进行通信。安全设备21可以通过Web沙箱23向Web服务器20请求获取页面代码。安全设备21可以在Web沙箱23中检测Web服务器20向其发送的页面代码中是否携带攻击代码。
用户终端22与安全设备21交互，能够获得安全设备23检测某一页面代码中是否携带有攻击代码的检测结果。
可选的，结合上述描述，若威胁检测装置是内部建立有Web沙箱的专用旁路检测设备，则本申请实施例提供的威胁检测方法所应用的网络系统的结构如图3所示。参见图3，该网络系统包括Web服务器30、交换机31、内部建立有Web沙箱的专用旁路检测设备32以及至少一个用户终端33，Web服务器30与交换机31之间通过网络连接，交换机31与专用旁路检测设备32之间通过网络连接，交换机31与每个用户终端33通过网络连接。
本申请实施例中Web服务器30所能实现的功能与上述示例中Web服务器10所实现的功能相同，此处不再详细赘述。
交换机31在监测到用户终端33向Web服务器30发送的包含URL的请求消息时，将该请求镜像一份，即将包含URL的请求消息复制一份，并向专用旁路检测设备32发送。本申请实施例中的交换机31可以用路由器代替。
专用旁路检测设备32内部的Web沙箱可以是在该专用旁路检测设备的虚拟操作系统中建立，也可以是在该专用旁路检测设备的真实操作系统中建立。通过预定义的通信协议，专用旁路检测设备32可与其内部建立的Web沙箱进行通信。专用旁路检测设备32在获取到包含URL的请求消息后，可以通过其内部的Web沙箱向Web服务器30请求获取与URL对应的页面代码。专用旁路检测设备32可以在其Web沙箱中检测Web服务器30向其发送的页面代码中是否携带有攻击代码。
本申请实施例提供的一种威胁检测方法、装置及网络系统适用于延迟加载的场景中。
图4为本申请实施例提供的一种威胁检测方法的流程示意图，该威胁检测方法可以应用在图1-图3中任意一个附图所示的网络系统中。
参见图4，该威胁检测方法包括：
S400、在Web沙箱的浏览器中加载URL时，威胁检测装置从Web服务器获取URL标识的第一显示页面组的页面代码和第一显示页面组在所述浏览器的显示区域中所占的整体尺寸。
第一显示页面组的页面代码包含监测代码，监测代码用于获取并监测已显示变量的数值。已显示变量的数值用于表示在浏览器的显示区域中，第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸。
S401、威胁检测装置在第一显示页面组的页面代码中植入预设的动态代码。
预设的动态代码用于触发从当前显示页面切换至所述当前显示页面的后一显示页面，即预设的动态代码可以实现当前显示页面自动向其后一显示页面滚动的功能，该功能等价于人机交互的过程。
S402、威胁检测装置解析并执行包含预设的动态代码的第一显示页面组的页面代码，依次显示第一显示页面组中的显示页面。
S403、在监测到已显示变量的数值大于或等于预设数值时，威胁检测装置向Web服务器发送请求消息，用于向Web服务器请求获取第二显示页面组的页面代码。
其中，第二显示页面组中的第一个显示页面为第一显示页面组中最后一个显示页面的后一显示页面。也就是说，威胁检测装置会先显示第一显示页面组中的所有显示页面，紧接着显示第二显示页面组中的所有显示页面。
预设数值大于或等于第一显示页面组的第一个显示页面在浏览器的显示区域中所占的尺寸，且小于第一显示页面组在浏览器的显示区域中所占的整体尺寸。
S404、Web服务器向威胁检测装置发送携带第二显示页面组的页面代码的响应消息。
S405、威胁检测装置在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码。
本申请实施例中的威胁检测装置的Web沙箱中内置有能够解析Web页面的客户端，该客户端为常见的浏览器或者其他集成了内置浏览器的应用程序。
应用程序是指为了完成某项或某几项特定任务而被开发运行于操作系统之上的计算机程序。本申请实施例中的能够解析Web页面的应用程序为威胁检测装置的Web沙箱搭载的系统所兼容的应用程序。
为了方便理解，本申请实施例以威胁检测装置的Web沙箱中内置有浏览器为例进行说明。
一般情况下，威胁检测装置在其真实操作系统中通过浏览器打开某一网页的过程可以视为威胁检测装置中的浏览器与Web服务器之间的通信过程。具体的，在延迟加载的场景中，浏览器在加载一个URL时，该浏览器先从Web服务器获取到与该URL对应的所有页面代码的一部分，并加载其获取到的页面代码。只有在用户下拉滚动条或触发显示页面向下滑动时，威胁检测装置中的浏览器才会继续与Web服务器进行通信，获取并加载后续的页面代码。
可以看出，在延迟加载的场景中，与URL对应的所有页面代码会被Web服务器分割为若干段页面代码。为了便于描述，本申请实施例中将分割后的每段页面代码称为页面代码。Web服务器根据威胁检测装置发送的请求消息，向威胁检测装置返回与请求消息相对应的页面代码。Web服务器每次返回的页面代码所表示的内容可在至少一个显示页面中显示，因此，Web服务器每次返回的页面代码为显示页面组的页面代码。本申请实施例中的显示页面组由至少一个显示页面组成。
其中，延迟加载的场景中，Web服务器分割与URL对应的所有页面代码属于现有技术，具体可以参考现有技术的描述，本申请实施例对此不再进行详细赘述。
本申请实施例中的威胁检测装置在Web沙箱的浏览器中加载URL时，从Web服务器获取URL标识的第一显示页面组的页面代码。第一显示页面组的页面代码为与URL对应的所有页面代码中的一部分，且第一显示页面组的页面代码是本申请实施例中的浏览器加载URL时，威胁检测装置首次获取到的页面代码。
