WO2018072733A1 - 网页安全检测方法及装置 - Google Patents

网页安全检测方法及装置 Download PDF

Info

Publication number
WO2018072733A1
WO2018072733A1 PCT/CN2017/106887 CN2017106887W WO2018072733A1 WO 2018072733 A1 WO2018072733 A1 WO 2018072733A1 CN 2017106887 W CN2017106887 W CN 2017106887W WO 2018072733 A1 WO2018072733 A1 WO 2018072733A1
Authority
WO
WIPO (PCT)
Prior art keywords
site
detected
control
list
target site
Prior art date
Application number
PCT/CN2017/106887
Other languages
English (en)
French (fr)
Inventor
叶伟
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018072733A1 publication Critical patent/WO2018072733A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present application relates to the field of communications, for example, to a webpage security detection method and apparatus.
  • ClickJacking is a web-based attack method based on visual spoofing. It performs partial malicious programs by inducing user operations to hide the reference content hidden on the upper layer of the page. The hidden content is set by the transparent iframe control. Realized. The hacker's carefully designed ClickJacking attack page, whether the user intentionally or unintentionally, may download malicious Trojans and upload sensitive information such as username and password.
  • the relatively reliable protection technology is to use the X-Frame-Options attribute in the Hypertext Transfer Protocol (HTTP) response header information for protection.
  • the X-Frame-Options attribute has three values: DENY, indicating that the page is not allowed to be displayed in the iframe, even if it is nested in the same domain name page; SAMEORIGIN means that the page can be displayed in the iframe of the same domain name page; ALLOW-FROM means that the page can be specified Displayed in the source iframe.
  • the embodiment of the present disclosure provides a webpage security detection method and apparatus to at least solve the webpage security problem caused by clickjacking in the related art.
  • a webpage security detecting method including:
  • determining whether the reference site is a legal site according to the determination result includes: determining that the reference site is a legal site when all the controls in the to-be-detected control list are present in the preset whitelist Allowing the target site to be loaded by the reference site.
  • determining whether the to-be-detected control in the to-be-detected control list is an illegal control according to the preset whitelist, and determining, according to the determination result, whether the referenced site is a legal site including:
  • the at least one to-be-detected control in the to-be-detected control list does not exist in the preset whitelist, determining that the at least one to-be-detected control is an illegal control, and determining that the referenced site is an illegal site, rejecting the The reference site loads the target site.
  • the method further includes: acquiring a top-level uniform resource locator (Uniform Resource Locator, respectively) of the reference site and the target site. Referred to as the url) path, it is determined whether the reference site and the target site belong to the homologous domain according to the top url path.
  • Uniform Resource Locator Uniform Resource Locator
  • the method further includes: acquiring, by the network side device, the pre-stored preset whitelist.
  • a webpage security detecting method including:
  • the network-side device sends a preset whitelist to the user equipment, where the preset whitelist is used to determine, by the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where the
  • the detection control list includes a to-be-detected control that references the site and the target site, the reference site being configured to load the target site by the control to be detected of the reference site.
  • the network side device sends the preset whitelist to the user equipment in the following manner, where the network side device sends the preset white white to the user equipment according to a predetermined time point.
  • a network side device receiving request information of the user equipment, and according to the request information And sending the preset whitelist to the user equipment.
  • a webpage security detecting apparatus including:
  • An obtaining module configured to obtain a list of to-be-detected controls, where the referenced site and the target site are in the same domain, wherein the to-be-detected control list includes the referenced site and the target site to be detected,
  • the reference site is configured to load the target site by the control to be detected of the reference site;
  • the determining module is configured to determine, according to the preset whitelist, whether the to-be-detected control in the to-be-detected control list is an illegal control, and determine, according to the determination result, whether the referenced site is a legal site.
  • the determining module is further configured to: when all the controls in the to-be-detected control list are present in the preset whitelist, determine that the reference site is a legal site, and allow the reference site to pass Load the target site.
  • the determining module is further configured to: when the at least one to-be-detected control in the to-be-detected control list does not exist in the preset whitelist, determine that the at least one to-be-detected control is an illegal control, And determining that the reference site is an illegal site, and refusing to load the target site by using the reference site.
  • the obtaining module is further configured to obtain a top-level uniform resource locator url path of the reference site and the target site before acquiring one or more to-be-detected controls of the reference site and the target site, according to The top url path determines whether the reference site and the target site belong to a homeodomain.
  • the determining module is further configured to: before determining, according to the preset whitelist, whether the to-be-detected control in the to-be-detected control list is an illegal control, acquiring the pre-stored preset whitelist from the network side device. .
  • a webpage security detecting apparatus which is applied to a network side device, and includes:
  • the sending module is configured to send a preset whitelist to the user equipment, where the preset whitelist is used to determine, by the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where
  • the to-be-detected control list includes a to-be-detected control that references the site and the target site, and the reference site is configured to load the target site by the to-be-detected control of the reference site.
  • the sending module is further configured to send the preset whitelist to the user equipment by using one of the following manners, where the sending module sends the preset to the user equipment according to a predetermined time point.
  • the whitelist is set; the sending module receives the request information of the user equipment, and sends the preset whitelist to the user equipment according to the request information.
  • a storage medium is also provided.
  • the storage medium is arranged to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • the network-side device sends a preset whitelist to the user equipment, where the preset whitelist is used to determine, by the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where the
  • the detection control list includes a to-be-detected control that references the site and the target site, the reference site being configured to load the target site by the control to be detected of the reference site.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal of a webpage security detecting method according to an embodiment of the present disclosure
