WO2020000748A1

WO2020000748A1 - File detection method and apparatus

Info

Publication number: WO2020000748A1
Application number: PCT/CN2018/108711
Authority: WO
Inventors: 熊庆昌
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-06-30
Filing date: 2018-09-29
Publication date: 2020-01-02
Also published as: CN108984673A; CN108984673B

Abstract

Disclosed are a file detection method and apparatus, wherein the method comprises: where a received status code returned by a server with regard to a first request is a target status code, acquiring first page content returned with regard to the first request, wherein the first page content comprises a first URL; determining N second URLs according to the first URL; sending N second requests to the server based on the N second URLs and receiving N pieces of second page content returned by the server with regard to the N second requests; and if M pieces of second page content in the N pieces of second page content match the first page content, determining that a file corresponding to the first URL is a target file. Applying the embodiment of the present application can increase the accuracy of file detection so as to reduce misinformation.

Description

File detection method and device

This application claims priority from a Chinese patent application filed with the Chinese Patent Office on June 30, 2018, with application number 2018107047079, and with the application name "a method and device for document detection", the entire contents of which are incorporated herein by reference. .

Technical field

The present application relates to the field of Internet technologies, and in particular, to a file detection method and device.

Background technique

Sensitive file detection refers to guessing whether there are specific sensitive files (such as test files, configuration files, management background files, backup files, etc.) in the web server or website through brute force methods. Generally speaking, in a website or web server, a sensitive file refers to a file that contains some sensitive information and cannot be directly accessed by any user.

At present, it is usually determined by matching a specific Hypertext Transfer Protocol (http) request that the status code returned is 200 (the server has successfully processed the request, indicating that the web page can be accessed normally) to determine whether the web server or website exists. Sensitive files. If the status code returned by the http request is 200, this page file can be accessed normally. If the status code returned by the http request is not 200, but 404 (the server cannot find the requested web page) or 403 (the server rejects the request), it means that the page file cannot be accessed. However, because some websites customize the status code 404 page returned by the http request, users will still return 200 when they visit non-existing pages (such as sensitive files). The status code is returned to determine whether there are a large number of false positives on a particular page.

Summary of the invention

The embodiments of the present application provide a file detection method and device, which can improve the accuracy of file detection and reduce false positives.

In a first aspect, an embodiment of the present application provides a file detection method, which includes:

When receiving the status code returned by the server for the first request as the target status code, acquiring the first page content returned for the first request, the first request including the first uniform resource locator URL;

N second URLs are determined according to the first URL, and any second URL in the N second URLs is a URL obtained by transforming based on the first URL, where N is an integer greater than or equal to 1;

Send N second requests to the server based on the N second URLs, and receive N second page content returned by the server for the N second requests, where a second request includes a second URL, a first Two requests correspond to a second page content;

If there are M second page contents in the N second page contents that match the first page content, it is determined that the file corresponding to the first URL is the target file, the M is an integer greater than or equal to 1, and the M is less than Or equal to N.

In a second aspect, an embodiment of the present application provides a file detection device, where the device includes:

An obtaining module, configured to obtain the first page content returned for the first request when the status code returned by the server for the first request is the target status code, where the first request includes a first uniform resource locator URL;

A first determining module, configured to determine N second URLs according to the first URL obtained by the obtaining module, and any second URL in the N second URLs is a URL obtained by transforming based on the first URL, the N is an integer greater than or equal to 1;

A transceiver module, configured to send N second requests to the server based on the N second URLs determined by the first determining module, and receive N second page content returned by the server for the N second requests, where A second request includes a second URL, and a second request corresponds to a second page content;

A second determining module, configured to determine that, when M second page contents in the N second page contents match the first page contents, a file corresponding to the first URL is a target file, and M is greater than or equal to An integer of 1, the M is less than or equal to the N.

In a third aspect, an embodiment of the present application provides a terminal, including a processor, an input device, an output device, and a memory. The processor, the input device, the output device, and the memory are connected to each other. The memory is used to store and support the execution of the terminal The computer program of the above method, the computer program comprising program instructions, the processor being configured to call the program instructions to execute the file detection method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute the foregoing first section. File detection methods on one hand.