具体的，本申请实施例中的威胁检测装置在Web沙箱的浏览器中加载URL时，从Web服务器获取URL标识的第一显示页面组的页面代码和第一显示页面组在所述浏览器的显示区域中所占的整体尺寸，即威胁检测装置执行S400。
威胁检测装置Web服务器获取URL标识的第一显示页面组的页面代码的方法为威胁检测装置向Web服务器发送携带URL的请求消息，Web服务器根据该URL向威胁检测装置发送第一显示页面组的页面代码。
可选的，第一显示页面组的页面代码可以用JavaScript脚本语言表示，也可以用VBScript(Visual Basic Script)脚本语言表示，还可以用其他任意一种用于支持网页内容的脚本语言表示，本申请实施例对此不作具体限定。
威胁检测装置在从Web服务器处获取到第一显示页面组的页面代码后，还会获取第一显示页面组在浏览器的显示区域中所占的整体尺寸。
可选的，本申请实施例中第一显示页面组在浏览器的显示区域中所占的整体尺寸可以为第一显示页面组在浏览器的显示区域中所占的网页可见区域高度值，也可以为第一显示页面组在浏览器的显示区域中所占的网页可见区域宽度值，还可以为第一显示页面组在浏览器的显示区域中所占的网页正文全文宽度值，本申请实施例对此不作具体限定。
示例性的，若第一显示页面组的页面代码用JavaScript脚本语言表示，则威胁检测装置可以通过document.body.clientWidth接口获取到第一显示页面组在浏览器的显示区域中所占的网页可见区域宽度值，通过document.body.clientHeight接口获取到第一显示页面组在浏览器的显示区域中所占的网页可见区域高度值，通过document.body.scrollWidth接口获取到第一显示页面组在浏览器的显示区域中所占的网页正文全文宽度值。document.body.clientWidth接口、document.body.clientHeight接口和document.body.scrollWidth接口的定义可以参考浏览器通信协议，此处不再详细赘述。
其中，本申请实施例可在威胁检测装置的显示屏幕中的任一位置建立直角坐标系，该直角坐标系包括X轴和Y轴。第一显示页面组中的任一显示页面中与该直角坐标系的X轴平行的方向可定义为宽度(或高度)，则该显示页面中与该直角坐标系的Y轴平行的方向可定义为高度(或宽度)。
进一步地，威胁检测装置在获取到第一显示页面组的页面代码后，威胁检测装置在其获取到的第一显示页面组的页面代码中植入预设的动态代码，即威胁检测装置执行S401。
其中，本申请实施例中预设的动态代码所使用的脚本语言与第一显示页面组的页面代码所使用的脚本语言可以相同，也可以不同，本申请实施例对此不作具体限定。本申请实施例中只需要保证第一显示页面组的页面代码和预设的动态代码均能被威胁检测装置所识别即可。
示例性的，若预设的动态代码用JavaScript脚本语言表示，则预设的动态代码可以为如下代码：
Figure PCTCN2017071149-appb-000001
具体的，在不影响第一显示页面组的页面代码中各个标签的对应关系的前提下，本申请实施例中的威胁检测装置可以将预设的动态代码置于第一显示页面组的页面代码中的任意脚本段落之后。
优选的，威胁检测装置将预设的动态代码置于第一显示页面组的页面代码的末尾。这 样不会影响第一显示页面组的页面代码的原有结构，还便于开发人员的识别。此外，在实际应用中，代码的实现也比较简单。
另外，可选的，本申请实施例中的威胁检测装置在第一显示页面组的页面代码中植入预设的动态代码的过程可以是在通过套接字(Socket)接口接收Web服务器发送的第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至第一显示页面组的页面代码中。
威胁检测装置在Web沙箱的浏览器中加载URL的过程可以视为该威胁检测装置中的浏览器与Web服务器之间的通信过程。具体的，该浏览器创建与Web服务器之间的Socket接口，并根据超文本传输协议(HTTP，Hypertext Transfer Protocol)规范向Web服务器发送HTTP请求报文；Web服务器根据HTTP规范解析浏览器发送的HTTP请求报文，并向浏览器发送响应消息，该响应消息中包含有页面代码，如JavaScript文档；浏览器解析响应消息中的页面代码，并渲染处理成相应的超文本标记语言(HTML，HyperText Markup Language)页面。
具体的，本申请实施例中的威胁检测装置通过Socket接口接收到Web服务器发送的响应消息时，先判断该响应消息中是否包含有第一显示页面组的页面代码，若包含，则该威胁检测装置在该第一显示页面组的页面代码中植入预设的动态代码。
可选的，本申请实施例中威胁检测设备中设置有钩子程序，该钩子程序挂钩该威胁检测装置的Web沙箱的网络层协议处理函数，该钩子程序用于截获第一显示页面组的页面代码。本申请实施例中的威胁检测装置在第一显示页面组的页面代码中植入预设的动态代码的过程可以是在该钩子程序获取到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至第一显示页面组的页面代码中。
可以理解的是，Web沙箱相当于威胁检测装置的操作系统的副本，因此，Web沙箱也包含有各个通信协议层。本申请实施例中Web沙箱的网络层是具备传输控制协议/因特网互联协议(TCP/IP，Transmission Control Protocol/Internet Protocol)模型中网络层的功能的协议层。