  • FIG. 2 is a flow chart of web page security detection in accordance with an embodiment of the present disclosure
  • FIG. 3 is a structural block diagram of a system for implementing a protection method in accordance with an embodiment of the present disclosure
  • FIG. 4 is a flow diagram of a method of protection provided in accordance with an embodiment of the present disclosure.
  • FIG. 5 is a structural block diagram of a webpage security detecting apparatus according to an embodiment of the present disclosure.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal of a webpage security detecting method according to an embodiment of the present disclosure.
  • the mobile terminal 10 may include one or more (only one shown) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA).
  • a memory 104 configured to store data
  • a transmission device 106 configured as a communication function.
  • the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device.
  • the mobile terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.
  • the memory 104 can be configured as a software program and a module for storing application software, such as program instructions/modules corresponding to the webpage security detection method in the embodiment of the present disclosure, and the processor 102 executes the software program and module stored in the memory 104, thereby The above methods are implemented by performing various functional applications and data processing.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may also include memory remotely located relative to processor 102, which may be connected to mobile terminal 10 over a network. Examples of such networks include, but are not limited to, the Internet, Enterprise intranet, local area network, mobile communication network and combinations thereof.
  • Transmission device 106 is configured to receive or transmit data via a network.
  • the network instance described above may include a wireless network provided by a communication provider of the mobile terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module configured to communicate with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 2 is a flowchart of webpage security detection according to an embodiment of the present disclosure. As shown in FIG. 2, the flow includes the following steps:
  • Step S202 Obtain a to-be-detected control list in the case that the referenced site and the target site are in the same-origin domain, where the to-be-detected control list includes the referenced site and the to-be-detected control of the target site, and the referenced site is configured as The target site is loaded by the to-be-detected control of the reference site; the form of storing the plurality of to-be-detected controls is not limited to a list, and each of the to-be-detected controls has a separate storage space.
  • Step S204 Determine whether the to-be-detected control in the to-be-detected control list is an illegal control according to the preset whitelist, and determine, according to the determination result, whether the referenced site is a legal site.
  • the at least one to-be-detected control in the to-be-detected control list does not exist in the preset whitelist, determining that the at least one to-be-detected control is an illegal control, and determining that the referenced site is an illegal site, rejecting the The reference site loads the target site.
  • the top-level uniform resource locator url path of the reference site and the target site determines whether the reference site and the target site belong to the homologous domain according to the top-level url path. If the reference site and the target site are not in the same domain, the target site is not allowed to be loaded by the reference site.
  • the top-level url path refers to the starting page address of a website, which is the home page address of the root path of the website. All sub-page paths of the website are extended by this root path. For example, the user logs in to the official website of Netease www.
  • the pre-stored preset whitelist is obtained from the network side device before determining whether the to-be-detected control in the to-be-detected control list is an illegal control according to the preset whitelist.
  • the preset whitelist can be stored on the network side device and can be delivered periodically by the network side device. It can be maintained periodically by the administrator.
  • a webpage security detecting method including:
  • the network side device sends a preset whitelist to the user equipment, where the preset whitelist is used to determine, for the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where the to-be-detected control list is Included are a control to be detected that references the site and the target site, the reference site being configured to load the target site through the control to be detected of the reference site.
  • the network side device sends the preset whitelist to the user equipment by using one of the following manners, including:
  • the network side device sends the preset white list to the user equipment according to a predetermined time point
  • the network side device receives the request information of the user equipment, and sends the preset white list to the user equipment according to the request information.
  • a protection method for a clickjacking attack is provided.
  • the method is based on a front-end protection method.
  • By recording and comparing the iframe control of the front-end page it is determined whether there is a ClickJacking attack.
  • the iframe control that affects the page itself can effectively protect against ClickJacking attacks.
  • a protection method for a clickjacking attack is provided.
  • a pre-made control whitelist By using a pre-made control whitelist, the existence of an illegal control is detected according to a certain criterion, as a basis for discovering a clickjacking attack, thereby improving user network security.
  • the whitelist of controls is pre-made and used as a basis for detecting illegal controls.
  • the steps in the embodiments of the present disclosure may include the following three steps:
  • Step one first determining whether the reference site and the target site are in the same domain; if not belonging to the homology domain, the reference target site is not allowed; if it belongs to the homologous domain, the subsequent detection step is performed;
  • Step 2 When the reference site and the target site are in the same-origin domain, obtain a list of specified controls of the reference site and the target site (the control specified in the method is an iframe);
  • Step 3 Compare the control list obtained in the second step with the control in the pre-made white list to detect whether there is an illegal control. If there is an illegal control, the clickjacking attack is considered; otherwise, the current reference site is considered It is legal.
  • the method can be divided into two steps, which are: homologous domain detection, control whitelist detection, and finally, according to the output result of the whitelist detection step, whether there is an attack behavior of clickjacking.
  • FIG. 3 is a structural block diagram of a system for implementing a protection method according to an embodiment of the present disclosure. As shown in FIG. 3, the system includes a user terminal 31 and a web server 34:
  • the reference web page 32 on the user terminal 31 loads the target web page 33 through the control 0 (ie, the iframe control), and the target web page 33 includes the control 1 to the control n.
  • the web server 34 stores therein a pre-made control whitelist 35, and the user terminal 31 can obtain the content of the control whitelist 35 from the web server 34 via the Internet.