The embodiment of the present application determines whether the file corresponding to the URL is the target file by comparing whether the content of the pages returned by multiple different requests are consistent, which can improve the accuracy of sensitive file detection, thereby reducing false positives of sensitive files.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flowchart of a file detection method according to an embodiment of the present application; FIG.

2 is another schematic flowchart of a file detection method according to an embodiment of the present application;

3 is a schematic block diagram of a document detection device according to an embodiment of the present application;

FIG. 4 is a schematic block diagram of a terminal provided by an embodiment of the present application.

detailed description

In the following, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

The embodiments of the present application may be applied in a penetration test process of a website or a web server. Penetration testing is a method to evaluate the security performance of computer network systems by using simulated hacker attacks. Usually when performing a penetration test on a website or web server, a comprehensive information collection is required for the website or web server, and scanning is performed on the website or web server for sensitive files such as configuration files and log files. This is because in a website or web server, sensitive files refer to files containing some sensitive information and cannot be directly accessed by any user. If sensitive files in the website or web server can be accessed by any user, hackers may use the information carried in these sensitive files to attack the website or web server, which may cause the website or web server to be paralyzed, and may even cause the Damage to the user's property of the website or web server.

The embodiment of the present application judges whether the content of the page returned by the first request containing the first URL and the content of the page returned by the second request containing the second URL (a URL not in the website or web server, that is, no URL exists) are compared to determine whether the content matches Whether the sensitive file in the website or web server can be accessed by any user. If it matches, it indicates that the sensitive file in the website or web server can be accessed by any user. Then, the file corresponding to the first URL can be determined as a sensitive file. This improves the accuracy of sensitive document detection and reduces false positives. It is also possible to modify the permissions of the file corresponding to the first URL or delete the file corresponding to the first URL in time after the sensitive file is found, thereby improving the security of the website or web server.

The document detection method and device provided in the embodiments of the present application will be described below with reference to FIGS. 1 to 4.

The first request and the second request in the embodiments of the present application may refer to the same type of request. For example, if the first request is a first http request, the second request is a second http request. This embodiment of the present application uses the first http request and the second http request as examples.

FIG. 1 is a schematic flowchart of a file detection method according to an embodiment of the present application. As shown in FIG. 1, the file detection method may include steps:

S101. When receiving the status code returned by the server for the first request as the target status code, the terminal obtains the content of the first page returned for the first request.

In some feasible implementation manners, the terminal may use a sensitive file scanning tool such as BBScan, Dirsearch, Opendoor, etc. to scan the URL in the server. The scanning process may be to use a sensitive file scanning tool to send an HTTP request containing the URL to the server. The server After receiving the http request, you can send the http status code corresponding to the URL in the http request to the terminal, such as status code 200 (the server has successfully processed the request, indicating that the web page can be accessed normally), status code 404 (the server cannot be found Requested web page), status code 403 (the server rejected the request), and so on. When the terminal receives that the status code returned by the server for the first http request is the target status code 200, the terminal first determines that the first URL carried by the first http request can be accessed by any user, and the terminal can receive the server's response to the first http request. The content of the first page returned by an http request. The first http request includes the first URL.

S102. The terminal determines N second URLs according to the first URL.

In some feasible implementations, the structure of the URL is usually "protocol: // servername (IP address) / path / filename". The terminal may perform at least one different character transformation on the file name portion of the first URL and / or the file suffix name of the first URL according to a preset rule (such as adding characters to the file name portion of the first URL). Perform different modifications at least once to obtain a total of N different second URLs. Any one of the N different second URLs may be a URL that is not in the foregoing server, that is, a URL that does not exist, and N is an integer greater than or equal to 1. One character conversion gets a second URL, and one modification gets a second URL. The type of the character may be one or more of numbers, letters (including uppercase and lowercase), and special characters, which are not limited in the embodiments of the present application. The terminal in the embodiment of the present application may automatically transform the first URL according to a preset rule, thereby obtaining a plurality of different second URLs (in fact, the second URL is a non-existent URL), thereby reducing manual processing steps. , Which improves the processing efficiency of file detection.