示例性的，若威胁检测装置中的Web沙箱运行在Linux系统中，威胁检测装置中设置有Linux netfilter机制的NF_IP_LOCAL_IN钩子程序，且该NF_IP_LOCAL_IN钩子程序挂钩于Web沙箱的网络层协议处理函数。NF_IP_LOCAL_IN钩子程序在获取到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至该第一显示页面组的页面代码中。
可选的，本申请实施例中威胁检测设备中设置有钩子程序，该钩子程序挂钩Web沙箱的浏览器内核，该钩子程序用于截获第一显示页面组的页面代码。本申请实施例中的威胁检测装置在第一显示页面组的页面代码中植入预设的动态代码的过程可以是在该钩子程序获取到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至第一显示页面组的页面代码中。
具体的，在威胁检测装置中的Web沙箱获取到第一显示页面组的页面代码之后，Web沙箱中的浏览器开始对该第一显示页面组的页面代码进行解析、渲染之前，挂钩Web沙箱的浏览器内核的钩子程序截获到第一显示页面组的页面代码时，威胁检测装置将预设的动态代码植入至该第一显示页面组的页面代码中。
示例性的，若Web沙箱中的浏览器为Webkit浏览器，Webkit浏览器的浏览器内核中 存在void Resource Loader::did Receive Data(Resource Handle*，const char*data，int length，int encoded DataLength)接口，该威胁检测装置中设置有钩子程序挂钩Webkit浏览器的浏览器内核。该钩子程序从void Resource Loader::did Receive Data(Resource Handle*，const char*data，int length，int encoded DataLength)接口中的data参数获取到第一显示页面组的页面代码时，威胁检测装置在data参数指向的第一显示页面组的页面代码中植入预设的动态代码。
无论威胁检测装置在哪一时刻将预设的动态代码植入至第一显示页面组的页面代码中，威胁检测装置均可获得包含有预设的动态代码的第一显示页面组的页面代码。
在威胁检测装置获得包含有预设的动态代码的第一显示页面组的页面代码之后，威胁检测装置解析并执行包含预设的动态代码的第一显示页面组的页面代码，依次显示第一显示页面组中的显示页面，即威胁检测装置执行S402。
本申请实施例中预设的动态代码用于触发从当前显示页面切换至当前显示页面的后一显示页面，即预设的动态代码可以实现当前显示页面自动向其后一显示页面滚动的功能，该功能等价于人机交互的过程。
从上述描述可知，第一显示页面组是由至少一个显示页面组成的，因此，威胁检测装置在解析并执行包含预设的动态代码的第一显示页面组的页面代码时，威胁检测装置会依次显示第一显示页面组中的显示页面。
进一步地，威胁检测装置在解析并执行包含预设的动态代码的第一显示页面组的页面代码时，该威胁检测装置会监测已显示变量的数值的变化。
由上面描述可知，已显示变量的数值用于表示在浏览器的显示区域中，第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸。容易理解的是，威胁检测装置依次显示第一显示页面组中的显示页面时，已显示变量的数值会逐渐增大。
其中，已显示变量的数值可以表示已显示的显示页面在浏览器的显示区域中所占的网页可见区域宽度值，也可以表示已显示的显示页面在浏览器的显示区域中所占的网页可见区域高度值。
具体的，在威胁检测装置监测到已显示变量的数值大于或等于预设数值时，威胁检测装置向Web服务器发送请求消息，即威胁检测装置执行S403。
其中，威胁检测装置发送的请求消息携带有显示页面组标识，Web服务器根据该显示页面组标识确定该威胁检测装置需要获取哪一显示页面组的页面代码。
上述显示页面组标识可以是第一显示页面组的标识，也可以是第二显示页面组的标识，本申请实施例对此不作具体限定。若本申请实施例中的请求消息携带有第一显示页面组的标识，则Web服务器据此查找第一显示页面组的标识所标识的第一显示页面组之后的第二显示页面组的页面代码，并将第二显示页面组的页面代码返回。若本申请实施例中的请求消息携带有第二显示页面组的标识，Web服务器据此查找第二显示页面组的标识所标识的第二显示页面组的页面代码并将其返回。
若本申请实施例中请求消息携带的显示页面组标识为第二显示页面组的标识，则该显示页面组标识可以为第二显示页面组在所有显示页面组中的显示次序，也可以为第二显示页面组的索引信息，本申请实施例对此不作具体限定。
示例性的，若第二显示页面组在所有显示页面组中的显示次序为2，则请求消息中可 以携带get page2的操作码。
进一步地，威胁检测装置向Web服务器发送请求消息后，Web服务器会向威胁检测装置发送响应于请求消息的响应消息，该响应消息携带第二显示页面组的页面代码，即执行S404。
相应的，威胁检测装置即可获取到第二显示页面组的页面代码。
进一步地，威胁检测装置在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码，即威胁检测装置执行S405。
威胁检测装置在Web沙箱中检测第二显示页面组的页面代码中是否携带有攻击代码的过程可以参考现有Web沙箱的检测原理，此处不再详细赘述。
第二显示页面组的页面代码属于延迟加载的页面代码，因此，采用本申请提供的威胁检测方法，威胁检测装置可以检测延迟加载页面中是否携带有攻击代码，避免了Web沙箱的漏检问题。