  • FIG. 4 is a flow chart of generating a protection method according to an embodiment of the present disclosure. As shown in FIG. 4, the implementation steps of the protection method include the following four steps:
  • Step S401 First, the user terminal obtains respective top-level url paths from the reference webpage and the target webpage, respectively, and determines whether the referenced webpage and the target webpage belong to the homologous domain through the two paths, and if it does not belong to the homologous domain, the clickjacking is considered to exist. Attack, referencing a web page is illegal; if it belongs to a homologous domain, then proceed Follow-up testing;
  • Step S402 the user terminal first obtains a reference control identifier of the reference webpage and the target webpage to generate a list of the control to be detected.
  • the id of the iframe control is used as an identifier (iframe_0, iframe_1, ..., iframe_n), wherein iframe_0 belongs to the reference.
  • the controls in the page, iframe_1, ..., iframe_n belong to the control in the target page, and the reference page loads the target page through the control iframe_0;
  • Step S403 the user terminal obtains a white list of the control from the web server, as a detection basis;
  • Step S404 the control list generated in step S402 is sequentially compared with the white list of the control in step 3. If the control exists in the white list and the control identifier is not repeated, the control is considered legal; if the control does not exist in the white list If the control identifier is duplicated, the control is considered to be illegal, and there is a clickjacking attack; according to the result of step S404, if the controls in the control list are all legal, the referenced webpage is considered to be a legitimate webpage; if the controls in the control list are not all legal , the reference page is not legal, terminate its loading of the target page to protect against clickjacking attacks.
  • the method according to the foregoing embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware.
  • the technical solution of the present disclosure which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM).
  • the instructions include a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.
  • a webpage security detection device is also provided, which is configured to implement the foregoing embodiments and implementation manners, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments can be implemented by software, hardware, or a combination of software and hardware, is also possible and conceived.
  • FIG. 5 is a structural block diagram of a webpage security detecting apparatus according to an embodiment of the present disclosure. As shown in FIG. 5, the apparatus includes:
  • the obtaining module 52 is configured to obtain a list of to-be-detected controls if the referenced site and the target site are in the same-origin domain, wherein the to-be-detected control list includes the referenced site and the to-be-detected control of the target site, the reference The site is configured to load the target site through the control to be detected of the reference site;
  • the determining module 54 is connected to the obtaining module 52, and is configured to determine, according to the preset whitelist, whether the to-be-detected control in the to-be-detected control list is an illegal control, and determine whether the referenced site is a legal site according to the determination result.
  • the determining module 54 is further configured to: when all the controls in the to-be-detected control list are present in the preset whitelist, determine that the referenced site is a legal site, and allow the target site to be loaded through the referenced site. .
  • the determining module 54 is further configured to: when the at least one to-be-detected control in the to-be-detected control list does not exist in the preset whitelist, determine that the at least one to-be-detected control is an illegal control, and determine the The reference site is an illegal site and refuses to load the target site through the reference site.
  • the obtaining module 52 is further configured to obtain a top-level uniform resource locator url path of the reference site and the target site before acquiring one or more to-be-detected controls of the reference site and the target site, according to the top layer.
  • the url path determines whether the reference site and the target site belong to the home domain.
  • the determining module 54 is further configured to: before determining whether the to-be-detected control in the to-be-detected control list is an illegal control according to the preset whitelist, acquiring the pre-stored preset whitelist from the network side device.
  • a webpage security detecting apparatus which is applied to a network side device, and includes:
  • the sending module is configured to send a preset whitelist to the user equipment, where the preset whitelist is used to determine, by the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where the
  • the detection control list includes a to-be-detected control that references the site and the target site, and the reference site is configured to load the target site through the control to be detected of the reference site.
  • the sending module is further configured to send the pre-delivery to the user equipment in one of the following manners: Set a white list, including:
  • the sending module sends the preset whitelist to the user equipment according to a predetermined time point
  • the sending module receives the request information of the user equipment, and sends the preset white list to the user equipment according to the request information.
  • the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the above modules are all located in the same processor; or, the above modules are respectively located in different combinations. In the processor.
  • Embodiments of the present disclosure also provide a storage medium.
  • an embodiment of the present disclosure also provides a computer readable storage medium storing computer executable instructions arranged to perform the method of any of the above embodiments.
  • the computer readable storage medium may be a transitory computer readable storage medium or a non-transitory computer readable storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the to-be-detected control list includes the referenced site and the to-be-detected control of the target site, where the reference site is configured to pass
  • the to-be-detected control of the reference site loads the target site;
  • the storage medium is further arranged to store program code for performing the following steps:
  • the network side device sends a preset whitelist to the user equipment, where the preset whitelist is used to determine, by the user equipment, whether the to-be-detected control in the to-be-detected control list is a legal control, where the to-be-detected
  • the list of controls includes a to-be-detected control that references the site and the target site, and the reference site is configured to load the target site through the control to be detected of the reference site.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs the method steps in the foregoing embodiments according to the stored program code in the storage medium.
  • modules or steps of the present disclosure described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.
  • the webpage security detecting method and device provided by the present application solves the webpage security problem caused by clickjacking in the related art, and effectively improves the security in the webpage browsing process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请提供了一种网页安全检测方法及装置，其中，该方法包括：将引用站点和目标站点所有的待检测控件收集起来，依据白名单判断上述的待检测控件是否在白名单中，判断待检测控件是否为合法控件，如果上述的待检测控件有一个是非法控件，则拒绝通过该引用站点加载该目标站点。采用上述步骤，解决了相关技术中由于点击劫持的造成的网页安全问题，有效提升了网页浏览过程中的安全性。