For example, if the first URL is http://xxx.pingan.com/conf/config.inc, and the status code corresponding to the first URL is 200, the terminal may add a single character to the header of the file name of the first URL. m "to get a second URL as http://xxx.pingan.com/conf/mconfig.inc, the terminal can also modify the file extension" .inc "of the first URL to a non-existing suffix format". "inu" to get another secondary URL as http://xxx.pingan.com/conf/mconfig.inu.

S103. The terminal sends N second requests to the server based on the N second URLs, and receives N second page content returned by the server for the N second requests.

In some feasible implementation manners, the terminal may send N second http requests to the server based on the N second URLs determined above. After receiving the second http requests sent by the terminal, the server The http requests all return a second page content corresponding to the second http request, and the terminal can receive the N second page content returned by the server for the N second http requests. A second http request includes a second URL determined as described above, and a second http request corresponds to a second page content. For example, assuming N = 3, the three second URLs determined above may be expressed as URL-a, URL-b, and URL-c, respectively, and the terminal may separately send a second http request a1 containing URL-a to the server and include the URL. -b's second http request b1, second URL request c1 including URL-c, the server receives the second http request a1, the second http request b1, the second http request c1, and respectively addresses the second http request a1 The second page content A1 corresponding to a1 is returned, and the second page content B1 corresponding to b1 is returned for the second http request b1. The second page content C1 corresponding to c1 is returned for the second http request c1. The terminal receives the three second page contents A1, B1, and C1 returned by the server.

In some feasible implementation manners, each time the terminal determines a second URL according to the first URL, the terminal may send a second http request including the second URL to the server, and receive the second http request returned by the server for the second http request. For the second page content, temporarily store the second page content corresponding to the second URL, and cycle N times to obtain N second page content corresponding to the N second URLs. The terminal may also first determine N second URLs according to the first URL, and then send N second HTTP requests to the server together, and receive the second page content returned by the server for each second http request, and obtain a total of N Second page content.

S104. If there are M second page contents in the N second page contents that match the first page content, the terminal determines that the file corresponding to the first URL is the target file.

In some feasible implementation manners, the terminal can detect whether each of the second page content received in the N second page content is the same as the first page content obtained in the above. If M exists in the N second page content, The content of each second page is the same as the content of the first page, and the terminal may determine that the file corresponding to the first URL is a target file (a sensitive file). If the contents of the N second pages are different from the contents of the first page, the terminal may determine that the file corresponding to the first URL is not a sensitive file. In the embodiment of the present application, by comparing whether the content of the first page and the content of the second page match, the accuracy of file detection can be improved and false positives can be reduced. This is because if the file corresponding to the first URL is a sensitive file, the first URL cannot be accessed by the user (that is, a page link that does not exist), that is, the status code corresponding to the first URL should indicate that the first URL cannot be accessed by the user. Access status code, such as 404 status code, 403 status code. However, because some websites or servers have customized 404 pages, the status code returned by the first http request containing the first URL is 200. Then, the first URL is transformed multiple times (in the header of the filename of the first URL, After adding a few characters at the end of the file name and / or the end of the file suffix name), a plurality of non-existing second URLs (referring to the links of the pages that do not exist in the website or server) are obtained. Because each second URL obtained after the first URL is transformed is a non-existing page link, and the first URL is also a non-existing page link, there must be at least one in the second page content corresponding to the second URL. The second page content is the same as the first page content corresponding to the first URL. Similarly, if the first URL itself is a page link that can be accessed by any user, then the status code corresponding to the first URL is 200, regardless of whether the website or server customizes the 404 page. The second URL is a non-existing page link, because each second URL is a non-existing page link, and the first URL is a normal page link, so the content of the second page corresponding to the second URL is all the same as the first URL. The content of the first page corresponding to the URL is different. The M may be an integer greater than or equal to 1, and the M may be less than or equal to the N.

For example, N = 3 and M = 1, the terminal can detect whether each of the three second page contents A1, B1, and C1 is the same as the first page content B1. At this time, the terminal detects one second page content After the page content B1 is the same as the first page content B1, the terminal can no longer detect whether the undetected second page content C1 among the three second page contents is the same as the first page content B1, and can directly determine the first URL. : The file corresponding to http://xxx.pingan.com/conf/config.inc is a sensitive file. In the embodiment of the present application, by finding M second page content that is the same as the first page content among the N second page contents, the search is no longer performed, which can improve the processing efficiency of file detection.

In some feasible implementation manners, the terminal may extract a first feature in the first page content, and the first feature may be a key character in the first page content, such as a title or first page content in the first page content. The first 50 characters. The terminal may also extract a second feature for each of the second second page content, to obtain a total of N second features. The second feature may be a key character in the content of the second page, and the second feature and the first feature are the same feature, that is, the first feature is a title in the first page content, and the second feature That is, the title in the second page content; the first feature is the first 50 characters in the first page content, and the second feature is the first 50 characters in the second page content. The terminal may detect whether the first feature is the same as each second feature of the N second features. If M second features among the N second features are the same as the first feature, the terminal may determine the first feature The file corresponding to a URL is a sensitive file. If none of the N second features are the same as the first feature, the terminal may determine that the file corresponding to the first URL is not a sensitive file. The M may be an integer greater than or equal to 1, and the M may be less than or equal to the N. In the embodiment of the present application, whether the first URL is a sensitive file is detected by detecting whether there are the same features among the N second features, the calculation amount is small, and the processing efficiency is high.

In the embodiment of the present application, when the status code returned by the server for the first request is the target status code, the first page content returned for the first request is obtained, where the first page content includes the first URL, and then according to the first A URL determines N second URLs, sends N second requests to the server based on the N second URLs, and receives N second page content returned by the server for the N second requests, if the N There are M second page contents in the second page content that match the first page content, then the file corresponding to the first URL is determined to be the target file, which can improve the accuracy of sensitive file detection, thereby reducing false positives of sensitive files .

Referring to FIG. 2, it is another schematic flowchart of a file detection method according to an embodiment of the present application. As shown in FIG. 2, the file detection method may include steps:

S201: When receiving the status code returned by the server for the first request as the target status code, the terminal obtains the content of the first page returned for the first request.

For the implementation manner of step S201 in the embodiment of the present application, reference may be made to the implementation manner provided by step S101 in the embodiment shown in FIG. 1, and details are not described herein again.

S202. The terminal adds characters N times at any N different positions in the file name part of the first URL to obtain N second URLs.

In some feasible implementation manners, the terminal may perform N character additions at any N different positions in the file name part of the first URL to obtain N second URLs. Wherein, adding one or more characters at any position in the file name part of the first URL is a character transformation of the file name part of the first URL. The N different positions may be the file name header, file name tail, and file suffix name tail of the first URL, respectively. One or more characters can be added in one position, and the characters added in each position can be different or the same. The type of the character may be one or more of numbers, letters (including uppercase and lowercase), and special characters, which are not limited in the embodiments of the present application. The embodiment of the present application obtains different second URLs by adding characters in different positions in the first URL file name portion (actually, the second URL is a non-existent URL). The operation is simple, the processing is convenient, and manufacturing can be improved. The accuracy of the URL, thereby improving the accuracy of detection in subsequent judgments.

Assume that the first URL is http://xxx.pingan.com/conf/config.inc and the status code corresponding to the first URL is 200. The terminal can add a character "x "To get a second URL as http://xxx.pingan.com/conf/xconfig.inc, and add a character" y "to the end of the file name of the first URL to get another second URL as http: // xxx.pingan.com/conf/configy.inc, you can also add a character "1" to the end of the file suffix of the first URL to modify the file suffix of the first URL so that the file suffix is ".inc1 "Doesn't exist, and you get another second URL: http://xxx.pingan.com/conf/config.inc1 is also a non-existent URL. Therefore, adding characters to the tail of the file suffix of the first URL by the terminal is also a way to modify the file suffix.

S203: The terminal sends N second requests to the server based on the N second URLs, and receives N second page content returned by the server for the N second requests.

For the implementation manner of step S203 in the embodiment of the present application, reference may be made to the implementation manner provided by step S103 in the embodiment shown in FIG. 1, and details are not described herein again.

S204. The terminal obtains the similarity values between each second page content and the first page content in the N second page contents to obtain N similarity values.

S205: If there are M similarity values among the N similarity values that are greater than the similarity threshold, the terminal determines that the file corresponding to the first URL is the target file.

In some feasible implementation manners, the terminal may use a page similarity algorithm such as a locally sensitive hash algorithm simhash or a minimum hash algorithm minhash to calculate each second page content and the first page content in the N second page contents. Between the similarity values, to obtain the N similarity values. The terminal then judges the magnitude relationship between each of the N similarity values and a preset similarity threshold. If there are M similarity values in the N similarity values that are greater than the preset similarity threshold, , The terminal may determine that the file corresponding to the first URL is a sensitive file. If all the N similarity values are less than or equal to the preset similarity threshold, the terminal may determine that the file corresponding to the first URL is not a sensitive file. The M may be an integer greater than or equal to 1, and the M may be less than or equal to the N. The embodiment of the present application can exclude the first page content and the second page content by calculating the similarity value of the first page content and the second page content, and comparing the magnitude relationship between the similarity value and a preset similarity threshold. The small difference between them affects the detection result of the file, thereby further improving the accuracy of the file detection.

For example, N = 3 and M = 1. The contents of the three second pages can be represented by A1, B1, and C1, respectively, and the contents of the first page can be represented by F1. The preset similarity threshold is 90%. The terminal uses simhash to calculate the similarity value between A1 and F1, the similarity value between B1 and F1, and the similarity value between C1 and F1. The three similarity values are similarity between A1 and F1, respectively. The degree value is 67%, the similarity value between B1 and F1 is 80%, and the similarity value between C1 and F1 is 94%. The terminal detects the size between the three similarity values of 67%, 80%, and 94% and a preset similarity threshold of 90%. Because the similarity value between C1 and F1 is 94% greater than the similarity threshold of 90%, The terminal determines that the file corresponding to the first URL is a sensitive file.

In some feasible implementation manners, after the terminal determines that the file corresponding to the first URL is a sensitive file, the terminal may output alarm prompt information, where the alarm prompt information includes the first URL, and the alarm prompt information is used to prompt the target user of the first URL. The file corresponding to a URL is a sensitive file, so that the target user can process the file corresponding to the first URL, to prevent malicious access by hackers and the server caused by the disclosure of sensitive file information, thereby causing the user's property to use the server. Loss and other issues. For example, after the terminal outputs the alarm prompt information, the programmer may delete or modify the file corresponding to the first URL to access the first URL as the highest level, that is, no one is allowed to access.

In the embodiment of the present application, when the status code returned by the server for the first request is the target status code, the first page content returned for the first request is obtained, where the first page content includes the first URL, and then the first page content is returned. The file name portion of a URL is subjected to N different character transformations to obtain N second URLs. Based on the N second URLs, N second requests are sent to the server, and the server receives the N second requests returned by the server. Of the N second page content, to obtain the similarity value between each second page content in the N second page content and the first page content, to obtain N similarity values, if the N similarity values If there are M similarity values greater than the similarity threshold, then the file corresponding to the first URL is determined as the target file, which can not only reduce the false positives of sensitive files, but also exclude the small differences between the page content to the detection results. The effect of this further improves the accuracy of document detection.

Referring to FIG. 3, it is a schematic block diagram of a document detection apparatus provided by an embodiment of the present application. The document detection device in the embodiment of the present application includes:

The obtaining module 10 is configured to obtain the first page content returned for the first request when the status code returned by the server for the first request is the target status code. The first request includes a first uniform resource locator URL.

The first determining module 20 is configured to determine N second URLs according to the first URL obtained by the obtaining module 10. Wherein, any second URL among the N second URLs is a URL obtained by transforming based on the first URL, and N is an integer greater than or equal to 1.

The transceiver module 30 is configured to send N second requests to the server based on the N second URLs determined by the first determining module 20, and receive N second page content returned by the server for the N second requests. . A second request includes a second URL, and a second request corresponds to a second page content.

The second determining module 40 is configured to determine that, when M second page contents in the N second page contents match the first page contents, a file corresponding to the first URL is a target file. Wherein, M is an integer greater than or equal to 1, and M is less than or equal to N.

In some feasible implementation manners, the first determining module 20 is configured to perform N different character transformations on the file name portion of the first URL obtained by the obtaining module 10 to obtain N second URLs. Among them, one character conversion obtains a second URL.

In some feasible implementation manners, the first determining module 20 is configured to perform N character additions at any N different positions in the file name portion of the first URL obtained by the obtaining module 10 to obtain N second URL; wherein, one or more characters are added at any position in the file name portion of the first URL as a character transformation of the file name portion of the first URL.

In some feasible implementation manners, the first determining module 20 is configured to perform N different modifications to the file suffix of the first URL obtained by the obtaining module 10 to obtain N second URLs. Among them, one modification obtains a second URL.

In some feasible implementation manners, the second determining module 40 includes a first obtaining unit 401, a detecting unit 402, and a first determining unit 403. The first obtaining unit 401 is configured to obtain a first feature in the first page content, and to obtain N second features of the N second page content; and the detecting unit 402 is used to detect the first obtaining unit. Whether the first feature obtained in 401 matches each second feature in the N second features; the first determining unit 403 is configured to: when there are M second features in the N second features and the first feature, When a feature matches, it is determined that the file corresponding to the first URL is a target file. One of the contents of the second page corresponds to one of the second features.

In some feasible implementation manners, the second determining module 40 includes a second obtaining unit 404 and a second determining unit 405. The second obtaining unit 404 is configured to obtain a similarity value between each second page content and the first page content in the N second page contents to obtain N similarity values; the second determining unit 405 Is used to determine that a file corresponding to the first URL is a target file when M similarity values among the N similarity values are greater than a similarity threshold.

In some feasible implementation manners, the second obtaining unit 404 is specifically configured to use a page similarity algorithm to calculate a similarity value between each second page content in the N second page contents and the first page content. Get N similarity values.

In some feasible implementation manners, the sending and receiving module 30 is further configured to output alarm prompt information after determining that a file corresponding to the first URL is a target file, where the alarm prompt information includes the first URL, and the alarm prompt information is used for Prompt that the file corresponding to the first URL is a sensitive file.

In specific implementation, the above-mentioned file detection device may implement the implementation manner provided by each step in the implementation manner provided in FIG. 1 or FIG. 2 through the foregoing modules to implement the functions implemented in the foregoing embodiments. For details, refer to the foregoing diagram. The corresponding description provided by each step in the method embodiment shown in FIG. 1 or FIG. 2 is not described herein again.

In the embodiment of the present application, when receiving the status code returned by the server for the first request as the target status code, the file detection device may obtain the first page content returned for the first request, where the first page content includes the first A URL, and then determine N second URLs according to the first URL, send N second requests to the server based on the N second URLs, and receive the N first URLs returned by the server for the N second requests Two-page content, if there are M second page contents in the N second page contents that match the first page content, determining the file corresponding to the first URL as the target file can improve the accuracy of sensitive file detection, This reduces false positives for sensitive files.

4 is a schematic block diagram of a terminal provided by an embodiment of the present application. As shown in FIG. 4, the terminal in the embodiment of the present application may include: one or more processors 801; one or more input devices 802, one or more output devices 803, and a memory 804. The processor 801, the input device 802, the output device 803, and the memory 804 are connected through a bus 805. The memory 802 is configured to store a computer program. The computer program includes program instructions. The processor 801 is configured to execute the program instructions stored in the memory 802. The input device 802 is configured to receive a status code returned by the server for the first request, and the processor 801 is configured to call the program instruction for execution:

N second URLs are determined according to the first URL, and any second URL in the N second URLs is a URL obtained by transforming based on the first URL, and N is an integer greater than or equal to 1.

The output device 803 is configured to send N second requests to the server based on the N second URLs, and the input device 802 is configured to receive N second page content returned by the server for the N second requests. One of the second requests includes a second URL, and one second request corresponds to a second page content.

The processor 801 is further configured to call the program instruction for execution. When there are M second page contents in the N second page contents that match the first page content, determine that a file corresponding to the first URL is a target file. . Wherein, M is an integer greater than or equal to 1, and M is less than or equal to N.

It should be understood that, in the embodiment of the present application, the processor 801 may be a central processing unit (CPU), and the processor may also be another general-purpose processor or a digital signal processor (DSP). , Application specific integrated circuit (ASIC), ready-made programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The input device 802 may include a receiver, a receiving program interface, and the like, and the output device 803 may include a transmitter, a sending program interface, and the like.

The memory 804 may include a read-only memory and a random access memory, and provide instructions and data to the processor 801. A part of the memory 804 may further include a non-volatile random access memory. For example, the memory 804 may also store information of a device type.

In specific implementation, the processor 801, the input device 802, and the output device 803 described in the embodiments of the present application may perform the implementation manners described in the file detection method provided in the embodiments of the present application, and may also execute the methods described in the embodiments of the present application. The implementation manner of the file detection device is not repeated here.

An embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, the files shown in FIG. 1 or FIG. 2 are implemented. For details of the detection method, refer to the description of the embodiment shown in FIG. 1 or FIG. 2, and details are not described herein again.

The computer-readable storage medium may be the file detection device or an internal storage unit of the terminal according to any of the foregoing embodiments, such as a hard disk or a memory of the terminal. The computer-readable storage medium may also be an external storage device of the terminal, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, and a flash memory card provided on the terminal. (flash card) and so on. Further, the computer-readable storage medium may include both an internal storage unit of the terminal and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium may also be used to temporarily store data that has been or will be output.

The above are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present invention. It should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

A file detection method, comprising:

When receiving the status code returned by the server for the first request as the target status code, acquiring the first page content returned for the first request, where the first request includes a first uniform resource locator URL;

N second URLs are determined according to the first URL, and any second URL in the N second URLs is a URL obtained by transforming based on the first URL, and N is an integer greater than or equal to 1. ;

Send N second requests to the server based on the N second URLs, and receive N second page content returned by the server for the N second requests, where a second request includes a second URL, a second request corresponds to a second page content;

If there are M second page contents in the N second page contents that match the first page content, it is determined that the file corresponding to the first URL is the target file, and M is an integer greater than or equal to 1. , The M is less than or equal to the N.
The method according to claim 1, wherein the determining N second URLs according to the first URL comprises:

Performing N different character transformations on the file name portion of the first URL to obtain N second URLs;

Among them, one character conversion obtains a second URL.
The method according to claim 2, wherein performing N different character transformations on the file name portion of the first URL comprises:

Performing N character additions at any N different positions in the file name portion of the first URL to obtain N second URLs;

Wherein, adding one or more characters at any position in the file name portion of the first URL is a character transformation of the file name portion of the first URL.
The method according to any one of claims 1-3, wherein if there are M second page contents in the N second page contents that match the first page contents, determining the The file corresponding to the first URL is the target file and includes:

Acquiring a first feature in the first page content, and acquiring N second features in the N second page content, one second page content corresponding to one second feature;

Detecting whether the first feature matches each of the N second features;

If there are M second features among the N second features that match the first feature, it is determined that the file corresponding to the first URL is a target file.
The method according to any one of claims 1-3, wherein if there are M second page contents in the N second page contents that match the first page contents, determining the The file corresponding to the first URL is the target file and includes:

Obtaining similarity values between each second page content and the first page content in the N second page content to obtain N similarity values;

If there are M similarity values among the N similarity values that are greater than a similarity threshold, it is determined that the file corresponding to the first URL is a target file.
The method according to claim 5, wherein the obtaining the similarity value between each second page content and the first page content in the N second page contents to obtain N similarities Values, including:

A page similarity algorithm is used to calculate a similarity value between each second page content and the first page content in the N second page contents to obtain N similarity values.
The method according to any one of claims 1-6, wherein after determining that a file corresponding to the first URL is a target file, the method further comprises:

Outputting alarm prompt information, the alarm prompt information includes the first URL, and the alarm prompt information is used to prompt that a file corresponding to the first URL is a sensitive file.
A document detection device, comprising:

An obtaining module, configured to obtain the first page content returned for the first request when the status code returned by the server for the first request is the target status code, the first request includes a first uniform resource locator URL ;

A first determining module, configured to determine N second URLs according to the first URL obtained by the obtaining module, and any second URL of the N second URLs is obtained after being transformed based on the first URL URL, where N is an integer greater than or equal to 1;

A transceiver module, configured to send N second requests to the server based on the N second URLs determined by the first determining module, and receive the N first requests returned by the server for the N second requests Two-page content, where a second request includes a second URL, and a second request corresponds to a second page content;

A second determining module, configured to: when there are M second page contents in the N second page contents that match the first page content, determine that a file corresponding to the first URL is a target file, and the M Is an integer greater than or equal to 1, the M is less than or equal to the N.
The apparatus according to claim 8, wherein the first determining module is configured to:

Performing N different character transformations on the file name portion of the first URL obtained by the obtaining module to obtain N second URLs;

Among them, one character conversion obtains a second URL.
The apparatus according to claim 8, wherein the first determining module is configured to:

Performing N character additions at any N different positions in the file name portion of the first URL obtained by the obtaining module to obtain N second URLs;

Wherein, adding one or more characters at any position in the file name portion of the first URL is a character transformation of the file name portion of the first URL.
The apparatus according to any one of claims 8 to 10, wherein the second determining module comprises:

A first obtaining unit, configured to obtain a first feature in the first page content, and obtain N second features in the N second page content, where one second page content corresponds to one second feature;

A detecting unit, configured to detect whether the first feature obtained by the first obtaining unit matches each second feature of the N second features;

A first determining unit, configured to determine that a file corresponding to the first URL is a target file when M second features among the N second features match the first feature.
The apparatus according to any one of claims 8 to 10, wherein the second determining module comprises:

A second obtaining unit, configured to obtain similarity values between each second page content and the first page content in the N second page contents to obtain N similarity values;

A second determining unit is configured to determine that a file corresponding to the first URL is a target file when M similarity values among the N similarity values are greater than a similarity threshold.
The apparatus according to claim 12, wherein the second obtaining unit is specifically configured to:

A page similarity algorithm is used to calculate a similarity value between each second page content and the first page content in the N second page contents to obtain N similarity values.
The device according to any one of claims 8-13, wherein the transceiver module is further configured to output alarm prompt information after determining that the file corresponding to the first URL is a target file, and the alarm prompt information Including the first URL, the alarm prompt information is used to prompt the file corresponding to the first URL to be a sensitive file.
A terminal is characterized in that it includes a processor, an input device, an output device, and a memory, and the processor, the input device, the output device, and the memory are connected to each other. The memory is used to store a computer program, and the computer program Including program instructions, the processor is configured to call the program instructions to execute:

When receiving the status code returned by the server for the first request as the target status code, acquiring the first page content returned for the first request, where the first request includes a first uniform resource locator URL;

N second URLs are determined according to the first URL, and any second URL in the N second URLs is a URL obtained by transforming based on the first URL, and N is an integer greater than or equal to 1. ;

The output device is configured to send N second requests to the server based on the N second URLs, and the input device is configured to receive N second pages returned by the server for the N second requests Content, where a second request includes a second URL, and a second request corresponds to a second page content;

The processor is further configured to call the program instruction to execute a file corresponding to the first URL when M second page content matches the first page content in the N second page content. Is an object file, where M is an integer greater than or equal to 1, and M is less than or equal to the N.
The terminal according to claim 15, wherein the processor is specifically configured to:

Performing N different character transformations on the file name portion of the first URL to obtain N second URLs;

Among them, one character conversion obtains a second URL.
The terminal according to claim 16, wherein the processor is specifically configured to:

Performing N character additions at any N different positions in the file name portion of the first URL to obtain N second URLs;

Wherein, adding one or more characters at any position in the file name portion of the first URL is a character transformation of the file name portion of the first URL.
The terminal according to any one of claims 15-17, wherein the processor is specifically configured to:

Acquiring a first feature in the first page content, and acquiring N second features in the N second page content, one second page content corresponding to one second feature;

Detecting whether the first feature matches each of the N second features;

If there are M second features among the N second features that match the first feature, it is determined that the file corresponding to the first URL is a target file.
The terminal according to any one of claims 15-17, wherein the processor is specifically configured to:

Obtaining similarity values between each second page content and the first page content in the N second page contents to obtain N similarity values;

If there are M similarity values among the N similarity values that are greater than a similarity threshold, it is determined that the file corresponding to the first URL is a target file.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of claims 1-7 is required.