威胁检测装置在获取到第二显示页面组的页面代码后，第一显示页面组的页面代码和第二显示页面组的页面代码会被合并为同一页面代码，此时，威胁检测装置会继续运行预设的动态代码。因此，威胁检测装置会继续自动切换显示页面。威胁检测装置自动切换显示页面，会触发该威胁检测装置继续与Web服务器交互，获取后续的显示页面组的页面代码，并对后续的显示页面组的页面代码进行检测，直至与URL对应的所有显示页面加载完毕，该流程结束。
示例性的，若预设的动态代码为上述示例所示的代码，上述示例所示的预设的动态代码中只要变量currentLocate的数值小于变量pageHeight的数值，当前显示页面就会自动滚动到后一显示页面。威胁检测装置在获取到第二显示页面组的页面代码后，该威胁检测装置获取到的变量pageHeight的数值也会随之增大，因此，威胁检测装置会继续自动切换显示页面。
从上面描述可知，采用本申请实施例提供的威胁检测方法，威胁检测装置在Web沙箱中可以获取到延迟加载的页面代码，从而可以在Web沙箱中检测延迟加载的页面代码是否携带有攻击代码，避免了Web沙箱的漏检问题。
本申请实施例提供一种威胁检测装置1，该威胁检测装置1用于执行以上威胁检测方法中的威胁检测装置所执行的步骤。所述威胁检测装置1可以包括相应步骤所对应的模块。
如图5所示，该威胁检测装置1包括处理单元50、显示单元51、发送单元52和接收单元53。
处理单元50，用于在Web沙箱的浏览器中加载统一资源定位符URL时，从Web服务器获取所述URL标识的第一显示页面组的页面代码和所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸，所述第一显示页面组的页面代码包含监测代码，所述监测代码用于获取并监测已显示变量的数值，所述已显示变量的数值用于表示在所述浏览器的显示区域中，所述第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸，以及用于在所述第一显示页面组的页面代码中植入预设的动态代码，所述预设的动态代码用于触发从所述当前显示页面切换至所述当前显示页面的后一显示页面，以及用于解析并执行包含所述预设的动态代码的第一显示页面组的页面代码。
显示单元51，用于根据所述处理单元50解析并执行的包含所述预设的动态代码的第 一显示页面组的页面代码，依次显示所述第一显示页面组中的显示页面。
发送单元52，用于在所述处理单元50通过所述监测代码监测到所述已显示变量的数值大于或等于预设数值时，向所述Web服务器发送请求消息，所述请求消息用以向所述Web服务器请求获取第二显示页面组的页面代码，所述第二显示页面组中的第一个显示页面为所述第一显示页面组中最后一个显示页面的后一显示页面，所述预设数值大于或等于所述第一显示页面组的第一个显示页面在所述浏览器的显示区域中所占的尺寸，且小于所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸。
接收单元53，用于接收所述Web服务器发送的响应消息，所述响应消息包括所述第二显示页面组的页面代码。
所述处理单元50，还用于在Web沙箱中检测所述接收单元53接收到的所述第二显示页面组的页面代码中是否携带有攻击代码。
进一步地，所述处理单元50，具体用于通过套接字Socket接口接收所述Web服务器发送的所述URL标识的第一显示页面组的页面代码。
可选的，本申请实施例中的威胁检测装置1中设置钩子程序挂钩所述Web沙箱的网络层协议处理函数，所述钩子程序用于截获所述第一显示页面组的页面代码，则所述处理单元50，具体用于在所述钩子程序获取到所述第一显示页面组的页面代码时，将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
可选的，本申请实施例中的威胁检测装置1中设置钩子程序挂钩所述Web沙箱的浏览器内核，所述钩子程序用于截获所述第一显示页面组的页面代码，则所述处理单元50，具体用于在所述钩子程序获取到所述第一显示页面组的页面代码时，将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
优选的，所述预设的动态代码被置于所述第一显示页面组的页面代码的末尾。
可以理解的是，本申请实施例的威胁检测装置1仅为根据该威胁检测装置1实现的功能进行的逻辑划分。实际应用中，可以进行上述单元的叠加或拆分。
本申请实施例提供的威胁检测装置1所实现的功能与上述实施例提供的威胁检测方法一一对应，对于该威胁检测装置1所实现的更为详细的处理流程，在上述方法实施例中已做详细描述，此处不再详细描述。
本申请另一实施例提供一种威胁检测装置，如图6所示，该威胁检测装置包括接口电路60、处理器61、存储器62、系统总线63和屏幕64。
其中，所述接口电路60、所述处理器61、所述存储器62与所述屏幕64之间通过所述系统总线63连接，并完成相互间通信。
本领域技术人员可以理解，图6所示的威胁检测装置的结构并不是对威胁检测装置的限定，其可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
具体的，当所述威胁检测装置运行时，所述威胁检测装置执行如图4所示的实施例的威胁检测方法。具体的威胁检测方法可参见上述如图4所示的实施例中的相关描述，此处不再赘述。
本申请实施例中的威胁检测装置中建立有Web沙箱。
结合上一实施例，本申请实施例中的接口电路60可以为上一实施例中的发送单元52，也可以为上一实施例中的接收单元53。
具体的，接口电路60用于实现该威胁检测装置与Web服务器之间的通信连接。
结合上一实施例，本申请实施例中的存储器62可以为上一实施例中的处理单元50。