Description

网页安全检测方法及装置 技术领域
本申请涉及通信领域，例如涉及一种网页安全检测方法及装置。
背景技术
在相关技术中，ClickJacking(点击劫持)是一种基于视觉欺骗的Web攻击方式，通过诱导用户操作隐藏在页面上层的引用内容来执行部分恶意程序，隐藏内容是通过设置属性为透明的iframe控件来实现的。经过黑客精心设计的ClickJacking攻击页面，无论是用户有意或是无意的操作，都可能会下载恶意的木马程序、上传用户名密码等敏感信息。
在相关技术中，比较可靠的防护技术是使用超文本传输协议(HyperText Transfer Protocol，简称为HTTP)响应头信息中的X-Frame-Options属性进行防护，X-Frame-Options属性有三种取值：DENY，表示该页面不允许在iframe中展示，即便是在相同域名的页面中嵌套也不允许；SAMEORIGIN，表示该页面可以在相同域名页面的iframe中展示；ALLOW-FROM表示该页面可以在指定来源的iframe中展示。
但是，X-Frame-Options的DENY和SAMEORIGIN这两种属性会限制iframe的使用，而ALLOW-FROM虽然可以允许iframe，但这种实现方式是基于服务端的，增加了后台的负担。
针对相关技术中，由于点击劫持的造成的网页安全问题，目前还没有有效地解决方案。
发明内容
本公开实施例提供了一种网页安全检测方法及装置，以至少解决相关技术中由于点击劫持的造成的网页安全问题。
根据本公开的一个实施例，提供了一种网页安全检测方法，包括：
在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括所述引用站点和所述目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点；
依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点。
可选地，依据判断结果确定所述引用站点是否为合法站点，包括：在所述待检测控件列表中的所有控件均存在于所述预设白名单中时，确定所述引用站点为合法站点，允许通过所述引用站点加载所述目标站点。
可选地，依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点，包括：
在所述待检测控件列表中的至少一个待检测控件未存在于所述预设白名单中时，确定所述至少一个待检测控件为非法控件，并确定所述引用站点为非法站点，拒绝通过所述引用站点加载所述目标站点。
可选地，所述获取引用站点和目标站点的一个或多个待检测控件之前，所述方法还包括：获取所述引用站点和所述目标站点各自的顶层统一资源定位符(Uniform Resource Locator，简称为url)路径，依据所述顶层url路径判断所述引用站点和所述目标站点是否属于同源域。
可选地，依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件之前，所述方法还包括：从网络侧设备获取预先存储的所述预设白名单。
根据本公开的另一个实施例，还提供了一种网页安全检测方法，包括：
网络侧设备向用户设备下发预设白名单，其中，所述预设白名单用于为所述用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，所述待检测控件列表中包括引用站点和目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点。
可选地，所述网络侧设备通过以下方式之一向所述用户设备下发所述预设白名单，包括：所述网络侧设备依据预定时间点向所述用户设备下发所述预设白名单；所述网络侧设备接收所述用户设备的请求信息，并依据所述请求信息 向所述用户设备下发所述预设白名单。
根据本公开的另一个实施例，还提供了一种网页安全检测装置，包括：
获取模块，被配置为在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括所述引用站点和所述目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点；
判断模块，被配置为依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点。
可选地，所述判断模块还被配置为在所述待检测控件列表中的所有控件均存在于所述预设白名单中时，确定所述引用站点为合法站点，允许通过所述引用站点加载所述目标站点。
可选地，所述判断模块还被配置为在所述待检测控件列表中的至少一个待检测控件未存在于所述预设白名单中时，确定所述至少一个待检测控件为非法控件，并确定所述引用站点为非法站点，拒绝通过所述引用站点加载所述目标站点。
可选地，所述获取模块还被配置为在获取引用站点和目标站点的一个或多个待检测控件之前，获取所述引用站点和所述目标站点各自的顶层统一资源定位符url路径，依据所述顶层url路径判断所述引用站点和所述目标站点是否属于同源域。
可选地，所述判断模块还被配置为在依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件之前，从网络侧设备获取预先存储的所述预设白名单。
根据本公开的另一个实施例，提供了一种网页安全检测装置，应用于网络侧设备，包括：
发送模块，被配置为向用户设备下发预设白名单，其中，所述预设白名单用于为所述用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，所述待检测控件列表中包括引用站点和目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点。
可选地，所述发送模块还被配置为通过以下方式之一向所述用户设备下发所述预设白名单，包括：所述发送模块依据预定时间点向所述用户设备下发所述预设白名单；所述发送模块接收所述用户设备的请求信息，并依据所述请求信息向所述用户设备下发所述预设白名单。
根据本公开的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：
在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括所述引用站点和所述目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点；
依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：
网络侧设备向用户设备下发预设白名单，其中，所述预设白名单用于为所述用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，所述待检测控件列表中包括引用站点和目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点。