具体的，所述存储器62可用于存储软件程序以及应用模块，处理器61通过运行存储在存储器62的软件程序以及应用模块，从而执行威胁检测装置的各种功能应用以及数据处理。
存储器62可主要包括存储程序区620和存储数据区621，其中，存储程序区620可存储操作系统、至少一个功能所需的应用程序，比如发送请求消息功能等；存储数据区可621存储Web服务器发送的页面代码，比如保存第一显示页面组的页面代码和第二显示页面组的页面代码。
其中，所述存储器62可以包括易失性存储器，例如高速随机存取存储器(RAM，Random Access Memory)，所述存储器62也可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件，本申请实施例对此不作具体限定。
结合上一实施例，本申请实施例中的处理器61可以为上一实施例中的处理单元50。
具体的，所述处理器61是威胁检测装置的控制中心。
所述处理器61利用各种接口和线路连接整个威胁检测装置的各个部分，通过运行或执行存储在存储器62内的软件程序和/或应用模块，以及调用存储在存储器62内的数据，执行威胁检测装置的各种功能和处理数据，从而对威胁检测装置进行整体监控。
可选的，处理器61可以为中央处理器(CPU，Central Processing Unit)。所述处理器61还可以为其他通用处理器、数字信号处理器(DSP，Digital Signal Processing)或者其他可编程逻辑器件或者晶体管逻辑器件、分立硬件组件等，本申请实施例对此不作具体限定。
其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述系统总线63可以包括数据总线、电源总线、控制总线和信号状态总线等。
本申请实施例中为了清楚说明，在图6中将各种总线都示意为系统总线63。
结合上一实施例，本申请实施例中的屏幕64可以为上一实施例中的显示单元51。
本申请实施例提供了一种威胁检测装置，威胁检测装置中存储有预设的动态代码，该预设的动态代码用于触发威胁检测装置从当前显示页面切换至当前显示页面的后一显示页面，因此，威胁检测装置在运行该第一显示页面组的页面代码和预设的动态代码时，会依次显示第一显示页面组中的显示页面，在威胁检测装置监测到已显示变量的数值大于或等于预设数值时，威胁检测装置与Web服务器进行交互，以获取第二显示页面组的页面代码。这样，在延迟加载的场景中，该威胁检测装置在Web沙箱中也可以获取到延迟加载的页面代码，从而使得威胁检测装置在Web沙箱中检测延迟加载的页面代码中是否携带有攻击代码，避免了威胁检测装置在Web沙箱中对延迟加载的页面代码的漏检。
如图4所示的实施例所述威胁检测方法如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本领域内的技术人员应明白，本申请的实施例可提供为方法、电子设备、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个包括有程序代码的计算机可读存储介质上实施的计算机程序产品的形式，所述计算机存储介质包括但不限于U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、磁盘存储器、CD-ROM、光学存储器等。
相应的，本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质包括一个或多个程序代码，当威胁检测装置中的处理器在执行该程序代码时，该威胁检测装置执行如图4所示的威胁检测方法。
本申请实施例还提供一种网络系统，如图7所示，该网络系统包括至少一个如上述各实施例所述的威胁检测装置和Web服务器。
具体的，Web服务器，用于根据威胁检测装置发送的请求，向威胁检测装置发送相应的页面代码，以使得威胁检测装置在Web沙箱中检测其接收到的显示页面组的页面代码中是否携带有攻击代码。
可选的，Web服务器根据威胁检测装置发送的统一资源定位符URL，向威胁检测装置发送URL标识的第一显示页面组的页面代码；Web服务器根据威胁检测装置发送的用于请求获取第二显示页面组的页面代码的请求消息，向威胁检测装置发送第二显示页面组的页面代码。
对于Web服务器所实现的更为详细的处理流程，在上述实施例中已做详细描述，此处不再详细描述。
对于威胁检测装置所实现的更为详细的处理流程，在上述实施例中已做详细描述，此处不再详细描述。
本申请实施例提供了一种网络系统，网络系统中的威胁检测装置中存储有预设的动态代码，该预设的动态代码用于触发威胁检测装置从当前显示页面切换至当前显示页面的后一显示页面，因此，威胁检测装置在运行该第一显示页面组的页面代码和预设的动态代码时，会依次显示第一显示页面组中的显示页面，在威胁检测装置监测到已显示变量的数值大于或等于预设数值时，威胁检测装置与Web服务器进行交互，以获取第二显示页面组的页面代码。这样，在延迟加载的场景中，该威胁检测装置在Web沙箱中也可以获取到延迟加载的页面代码，从而使得威胁检测装置在Web沙箱中检测延迟加载的页面代码是否携带有攻击代码，避免了威胁检测装置在Web沙箱中对延迟加载的页面代码的漏检。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。
例如，以上所描述的装置实施例仅仅是示意性的，例如，模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。
基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (11)