通过本公开，将引用站点和目标站点所有的待检测控件收集起来，依据白名单判断上述的待检测控件是否在白名单中，判断待检测控件是否为合法控件，如果上述的待检测控件有一个是非法控件，则拒绝通过该引用站点加载该目标站点。解决了相关技术中由于点击劫持的造成的网页安全问题，有效提升了网页浏览过程中的安全性。
附图概述
此处所说明的附图用来提供对本公开的理解，构成本申请的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1是本公开实施例的一种网页安全检测方法的移动终端的硬件结构框图；
图2是根据本公开实施例的网页安全检测的流程图；
图3是根据本公开实施例中的实现防护方法的系统的结构框图；
图4是根据本公开实施例中提供的防护方法生成的流程图；
图5是根据本公开实施例的一种网页安全检测装置的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本公开。在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图1是本公开实施例的一种网页安全检测方法的移动终端的硬件结构框图。如图1所示，移动终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、被配置为存储数据的存储器104、以及被配置为通信功能的传输装置106。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，移动终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可被配置为存储应用软件的软件程序以及模块，如本公开实施例中的网页安全检测方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104还可包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端10。上述网络的实例包括但不限于互联网、 企业内部网、局域网、移动通信网及其组合。
传输装置106被配置为经由一个网络接收或者发送数据。上述的网络实例可包括移动终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其被配置为通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述移动终端的网页安全检测方法，图2是根据本公开实施例的网页安全检测的流程图，如图2所示，该流程包括如下步骤：
步骤S202，在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括该引用站点和该目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点；上述存储众多待检测控件的形式不局限于列表，也可以是每个待检测控件都有单独的存储空间。
步骤S204，依据预设白名单判断该待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定该引用站点是否为合法站点。
通过上述步骤，将引用站点和目标站点所有的待检测控件收集起来，依据白名单判断上述的待检测控件是否在白名单中，判断待检测控件是否为合法控件，如果上述的待检测控件有一个是非法控件，则拒绝通过该引用站点加载该目标站点。解决了相关技术中由于点击劫持的造成的网页安全问题，有效提升了网页浏览过程中的安全性。
可选地，在该待检测控件列表中的所有控件均存在于该预设白名单中时，确定该引用站点为合法站点，允许通过该引用站点加载该目标站点。
可选地，在该待检测控件列表中的至少一个待检测控件未存在于该预设白名单中时，确定该至少一个待检测控件为非法控件，并确定该引用站点为非法站点，拒绝通过该引用站点加载该目标站点。
可选地，该获取引用站点和目标站点的一个或多个待检测控件之前，获取 该引用站点和该目标站点各自的顶层统一资源定位符url路径，依据该顶层url路径判断该引用站点和该目标站点是否属于同源域。如果引用站点和目标站点不属于同源域，则不允许通过引用站点加载目标站点。顶层url路径，是指登陆一个网站的起始网页地址，是该网站根路径的主页地址，该网站的所有子页面路径均是在由这个根路径延伸出来的，例如：用户登陆网易官网www.163.com，在官网界面，用户点开了网易新闻的链接news.163.com，在本申请文件中，将网易官网www.163.com称为网易新闻等一系例网易下属网站站点的顶层url路径。相应的，网易新闻和网易邮箱(mail.163.com)拥有同一个顶层url路径，称网易新闻和网易邮箱属于同源域。该处补充的例子是对顶层url路径的解释，不限定本申请文件中的技术内容。
可选地，依据预设白名单判断该待检测控件列表中的待检测控件是否为非法控件之前，从网络侧设备获取预先存储的该预设白名单。预设白名单可以存储于网络侧设备，可以由网络侧设备定期下发，可以由管理员定期维护。
根据本公开的另一个实施例，还提供了一种网页安全检测方法，包括：
网络侧设备向用户设备下发预设白名单，其中，该预设白名单用于为该用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，该待检测控件列表中包括引用站点和目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点。
可选地，该网络侧设备通过以下方式之一向该用户设备下发该预设白名单，包括：
该网络侧设备依据预定时间点向该用户设备下发该预设白名单；
该网络侧设备接收该用户设备的请求信息，并依据该请求信息向该用户设备下发该预设白名单。
下面结合本公开实施例进行详细说明
在本公开实施例中提供了一种针对点击劫持攻击的防护方法，该方法是基于前端的防护方法，通过记录和比对前端页面的iframe控件，判断是否存在ClickJacking(点击劫持)攻击，在不影响页面本身的iframe控件使用的同时，能有效的防护ClickJacking(点击劫持)攻击。
为了使本公开实施例中的技术方案更加清楚，以下对本公开进行详细说明。应当理解，此处所描述的实施例仅仅用以解释本公开，并不用于限定本公开。
本公开实施例中提供一种针对点击劫持攻击的防护方法，通过使用预制的控件白名单，根据一定的判定准则，检测非法控件的存在，作为发现点击劫持攻击的依据，以提高用户的网络安全。该的控件白名单为事先预制的，并作为检测非法控件的依据。本公开实施例中的步骤可以包括以下三个步骤：
步骤一，首先判断引用站点和目标站点是否处于同源域中，如果不属于同源域，则不允许引用目标站点；如果属于同源域，则进行后续检测步骤；
步骤二，当引用站点和目标站点处于同源域时，获取引用站点和目标站点的指定控件列表(本方法中指定控件为iframe)；
步骤三，将步骤二中获得的控件列表依次与事先预制的白名单中的控件进行比对，检测是否存在非法控件，若存在非法控件，则认为存在点击劫持攻击；反之，则认为当前引用站点是合法的。
根据本公开实施例中的防护方法，可以分为两步检测，依次为：同源域检测，控件白名单检测，最终根据白名单检测步骤的输出结果，判定是否存在点击劫持的攻击行为。
防护方法实施例