  1. 一种威胁检测方法，其特征在于，包括：
    威胁检测装置在Web沙箱的浏览器中加载统一资源定位符URL时，从Web服务器获取所述URL标识的第一显示页面组的页面代码和所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸，所述第一显示页面组的页面代码包含监测代码，所述监测代码用于获取并监测已显示变量的数值，所述已显示变量的数值用于表示在所述浏览器的显示区域中，所述第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸；
    所述威胁检测装置在所述第一显示页面组的页面代码中植入预设的动态代码，所述预设的动态代码用于触发从所述当前显示页面切换至所述当前显示页面的后一显示页面；
    所述威胁检测装置解析并执行包含所述预设的动态代码的第一显示页面组的页面代码，依次显示所述第一显示页面组中的显示页面；
    若所述威胁检测装置通过所述监测代码监测到所述已显示变量的数值大于或等于预设数值，则向所述Web服务器发送请求消息，所述请求消息用以向所述Web服务器请求获取第二显示页面组的页面代码，所述第二显示页面组中的第一个显示页面为所述第一显示页面组中最后一个显示页面的后一显示页面，所述预设数值大于或等于所述第一显示页面组的第一个显示页面在所述浏览器的显示区域中所占的尺寸，且小于所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸；
    所述威胁检测装置接收所述Web服务器发送的响应消息，所述响应消息携带所述第二显示页面组的页面代码；
    所述威胁检测装置在所述Web沙箱中检测所述第二显示页面组的页面代码中是否携带有攻击代码。
  2. 根据权利要求1所述的威胁检测方法，其特征在于，所述威胁检测装置从Web服务器获取所述URL标识的第一显示页面组的页面代码，包括：
    所述威胁检测装置通过套接字Socket接口接收所述Web服务器发送的所述URL标识的第一显示页面组的页面代码。
  3. 根据权利要求1或2所述的威胁检测方法，其特征在于，设置钩子程序挂钩所述Web沙箱的网络层协议处理函数，所述钩子程序用于截获所述第一显示页面组的页面代码；
    所述威胁检测装置在所述第一显示页面组的页面代码中植入预设的动态代码，包括：
    在所述钩子程序获取到所述第一显示页面组的页面代码时，所述威胁检测装置将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
  4. 根据权利要求1或2所述的威胁检测方法，其特征在于，设置钩子程序挂钩所述Web沙箱的浏览器内核，所述钩子程序用于截获所述第一显示页面组的页面代码；
    所述威胁检测装置在所述第一显示页面组的页面代码中植入预设的动态代码，包括：
    在所述钩子程序获取到所述第一显示页面组的页面代码时，所述威胁检测装置将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
  5. 根据权利要求1-4中任意一项所述的威胁检测方法，其特征在于，所述动态代码被置于所述第一显示页面组的页面代码的末尾。
  6. 一种威胁检测装置，其特征在于，包括：
    处理单元，用于在Web沙箱的浏览器中加载统一资源定位符URL时，从Web服务器获取所述URL标识的第一显示页面组的页面代码和所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸，所述第一显示页面组的页面代码包含监测代码，所述监测代码用于获取并监测已显示变量的数值，所述已显示变量的数值用于表示在所述浏览器的显示区域中，所述第一显示页面组的第一个显示页面的起始位置到当前显示页面之间已显示的显示页面所占的尺寸，以及用于在所述第一显示页面组的页面代码中植入预设的动态代码，所述预设的动态代码用于触发从所述当前显示页面切换至所述当前显示页面的后一显示页面，以及用于解析并执行包含所述预设的动态代码的第一显示页面组的页面代码；
    显示单元，用于根据所述处理单元解析并执行的包含所述预设的动态代码的第一显示页面组的页面代码，依次显示所述第一显示页面组中的显示页面；
    发送单元，用于在所述处理单元通过所述监测代码监测到所述已显示变量的数值大于或等于预设数值时，向所述Web服务器发送请求消息，所述请求消息用以向所述Web服务器请求获取第二显示页面组的页面代码，所述第二显示页面组中的第一个显示页面为所述第一显示页面组中最后一个显示页面的后一显示页面，所述预设数值大于或等于所述第一显示页面组的第一个显示页面在所述浏览器的显示区域中所占的尺寸，且小于所述第一显示页面组在所述浏览器的显示区域中所占的整体尺寸；
    接收单元，用于接收所述Web服务器发送的响应消息，所述响应消息包括所述第二显示页面组的页面代码；
    所述处理单元，还用于在所述Web沙箱中检测所述接收单元接收到的所述第二显示页面组的页面代码中是否携带有攻击代码。
  7. 根据权利要求6所述的威胁检测装置，其特征在于，
    所述处理单元，具体用于通过套接字Socket接口接收所述Web服务器发送的所述URL标识的第一显示页面组的页面代码。
  8. 根据权利要求6或7所述的威胁检测装置，其特征在于，设置钩子程序挂钩所述Web沙箱的网络层协议处理函数，所述钩子程序用于截获所述第一显示页面组的页面代码；
    所述处理单元，具体用于在所述钩子程序获取到所述第一显示页面组的页面代码时，将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
  9. 根据权利要求6或7所述的威胁检测装置，其特征在于，设置钩子程序挂钩所述Web沙箱的浏览器内核，所述钩子程序用于截获所述第一显示页面组的页面代码；
    所述处理单元，具体用于在所述钩子程序获取到所述第一显示页面组的页面代码时，将所述预设的动态代码植入至所述第一显示页面组的页面代码中。
  10. 根据权利要求6-9中任意一项所述的威胁检测装置，其特征在于，
    所述预设的动态代码被置于所述第一显示页面组的页面代码的末尾。
  11. 一种网络系统，其特征在于，包括至少一个如权利要求6-10中任意一项所述的威胁检测装置以及Web服务器，其中，所述至少一个威胁检测装置中的每个威胁检测装置均与所述Web服务器之间通过网络相连。
PCT/CN2017/071149 2016-05-10 2017-01-13 一种威胁检测方法、装置及网络系统 WO2017193626A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2018540440A JP6585853B2 (ja) 2016-05-10 2017-01-13 脅威検出方法および装置ならびにネットワーク・システム
ES17795253T ES2764672T3 (es) 2016-05-10 2017-01-13 Método y aparato de detección de amenazas y sistema de red
EP17795253.8A EP3306510B1 (en) 2016-05-10 2017-01-13 Threat detection method and apparatus, and network system
US15/866,236 US11036849B2 (en) 2016-05-10 2018-01-09 Threat detection method and apparatus, and network system
US17/103,247 US11604872B2 (en) 2016-05-10 2020-11-24 Threat detection method and apparatus, and network system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610305868.1 2016-05-10
CN201610305868.1A CN107358095B (zh) 2016-05-10 2016-05-10 一种威胁检测方法、装置及网络系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/866,236 Continuation US11036849B2 (en) 2016-05-10 2018-01-09 Threat detection method and apparatus, and network system

Publications (1)

Publication Number Publication Date
WO2017193626A1 true WO2017193626A1 (zh) 2017-11-16

Family

ID=60266968

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/071149 WO2017193626A1 (zh) 2016-05-10 2017-01-13 一种威胁检测方法、装置及网络系统

Country Status (6)

Country Link
US (2) US11036849B2 (zh)
EP (1) EP3306510B1 (zh)
JP (1) JP6585853B2 (zh)
CN (1) CN107358095B (zh)
ES (1) ES2764672T3 (zh)
WO (1) WO2017193626A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108563946A (zh) * 2018-04-17 2018-09-21 广州大学 一种浏览器挖矿行为检测的方法、浏览器插件和系统
US10614213B1 (en) 2019-11-18 2020-04-07 Clean.io, Inc. Detecting malicious code existing in internet advertisements by ongoing sandbox monitoring
CN111225049A (zh) * 2020-01-02 2020-06-02 上海多算智能科技有限公司 一种自动构建web应用系统镜像的方法
CN112434287B (zh) * 2020-11-20 2024-04-02 西安四叶草信息技术有限公司 一种检测Hook的方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080127292A1 (en) * 2006-08-04 2008-05-29 Apple Computer, Inc. Restriction of program process capabilities
CN101692267A (zh) * 2009-09-15 2010-04-07 北京大学 一种大规模恶意网页检测方法及系统
US20110078790A1 (en) * 2009-09-29 2011-03-31 Fazunenko Dmitry A API Signature Verification for High-Security Platforms
CN102088379A (zh) * 2011-01-24 2011-06-08 国家计算机网络与信息安全管理中心 基于沙箱技术的客户端蜜罐网页恶意代码检测方法与装置