图3是根据本公开实施例中的实现防护方法的系统的结构框图，如图3所示，系统中包括用户终端31和Web服务器34：
用户终端31上的引用网页32通过控件0(即iframe控件)加载目标网页33，而目标网页33中则包含控件1～控件n。
Web服务器34其中则存有事先预制的控件白名单35，用户终端31通过互联网可以从Web服务器34中获取控件白名单35的内容。
图4是根据本公开实施例中提供的防护方法生成的流程图，如图4所示，本防护方法的实现步骤包括以下四个步骤：
步骤S401，首先用户终端分别从引用网页和目标网页中获得各自的顶层url路径，通过这两个路径判断引用网页和目标网页是否属于同源域，如果不属于同源域，则认为存在点击劫持攻击，引用网页不合法；若属于同源域，则进行 后续检测；
步骤S402，用户终端先获取引用网页和目标网页的指定控件标识以生成待检测控件的列表，本实例中以iframe控件的id作为标识(iframe_0，iframe_1，……，iframe_n)，其中，iframe_0属于引用页面里的控件，iframe_1，……，iframe_n属于目标页面里的控件，引用页面通过控件iframe_0加载目标页面；
步骤S403，用户终端从Web服务器获取控件白名单，以作为检测依据；
步骤S404，将步骤S402中生成的控件列表依次与步骤三中的控件白名单比对，如果该控件存在于白名单中且控件标识不重复，则认为控件合法；如果该控件不存在于白名单中或控件标识重复，则认为该控件不合法，存在点击劫持攻击；根据步骤S404的结果，如果控件列表中的控件全部合法，则认为引用网页是合法网页；如果控件列表中的控件不是全部合法，则引用网页不合法，终止其对目标网页的加载，以防护点击劫持攻击。
采用本公开实施例中的技术方案，有效的为用户提供对于点击劫持攻击的防护。显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开实施例的范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开也意图包含这些改动和变型在内。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件实现。基于这样的理解，本公开的技术方案本质上或者说对相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法。
实施例2
在本实施例中还提供了一种网页安全检测装置，该装置被配置为实现上述实施例及实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以通过软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图5是根据本公开实施例的一种网页安全检测装置的结构框图，如图5所示，该装置包括：
获取模块52，被配置为在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括该引用站点和该目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点；
判断模块54，与该获取模块52连接，被配置为依据预设白名单判断该待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定该引用站点是否为合法站点。
可选地，该判断模块54还被配置为在该待检测控件列表中的所有控件均存在于该预设白名单中时，确定该引用站点为合法站点，允许通过该引用站点加载该目标站点。
可选地，该判断模块54还被配置为在该待检测控件列表中的至少一个待检测控件未存在于该预设白名单中时，确定该至少一个待检测控件为非法控件，并确定该引用站点为非法站点，拒绝通过该引用站点加载该目标站点。
可选地，该获取模块52还被配置为在获取引用站点和目标站点的一个或多个待检测控件之前，获取该引用站点和该目标站点各自的顶层统一资源定位符url路径，依据该顶层url路径判断该引用站点和该目标站点是否属于同源域。
可选地，该判断模块54还被配置为在依据预设白名单判断该待检测控件列表中的待检测控件是否为非法控件之前，从网络侧设备获取预先存储的该预设白名单。
根据本公开的另一个实施例，提供了一种网页安全检测装置，应用于网络侧设备，包括：
发送模块，被配置为向用户设备下发预设白名单，其中，该预设白名单用于为该用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，该待检测控件列表中包括引用站点和目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点。
可选地，该发送模块还被配置为通过以下方式之一向该用户设备下发该预 设白名单，包括：
该发送模块依据预定时间点向该用户设备下发该预设白名单；
该发送模块接收该用户设备的请求信息，并依据该请求信息向该用户设备下发该预设白名单。
上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本公开的实施例还提供了一种存储介质。例如，本公开实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行上述任一实施例中的方法。所述计算机可读存储介质可以是暂态计算机可读存储介质，也可以是非暂态计算机可读存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括该引用站点和该目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点；
S2，依据预设白名单判断该待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定该引用站点是否为合法站点。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
S3，网络侧设备向用户设备下发预设白名单，其中，该预设白名单用于为该用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，该待检测控件列表中包括引用站点和目标站点的待检测控件，该引用站点被配置为通过该引用站点的待检测控件加载该目标站点。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述实施例中方法步骤。
可选地，本实施例中的示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开不限制于任何特定的硬件和软件结合。
以上所述仅为本公开的实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开实施例的范围之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。
工业实用性
本申请提供的网页安全检测方法及装置，解决了相关技术中由于点击劫持的造成的网页安全问题，有效提升了网页浏览过程中的安全性。

Claims (15)

  1. 一种网页安全检测方法，包括：
    在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括所述引用站点和所述目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点；
    依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点。
  2. 根据权利要求1所述的方法，其中，依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点，包括：在所述待检测控件列表中的所有控件均存在于所述预设白名单中时，确定所述引用站点为合法站点，允许通过所述引用站点加载所述目标站点。
  3. 根据权利要求1所述的方法，其中，依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点，包括：
    在所述待检测控件列表中的至少一个待检测控件未存在于所述预设白名单中时，确定所述至少一个待检测控件为非法控件，并确定所述引用站点为非法站点，拒绝通过所述引用站点加载所述目标站点。
  4. 根据权利要求1所述的方法，其中，所述获取引用站点和目标站点的一个或多个待检测控件之前，所述方法还包括：
    获取所述引用站点和所述目标站点各自的顶层统一资源定位符url路径，依据所述顶层url路径判断所述引用站点和所述目标站点是否属于同源域。
  5. 根据权利要求1所述的方法，其中，依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件之前，所述方法还包括：
    从网络侧设备获取预先存储的所述预设白名单。
  6. 一种网页安全检测方法，包括：
    网络侧设备向用户设备下发预设白名单，其中，所述预设白名单用于为所述用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，所述待检测控件列表中包括引用站点和目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点。
  7. 根据权利要求6所述的方法，其中，所述网络侧设备通过以下方式之一向所述用户设备下发所述预设白名单，包括：
    所述网络侧设备依据预定时间点向所述用户设备下发所述预设白名单；
    所述网络侧设备接收所述用户设备的请求信息，并依据所述请求信息向所述用户设备下发所述预设白名单。
  8. 一种网页安全检测装置，包括：
    获取模块，被配置为在引用站点与目标站点处于同源域的情况下，获取待检测控件列表，其中，该待检测控件列表中包括所述引用站点和所述目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点；
    判断模块，被配置为依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件，并依据判断结果确定所述引用站点是否为合法站点。
  9. 根据权利要求8所述的装置，其中，所述判断模块还被配置为在所述待检测控件列表中的所有控件均存在于所述预设白名单中时，确定所述引用站点 为合法站点，允许通过所述引用站点加载所述目标站点。
  10. 根据权利要求9所述的装置，其中，所述判断模块还被配置为在所述待检测控件列表中的至少一个待检测控件未存在于所述预设白名单中时，确定所述至少一个待检测控件为非法控件，并确定所述引用站点为非法站点，拒绝通过所述引用站点加载所述目标站点。
  11. 根据权利要求8所述的装置，其中，所述获取模块还被配置为在获取引用站点和目标站点的一个或多个待检测控件之前，获取所述引用站点和所述目标站点各自的顶层统一资源定位符url路径，依据所述顶层url路径判断所述引用站点和所述目标站点是否属于同源域。
  12. 根据权利要求8所述的装置，其中，所述判断模块还被配置为在依据预设白名单判断所述待检测控件列表中的待检测控件是否为非法控件之前，从网络侧设备获取预先存储的所述预设白名单。
  13. 一种网页安全检测装置，应用于网络侧设备，包括：
    发送模块，被配置为向用户设备下发预设白名单，其中，所述预设白名单用于为所述用户设备判断待检测控件列表中的待检测控件是否为合法控件提供依据，其中，所述待检测控件列表中包括引用站点和目标站点的待检测控件，所述引用站点被配置为通过所述引用站点的待检测控件加载所述目标站点。
  14. 根据权利要求13所述的装置，其中，所述发送模块还被配置为通过以下方式之一向所述用户设备下发所述预设白名单，包括：
    所述发送模块依据预定时间点向所述用户设备下发所述预设白名单；
    所述发送模块接收所述用户设备的请求信息，并依据所述请求信息向所述用户设备下发所述预设白名单。
  15. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求1-5、6-7中任一项的方法。
PCT/CN2017/106887 2016-10-19 2017-10-19 网页安全检测方法及装置 WO2018072733A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610912020.5 2016-10-19
CN201610912020.5A CN107968769A (zh) 2016-10-19 2016-10-19 网页安全检测方法及装置

Publications (1)

Publication Number Publication Date
WO2018072733A1 true WO2018072733A1 (zh) 2018-04-26

Family

ID=61996443

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/106887 WO2018072733A1 (zh) 2016-10-19 2017-10-19 网页安全检测方法及装置

Country Status (2)

Country Link
CN (1) CN107968769A (zh)
WO (1) WO2018072733A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109062800A (zh) * 2018-07-28 2018-12-21 安徽捷兴信息安全技术有限公司 一种手机应用测试方法及装置
CN109947520A (zh) * 2019-03-27 2019-06-28 努比亚技术有限公司 网页控件的处理方法、装置、设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109522500B (zh) * 2018-11-26 2021-03-09 深圳乐信软件技术有限公司 网页显示方法、装置、终端和存储介质
CN110278207B (zh) * 2019-06-21 2023-04-07 深圳前海微众银行股份有限公司 一种点击劫持漏洞检测方法、装置及计算机设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8548917B1 (en) * 2012-09-07 2013-10-01 Amazon Technologies, Inc. Detection of child frames in web pages
US20130347070A1 (en) * 2012-06-26 2013-12-26 Google Inc. System and method for embedding first party widgets in third-party applications
CN104767747A (zh) * 2015-03-30 2015-07-08 微梦创科网络科技（中国）有限公司 点击劫持安全检测方法和装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130055369A1 (en) * 2011-08-24 2013-02-28 Mcafee, Inc. System and method for day-zero authentication of activex controls
CN103001817B (zh) * 2011-09-16 2016-08-10 厦门市美亚柏科信息股份有限公司 一种实时检测网页跨域请求的方法和装置
CN103973635B (zh) * 2013-01-24 2015-10-28 腾讯科技（深圳）有限公司 页面访问控制方法和相关装置及系统
CN104158789A (zh) * 2013-05-13 2014-11-19 腾讯科技（深圳）有限公司 一种支付类网站的安全性检测方法及装置
CN104243460B (zh) * 2014-09-03 2018-04-27 飞天诚信科技股份有限公司 一种实现网络防钓鱼的方法
CN105100061B (zh) * 2015-06-19 2018-09-04 小米科技有限责任公司 网址劫持检测的方法及装置
CN105119909B (zh) * 2015-07-22 2019-02-19 国家计算机网络与信息安全管理中心 一种基于页面视觉相似性的仿冒网站检测方法和系统
CN105184161B (zh) * 2015-08-11 2017-11-07 清华大学深圳研究生院 一种针对混合模式移动应用的检测方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130347070A1 (en) * 2012-06-26 2013-12-26 Google Inc. System and method for embedding first party widgets in third-party applications
US8548917B1 (en) * 2012-09-07 2013-10-01 Amazon Technologies, Inc. Detection of child frames in web pages
CN104767747A (zh) * 2015-03-30 2015-07-08 微梦创科网络科技（中国）有限公司 点击劫持安全检测方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109062800A (zh) * 2018-07-28 2018-12-21 安徽捷兴信息安全技术有限公司 一种手机应用测试方法及装置
CN109947520A (zh) * 2019-03-27 2019-06-28 努比亚技术有限公司 网页控件的处理方法、装置、设备及存储介质
CN109947520B (zh) * 2019-03-27 2023-12-08 努比亚技术有限公司 网页控件的处理方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN107968769A (zh) 2018-04-27

Similar Documents

Publication Publication Date Title
US9838408B1 (en) System, device and method for detecting a malicious attack based on direct communications between remotely hosted virtual machines and malicious web servers
WO2018072733A1 (zh) 网页安全检测方法及装置
US8505102B1 (en) Detecting undesirable content
JP6280641B2 (ja) アカウントログイン方法、デバイス及びシステム
US10075453B2 (en) Detecting suspicious files resident on a network
US9648033B2 (en) System for detecting the presence of rogue domain name service providers through passive monitoring
EP3210107B1 (en) Method and apparatus for facilitating the login of an account
CN109981653B (zh) 一种web漏洞扫描方法
US9215209B2 (en) Source request monitoring
US20140068720A1 (en) System and method for protecting devices on dynamically configured network
AU2016354668A1 (en) A distributed user profile identity verification system for e-commerce transaction security
CN103607385A (zh) 基于浏览器进行安全检测的方法和装置
US9948649B1 (en) Internet address filtering based on a local database
CN107493576B (zh) 用于确定无线接入点的安全信息的方法与设备
GB2512954A (en) Detecting and marking client devices
US9473516B1 (en) Detecting network attacks based on a hash
US10992669B2 (en) Acquisition of a device fingerprint from an instance of a client application
CN107395553B (zh) 一种网络攻击的检测方法、装置及存储介质
CN105634660B (zh) 数据包检测方法及系统
US20140019957A1 (en) Method, apparatus, and system for sharing software among terminals
WO2017084456A1 (zh) Wifi热点的处理方法、装置及系统
CN111106983B (zh) 一种检测网络连通性的方法及装置
US9270689B1 (en) Dynamic and adaptive traffic scanning
WO2019047693A1 (zh) 一种进行WiFi网络安全监控的方法与设备
Mansoori et al. Empirical analysis of impact of HTTP referer on malicious website behaviour and delivery

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17862585

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17862585

Country of ref document: EP

Kind code of ref document: A1