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7953820B2 (en) * 2002-09-11 2011-05-31 Hughes Network Systems, Llc Method and system for providing enhanced performance of web browsing
US9055093B2 (en) * 2005-10-21 2015-06-09 Kevin R. Borders Method, system and computer program product for detecting at least one of security threats and undesirable computer files
US7873635B2 (en) * 2007-05-31 2011-01-18 Microsoft Corporation Search ranger system and double-funnel model for search spam analyses and browser protection
US9712560B2 (en) * 2007-11-05 2017-07-18 Cabara Software Ltd. Web page and web browser protection against malicious injections
EP2462516A4 (en) * 2009-08-07 2014-12-24 Access Innovation Media Pty Ltd SYSTEM AND METHOD FOR CONTINUOUS DIFFUSION OF TEXT IN REAL TIME
JP2012078877A (ja) 2010-09-30 2012-04-19 Dainippon Printing Co Ltd 脆弱性検査装置、脆弱性検査方法、及び脆弱性検査プログラム
US9305165B2 (en) 2011-05-06 2016-04-05 The University Of North Carolina At Chapel Hill Methods, systems, and computer readable media for detecting injected machine code
JP2012238218A (ja) * 2011-05-12 2012-12-06 Sony Corp 情報処理装置、情報処理方法及びコンピュータプログラム
US8601579B2 (en) 2011-06-03 2013-12-03 Apple Inc. System and method for preserving references in sandboxes
EP2754004A4 (en) * 2011-09-08 2015-08-19 Double Verify Inc SYSTEM AND METHOD FOR IMPROVED INTERACTION BETWEEN AN IFRAME OR SITE AND AN EMBEDDED IFRAME FROM ANOTHER DOMAIN
JP2014534498A (ja) 2011-09-30 2014-12-18 ニューマン インフィニット， インク．Ｎｅｗｍａｎ Ｉｎｆｉｎｉｔｅ， Ｉｎｃ． ＪａｖａＳｃｒｉｐｔを保護する装置、方法及びコンピューター可読性記憶媒体
US10049168B2 (en) * 2012-01-31 2018-08-14 Openwave Mobility, Inc. Systems and methods for modifying webpage data
US9256733B2 (en) * 2012-04-27 2016-02-09 Microsoft Technology Licensing, Llc Retrieving content from website through sandbox
US9104864B2 (en) 2012-10-24 2015-08-11 Sophos Limited Threat detection through the accumulated detection of threat characteristics
US8893222B2 (en) 2012-11-13 2014-11-18 Auckland Uniservices Ltd. Security system and method for the android operating system
JP6311417B2 (ja) 2014-04-08 2018-04-18 富士通株式会社 無線通信装置、無線通信方法および無線通信プログラム
JP6672309B2 (ja) * 2014-09-09 2020-03-25 ライブパーソン， インコーポレイテッド 動的コード管理
KR101574652B1 (ko) * 2015-01-14 2015-12-11 한국인터넷진흥원 모바일 침해사고 분석시스템 및 방법
IL237986A0 (en) * 2015-03-26 2015-11-30 Yaron Peretz Method and system for broadcasting surfing activities
CN104967628B (zh) * 2015-07-16 2017-12-26 浙江大学 一种保护web应用安全的诱骗方法
CN107757178B (zh) * 2017-11-24 2020-02-21 梁志辉 自动翻谱器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080127292A1 (en) * 2006-08-04 2008-05-29 Apple Computer, Inc. Restriction of program process capabilities
CN101692267A (zh) * 2009-09-15 2010-04-07 北京大学 一种大规模恶意网页检测方法及系统
US20110078790A1 (en) * 2009-09-29 2011-03-31 Fazunenko Dmitry A API Signature Verification for High-Security Platforms
CN102088379A (zh) * 2011-01-24 2011-06-08 国家计算机网络与信息安全管理中心 基于沙箱技术的客户端蜜罐网页恶意代码检测方法与装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3306510A4 *

Also Published As

Publication number Publication date
ES2764672T3 (es) 2020-06-04
US20210081526A1 (en) 2021-03-18
US11036849B2 (en) 2021-06-15
EP3306510B1 (en) 2019-10-30
JP2019511767A (ja) 2019-04-25
US20180129804A1 (en) 2018-05-10
US11604872B2 (en) 2023-03-14
EP3306510A1 (en) 2018-04-11
CN107358095B (zh) 2019-10-25
EP3306510A4 (en) 2018-07-18
JP6585853B2 (ja) 2019-10-02
CN107358095A (zh) 2017-11-17

Similar Documents

Publication Publication Date Title
TWI690812B (zh) 頁面元件動態佈局方法、裝置及客戶端
US11604872B2 (en) Threat detection method and apparatus, and network system
EP2165457B1 (en) Web media asset identification system and method
US10201750B2 (en) Method and apparatus of preloading browser game on client
US8819819B1 (en) Method and system for automatically obtaining webpage content in the presence of javascript
US9235451B2 (en) Browser kernel switching method
US10015226B2 (en) Methods for making AJAX web applications bookmarkable and crawlable and devices thereof
WO2018219076A1 (zh) 防止网页劫持的处理方法、客户端以及服务器
CN103810176B (zh) 一种网页信息的预取访问方法和装置
CN107040584B (zh) 客户端下载图片的方法及装置
US20110209075A1 (en) Page resource processing method and system
JP6500086B2 (ja) 二次元コードの解析方法および装置、コンピュータ読み取り可能な記憶媒体、コンピュータプログラムおよび端末機器
WO2014139300A1 (en) Method and device for loading a plug-in
US20120096261A1 (en) Method and apparatus for controlling access to encrypted network communication channels
CN108416021B (zh) 一种浏览器网页内容处理方法、装置、电子设备及可读介质
WO2014090082A1 (zh) 图片处理方法、装置及终端
WO2013010394A1 (zh) 一种互联网病毒检测方法、装置和系统
WO2018133772A1 (zh) 网页资源的获取方法和装置、存储介质、电子装置
WO2014194733A1 (en) Method and device for obtaining contents of page, application apparatus and mobile terminal
JP2011043924A (ja) Ｗｅｂ行動履歴取得システム、Ｗｅｂ行動履歴取得方法、ゲートウェイ装置、及びプログラム
CN110149246B (zh) 一种共享上网检测方法、系统及电子设备和存储介质
Taivalsaari et al. Cloud browser: enhancing the web browser with cloud sessions and downloadable user interface
CN104978199A (zh) 一种用于多种浏览器的插件应用方法和装置
CN101651939A (zh) 一种面向B/S系统代理服务器的Web页面替换方法
WO2013045969A1 (en) Method for providing remote server content to a web browser of a user computer through a third party server, web browser, third party server, and computer-readable medium related thereto

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018540440

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE