WO2020057523A1 - 触发漏洞检测的方法及装置 - Google Patents

触发漏洞检测的方法及装置 Download PDF

Info

Publication number
WO2020057523A1
WO2020057523A1 PCT/CN2019/106297 CN2019106297W WO2020057523A1 WO 2020057523 A1 WO2020057523 A1 WO 2020057523A1 CN 2019106297 W CN2019106297 W CN 2019106297W WO 2020057523 A1 WO2020057523 A1 WO 2020057523A1
Authority
WO
WIPO (PCT)
Prior art keywords
webpage
target
type
tree structure
changed
Prior art date
Application number
PCT/CN2019/106297
Other languages
English (en)
French (fr)
Inventor
吴培壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020057523A1 publication Critical patent/WO2020057523A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a method and a device for triggering vulnerability detection.
  • the webpage structure of all webpages included in the website can be detected according to a preset period. If it is detected that there are webpages whose webpage structure has changed in the webpages included in the website, the vulnerability detection of the website can be triggered.
  • the present application provides a method and a device for triggering vulnerability detection, which can be used to solve the problem that a website has a relatively large security risk due to failure to trigger a vulnerability detection on the website in a related technology.
  • the technical solution is as follows:
  • a method for triggering vulnerability detection includes: receiving a target uniform resource locator (URL) for accessing a target webpage sent by a user terminal; and detecting a target URL corresponding to the target URL. Whether the structure of the webpage has changed; if it is detected that the structure of the webpage of the target webpage corresponding to the target URL has changed, the vulnerability detection of the target website to which the target webpage belongs is triggered.
  • URL uniform resource locator
  • a target URL sent by a user terminal when a target URL sent by a user terminal is received, it is possible to detect whether the webpage structure of the target webpage corresponding to the target URL has changed, and trigger the target website when it is detected that the webpage structure of the target webpage has changed. Vulnerability detection. In this way, if the webpage structure of the target webpage in the target website changes, the change can be detected in time when the target URL sent by the user terminal is received, and the vulnerability detection operation is triggered in time, which effectively reduces the Immediately trigger security risks from vulnerability detection.
  • the implementation process of detecting whether the webpage structure of the target webpage corresponding to the target URL has changed may include: obtaining a first webpage structure of the target webpage, where the first webpage structure refers to a webpage of the target webpage stored before the current moment Structure, and the first webpage structure includes at least one type of tree structure; rendering the target webpage and obtaining a second webpage structure of the target webpage at the current moment, the second webpage structure includes a tree structure included with the first webpage structure The same type of tree structure; based on the first webpage structure and the second webpage structure, determine whether the webpage structure of the target webpage has changed.
  • the first webpage structure may include at least one of a document object model (DOM) tree structure, a JavaScript structure, and a cascading style sheets (CSS) style structure. This embodiment of the present application does not specifically limit this.
  • the second webpage structure includes a tree structure of the same type as the tree structure included in the first webpage structure.
  • the implementation process of determining whether the webpage structure of the target webpage has changed based on the first webpage structure and the second webpage structure may include: for each webpage structure in the first webpage structure and the second webpage structure, determining Multiple parameter values for each type of tree structure in each web page structure; multiple parameter values for each type of tree structure in the first web page structure and multiple parameters for each type of tree structure in the second web page structure Value to determine the parameter values of multiple target parameters corresponding to each type of tree structure; based on the parameter values of multiple target parameters corresponding to each type of tree structure, determine whether the webpage structure of the target webpage has changed.
  • the multiple parameter values of each type of tree structure may include at least two of the total length value, average length value, maximum length value, minimum length value, and number of nodes of the corresponding type of tree structure.
  • the parameter values of the plurality of target parameters corresponding to each type of tree structure may include at least two of a total length change rate, an average length change rate, a maximum length change rate, a minimum length change rate, and a degree of structural coincidence.
  • an implementation process of determining multiple parameter values of each type of tree structure in each web page structure may include: determining a root node and each leaf node in each type of tree structure in each web page structure. Multiple length values of the corresponding type of tree structure in the corresponding webpage structure; determine the total length of the corresponding type of tree structure in the corresponding webpage structure based on the multiple length values of each type of tree structure in each webpage structure Length value, average length value, maximum length value, and minimum length value; obtain the number of nodes of each type of tree structure in each web page structure, and the number of nodes of each type of tree structure in each web page structure, The total length value, average length value, maximum length value, and minimum length value are used as multiple parameter values of the corresponding type of tree structure in the corresponding webpage structure.
  • the implementation process of determining whether the webpage structure of the target webpage has changed may include: multiple targets corresponding to each type of tree structure
  • the parameter value of the parameter is used as the input of the neural network model, and the value of the network structure change status obtained by the neural network model is obtained.
  • the neural network model is obtained by training on multiple sample sets. Each sample set in the multiple sample sets contains each type.
  • the neural network model may be a fully connected neural network model, and the output layer of the neural network model may use a sigmoid neuron.
  • the first threshold may be a value set according to the network structure change state value in multiple sample sets during the training of the neural network model. For example, the first threshold may be 0.5.
  • the webpage structure of the target webpage corresponding to the target URL before detecting whether the webpage structure of the target webpage corresponding to the target URL has changed, it may also be detected whether the webpage content of the target webpage has changed; , Execute the step of detecting whether the webpage structure of the target webpage corresponding to the target URL has changed.
  • the implementation process of detecting whether the webpage content of the target webpage has changed may include: determining a hash value of the webpage content of the target webpage at the current time; obtaining a stored hash of the webpage content of the target webpage before the current time Value; if the hash value of the web page content of the target web page at the current time is different from the hash value of the web page content of the target web page before the current time, it is determined that the web page content of the target web page has changed.
  • the URL database stores the data received before the current time. All URLs of the target website; if the target URL exists in the URL database, performing a step of detecting whether the webpage structure of the target webpage corresponding to the target URL has changed. If the target URL does not exist in the URL database, the vulnerability detection of the target website is triggered.
  • the URL included in the URL database may be a URL accessed by all user terminals before the current time.
  • the vulnerability detection is triggered, so as to ensure that the vulnerability detection of the target website is triggered in time before the user terminal accesses the new webpage, thereby reducing the security risk of the target website.
  • a device for triggering vulnerability detection has a function of implementing the method behavior of triggering vulnerability detection in the first aspect.
  • the apparatus for triggering vulnerability detection includes at least one module, and the at least one module is configured to implement the method for triggering vulnerability detection provided by the first aspect.
  • a device for triggering vulnerability detection includes a processor and a memory, where the memory is configured to store a device that supports triggering vulnerability detection to execute the device provided by the first aspect.
  • the processor is configured to execute a program stored in the memory.
  • the operating device of the storage device may further include a communication bus for establishing a connection between the processor and the memory.
  • a computer-readable storage medium stores instructions that, when run on a computer, cause the computer to execute the method for triggering vulnerability detection according to the first aspect.
  • a computer program product containing instructions which when run on a computer, causes the computer to execute the method for triggering vulnerability detection as described in the first aspect above.
  • a target URL sent by a user terminal when a target URL sent by a user terminal is received, it is possible to detect whether the webpage structure of the target webpage corresponding to the target URL has changed, and trigger the target website when it is detected that the webpage structure of the target webpage has changed. Vulnerability detection. In this way, if the webpage structure of the target webpage in the target website changes, the change can be detected in time when the target URL sent by the user terminal is received, and the vulnerability detection operation is triggered in time, which effectively reduces the Immediately trigger security risks from vulnerability detection.
  • FIG. 1 is an implementation environment diagram of a method for triggering vulnerability detection provided by an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a computer device according to an embodiment of the present application.
  • FIG. 3 is a flowchart of a method for triggering vulnerability detection according to an embodiment of the present application.
  • FIG. 4 is a flowchart of determining whether a web page structure of a target web page has changed according to an embodiment of the present application
  • FIG. 5 is a schematic diagram of a fully connected neural network model according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an apparatus for triggering vulnerability detection according to an embodiment of the present application.
  • coding vulnerabilities may occur when writing web page code due to the limitations of the level and experience of developers.
  • new pages may be added to the website, or the original pages on the website may have changed.
  • website vulnerabilities may also occur.
  • the method for triggering vulnerability detection provided in the embodiments of the present application can be used to trigger at an appropriate time. Vulnerability testing of websites.
  • FIG. 1 is an implementation environment diagram of a method for triggering vulnerability detection provided by an embodiment of the present application.
  • the implementation environment includes a user terminal 101, a gateway 102, and a website server 103.
  • the user terminal 101 has a communication connection with the gateway 102
  • the gateway 102 has a communication connection with the website server 103.
  • the user terminal 101 may send the target Uniform Resource Locator (URL) for accessing the target webpage to the gateway 102 through the installed browser.
  • the gateway 102 may analyze the target URL according to the analysis result, determine the website server 103 corresponding to the target URL according to the analysis result, and forward the target URL to the corresponding website server 103.
  • the website server 103 can process the target URL and the target webpage corresponding to the target URL by using the method for triggering vulnerability detection provided in the embodiment of the present application, and then decide whether to Trigger a vulnerability detection on the website.
  • the user terminal 101 may refer to a smart phone, a tablet computer, a notebook computer, a desktop computer, and the like.
  • the gateway 102 may have a routing function device.
  • the gateway 102 may be a router, a server with a routing protocol enabled, a proxy server, and the like.
  • the website server 103 may be a server or a server cluster, which is not specifically limited in the embodiment of the present application.
  • the method for triggering vulnerability detection provided in the embodiment of the present application may also be applied to the gateway 102. That is, after the gateway 102 receives the target URL for accessing the target webpage sent by the user terminal 101, the gateway 102 may use the method for triggering vulnerability detection provided in the embodiment of the application to target the target URL and the target corresponding to the target URL. The webpage processes it, and then determines whether to trigger a vulnerability detection on the website based on the processing result.
  • the method is applied to a website server as an example to explain this application in detail, but this does not constitute a limitation on the embodiment of the application.
  • FIG. 2 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
  • the website server in FIG. 1 can be implemented by the computer device shown in FIG. 2.
  • the computer device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.
  • the processor 201 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more of the programs used to control the execution of the program of the solution of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication bus 202 may include a path for transmitting information between the aforementioned components.
  • the memory 203 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory (RAM)) or other information that can store information and instructions
  • ROM read-only memory
  • RAM random access memory
  • Type of dynamic storage device which can also be electrically erasable and programmable read-only memory (Erasable, Programmable, Read-Only Memory, EEPROM), Compact Disc (Read-Only Memory, CD-ROM) or other optical disk storage, optical discs Storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be written Any other medium that the computer can access, but is not limited to.
  • the memory 203 may exist independently, and is connected to the processor 201 through a communication bus 202.
  • the memory 203 may also be integrated with the processor 201.
  • the communication interface 204 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the processor 201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 2.
  • the computer device may include multiple processors, such as the processor 201 and the processor 205 shown in FIG. 2. Each of these processors may be a single-CPU processor or a multi-CPU processor.
  • a processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).
  • the computer device may further include an output device 206 and an input device 207.
  • the output device 206 is in communication with the processor 201 and can display information in a variety of ways.
  • the output device 206 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector.
  • the input device 207 is in communication with the processor 201 and can receive user input in a variety of ways.
  • the input device 207 may be a mouse, a keyboard, a touch screen device, a sensing device, or the like.
  • the above-mentioned computer equipment may be a general-purpose computer equipment or a special-purpose computer equipment.
  • the embodiment of the present application does not limit the type of computer equipment.
  • the memory 203 is configured to store program code for executing the solution of the present application, and the processor 201 controls execution.
  • the processor 201 is configured to execute the program code 208 stored in the memory 203.
  • the program code 208 may include one or more software modules.
  • the website server shown in FIG. 1 may trigger the vulnerability detection of the website through the processor 201 and one or more software modules in the program code 208 in the memory 203.
  • FIG. 3 is a flowchart of a method for triggering vulnerability detection according to an embodiment of the present application. This method can be applied to the website server or gateway shown in FIG. 1, and the following description is made by using the website server as an example. Referring to FIG. 3, the method includes:
  • Step 301 Receive a target URL for accessing a target webpage sent by a user terminal.
  • the target URL of the target webpage may be sent to the website server through the gateway.
  • the website server can receive the target URL, then obtain corresponding webpage information according to the target URL, and return the acquired webpage information to the user terminal.
  • Each webpage in the website corresponds to a unique URL, that is, the target URL can be used to uniquely identify the target webpage.
  • Step 302 Detect whether the webpage structure of the target webpage corresponding to the target URL has changed.
  • the website server directly obtains the webpage of the target webpage according to the parameters contained in the target URL Information will be at risk.
  • the website server may first detect whether the webpage structure of the target webpage corresponding to the target URL has changed, and determine whether to trigger a vulnerability detection according to the detection result, and then Vulnerability detection results to determine whether to obtain the web page information of the target web page. That is, in the embodiment of the present application, the website server may trigger the vulnerability detection in time by detecting whether the structure of the target webpage has changed before acquiring and feedbacking the webpage information of the target webpage, thereby reducing the security risk of the website.
  • the website server may detect whether the webpage structure of the target webpage corresponding to the target URL has changed through steps 3021-3023.
  • the first webpage structure refers to the webpage structure of the target webpage before the current moment of storage.
  • the website server can record the webpage structure of all the webpages in the target website when the vulnerability detection of the target website is triggered for the first time and the detection result is no vulnerability. After that, whenever a vulnerability detection is triggered, if the detection result is no vulnerability, the previously recorded webpage structure is updated once. In this way, when the website server receives the target URL for accessing the target webpage in the target website, the website server can obtain the webpage structure of the target webpage that was updated when the target website was detected to be free of vulnerabilities before the current moment. , Which is the first page structure of the landing page.
  • the first webpage structure may include at least one type of tree structure.
  • the first webpage structure may include at least one of a document object model (DOM) tree structure, a JavaScript structure, and a Cascading Style Sheets (CSS) style structure. This embodiment of the present application does not specifically limit this.
  • DOM document object model
  • JavaScript JavaScript
  • CSS Cascading Style Sheets
  • the website server may obtain the webpage information of the target webpage according to the target URL, and simulate the browser to render the target webpage according to the webpage information of the target webpage. After that, the website server records the webpage structure of the target webpage rendered at the current moment, that is, the second webpage structure of the target webpage.
  • the second webpage structure includes a tree structure of the same type as the tree structure included in the first webpage structure. That is, what type of tree structure is included in the first webpage structure, and what type of tree structure is also included in the second webpage structure. For example, if the first webpage structure includes a DOM tree structure, the second webpage structure also includes a DOM tree structure. If the first webpage structure includes a DOM tree structure and a CSS style structure, the second webpage structure also includes a DOM tree structure and a CSS style structure. The embodiments of this application are not repeated here.
  • the website server can determine whether the webpage structure of the target webpage has changed based on the first webpage structure and the second webpage structure of the target webpage, and then decide whether to Trigger a vulnerability detection on the target website.
  • the website server may determine whether the webpage structure of the target webpage has changed based on the first webpage structure and the second webpage structure of the target webpage through steps (1)-(3).
  • the first webpage structure includes at least one type of tree structure
  • the second webpage structure includes the same type of tree structure as the tree structure included in the first webpage structure, that is, the second webpage structure Also includes at least one type of tree structure.
  • the website server may determine multiple parameter values of each type of tree structure included in the first webpage structure, and determine multiple parameters of each type of tree structure included in the second webpage structure. value.
  • the multiple parameter values of each type of tree structure included in the first webpage structure are determined as an example to describe the implementation of this step.
  • the website server may determine the length value between the root node and each leaf node in each type of tree structure included in the first web page structure, and obtain multiple length values of the corresponding type of tree structure in the first web page structure; Multiple length values of each type of tree structure in a web page structure determine the total length value, average length value, maximum length value, and minimum length value of the corresponding type of tree structure in the first web page structure; Number of nodes of each type of tree structure, and the number, total length value, average length value, maximum length value, and minimum length value of each type of tree structure node in the first webpage structure are corresponding to the first webpage structure. Multiple parameter values for a tree structure of type.
  • each of them includes multiple nodes, and the multiple nodes include a root node, multiple intermediate nodes, and multiple leaf nodes.
  • the website server can obtain a root node in the DOM tree structure and each leaf node in a plurality of leaf nodes. Between the length values to get multiple length values.
  • the website server can calculate the sum of multiple length values to obtain the total length value of the DOM tree structure, calculate the average value of the multiple length values, obtain the average length value of the DOM tree structure, and determine the maximum value from the multiple length values. Value to obtain the maximum length value of the DOM tree structure, determine the minimum value from multiple length values, and obtain the minimum length value of the DOM tree structure. In addition, the web server can determine the number of all nodes included in the DOM tree structure. The total length value, average length value, maximum length value, minimum length value, and number of nodes of the DOM tree structure determined as described above can be used as multiple parameter values of the DOM tree structure.
  • the multiple parameter values of the DOM tree structure may include the total length value, the average length value, the maximum length value, the minimum length value, and the number of nodes of the DOM tree structure. part.
  • the multiple parameter values of the DOM tree structure may only include the total length value, the average length value, the maximum length value, and the minimum length value of the DOM tree structure.
  • the multiple parameter values of the DOM tree structure may also include other parameter values that can be used to characterize the structure of the webpage, in addition to the above parameters. This embodiment of the present application does not specifically limit this.
  • the multiple parameter values of the corresponding type of tree structure can be determined by referring to the above method for determining multiple parameter values of the DOM tree structure.
  • the method for determining multiple parameter values of each type of tree structure included in the first webpage structure can be referred to to determine the second webpage structure.
  • Multiple parameter values of each type of tree structure included are not repeated herein in the embodiment of the present application.
  • each type of The multiple parameter values of the tree structure and the multiple parameter values of the corresponding type of tree structure in the second webpage structure should include parameter values of the same parameter.
  • the multiple parameter values of the DOM tree structure in the first webpage structure obtained include the total length value, the average length value of the DOM tree structure, and the number of nodes in the DOM tree structure
  • the DOM tree structure in the obtained second webpage structure The multiple parameter values of should also include at least two of the total length value, the average length value of the DOM tree structure, and the number of nodes of the DOM tree structure.
  • the website server may The multiple parameter values of the tree structure are compared with the multiple parameter values of the corresponding type of tree structure in the second webpage structure, so as to obtain the parameter values of multiple target parameters corresponding to the corresponding type of tree structure.
  • the multiple target parameters may include at least two of a total length change rate, an average length change rate, a maximum length change rate, a minimum length change rate, and a degree of structural coincidence.
  • the website server may convert each parameter value of multiple parameter values of the DOM tree structure in the first web page structure and the corresponding parameter value of the DOM tree structure in the second web page structure. The comparison is performed to obtain the parameter values of the corresponding target parameters.
  • multiple parameter values of the DOM tree structure in the first webpage structure and multiple parameter values of the DOM tree structure in the second webpage structure include a total length value, an average length value, a maximum length value, and a minimum length value And the number of nodes, the website server may determine the total length of the DOM tree structure by the following formula (1) according to the total length value of the DOM tree structure in the first webpage structure and the total length value of the DOM tree structure in the second webpage structure.
  • Change rate determines the average length change rate of the DOM tree structure by the following formula (2), according to the first The maximum length value of the DOM tree structure in the web page structure and the maximum length value of the DOM tree structure in the second web page structure.
  • the maximum length change rate of the DOM tree structure is determined by the following formula (3).
  • the minimum length change rate of the DOM tree structure is determined by the following formula (4).
  • the number of nodes and the number of nodes of the DOM tree structure in the second webpage structure, the structural coincidence degree of the DOM tree structure is determined by the following formula (5).
  • ⁇ sum is the change rate of the total length of the DOM tree structure
  • L sum2 is the total length value of the DOM tree structure in the second webpage structure
  • L sum1 is the total length value of the DOM tree structure in the first webpage structure.
  • ⁇ avg is the average length change rate of the DOM tree structure
  • Lavg2 is the average length value of the DOM tree structure in the second webpage structure
  • Lavg1 is the average length value of the DOM tree structure in the first webpage structure.
  • ⁇ max is the maximum change in length of the DOM tree structure
  • L max2 is the maximum length of the second web page DOM tree structure
  • L max1 is the maximum length of the first web page DOM tree structure.
  • ⁇ min is the minimum length change rate of the DOM tree structure
  • L min2 is the minimum length value of the DOM tree structure in the second web page structure
  • L min1 is the minimum length value of the DOM tree structure in the first web page structure.
  • multiple parameter values of the DOM tree structure in the first webpage structure and the DOM tree structure in the second webpage structure may include part of the total length value, average length value, maximum length value, minimum length value, and number of nodes.
  • the web server is based on multiple DOM tree structures in the first webpage structure.
  • the parameter values and the multiple target parameters determined by the multiple parameter values of the DOM tree structure in the second webpage structure also include the total length change rate, the average length change rate, the maximum length change rate, the minimum length change rate, and the degree of structural coincidence. section.
  • the multiple parameter values of the DOM tree structure in the first web page structure and the multiple parameter values of the DOM tree structure in the second web page structure may also include other parameter values in addition to the above several parameter values.
  • the target parameters may also include parameters other than the above several target parameters, which are not specifically limited in this embodiment of the present application.
  • the above mainly uses the DOM tree structure as an example to explain the implementation of determining the parameter values of multiple target parameters corresponding to the DOM tree structure.
  • the above methods are used to determine the parameter values of the target parameters corresponding to other types of tree structures, which are not described in this embodiment of the present application.
  • the website server can determine whether the web page structure of the target web page has changed based on the parameter values of multiple target parameters corresponding to each type of tree structure. .
  • the website server may use the parameter values of multiple target parameters corresponding to each type of tree structure as the input of the neural network model, and obtain the network structure change status value output by the neural network model. It is obtained through training on each sample set, and each sample set in the multiple sample sets includes a set of parameter values of multiple target parameters corresponding to each type of tree structure and a network structure change state value corresponding to the corresponding sample set; if the neural network model The output network structure change status value is greater than the first threshold, it is determined that the webpage structure of the target webpage has changed.
  • the neural network model may be a fully connected neural network model as shown in FIG. 5, and an output layer of the neural network model may use a sigmoid neuron.
  • the web server can train the neural network model based on multiple sample sets. Each sample set in the multiple sample sets includes a set of parameter values of multiple target parameters corresponding to each type of tree structure in multiple types of tree structures and a network structure change status value corresponding to the corresponding sample set.
  • the website server may use a set of parameter values of multiple target parameters included in the first sample set as the input of the neural network model, and obtain corresponding output results, and compare the output results with the first
  • the deviation between the network structure change state values included in each sample set, and the backpropagation algorithm is used to update the weights and offsets in the neural network model through the deviation.
  • a set of parameter values of multiple target parameters included in the second sample set is used as the input of the neural network model, and the above steps are repeated until the output result of the neural network model corresponds to the network structure in the sample set corresponding to the output result.
  • the neural network model is considered to have been trained.
  • the preset value can be set according to the required accuracy of the neural network model.
  • the parameter values of multiple target parameters corresponding to each type of tree structure may be used as the parameter values.
  • the input value of the neural network model and the network structure change state value obtained by the neural network model are obtained. Since the output layer of the neural network model uses sigmoid neurons, the network structure change state value will be between 0-1.
  • the website server can determine whether the value of the change status of the network structure is greater than the first threshold value. If it is greater than the first threshold value, it can be determined that the webpage structure of the target webpage has changed. No change.
  • the first threshold may be a value set according to the network structure change state value in multiple sample sets during the training of the neural network model, for example, the first threshold may be 0.5.
  • the website server may further adjust the foregoing first threshold value according to the webpage structure change state value.
  • the webpage structure change status value may be combined with the webpage structure change status value previously output by the neural network model and used to characterize that the webpage structure has changed.
  • the first threshold is adjusted. If the webpage structure change status value is not greater than 0.5, at this time, the webpage structure change status value can be combined with the webpage structure change status value previously output by the neural network model and used to characterize the webpage structure unchanged. The first threshold is adjusted.
  • the website server may also first detect whether the webpage content of the target webpage corresponding to the target URL has changed, and if the webpage content of the target webpage has changed, then detect whether the webpage structure of the target webpage has changed. That is, before step 302, the website server may also perform a step of detecting whether the webpage content of the target webpage corresponding to the target URL has changed, and then execute step 302 when it is detected that the webpage content of the target webpage has changed. .
  • the website server may obtain the webpage information of the target webpage according to the target URL, and determine the current time based on the webpage information of the target webpage obtained.
  • the hash value of the web content of the landing page At the same time, the website server can obtain the hash value of the content of the webpage of the target webpage before the current time and store the hash value of the content of the webpage of the target webpage at the current time with the content of the webpage of the target webpage before the current time. Compare the hash values of. If the two are not the same, it means that the web page content of the target web page has changed. Otherwise, it can be determined that the web page content of the target web page has not changed.
  • the target webpage corresponding to the target URL sent by the user terminal may be a newly added webpage, and after the target webpage is added, no vulnerability detection has been performed.
  • the website server no longer needs to detect whether the webpage content of the target webpage and the structure of the webpage have changed, but directly triggers vulnerability detection on the target webpage. That is, in the embodiment of the present application, before detecting whether the webpage content of the target webpage has changed, the website server may first detect whether the target webpage corresponding to the target URL is a newly added webpage. Alternatively, if the website server does not perform the step of detecting whether the webpage content of the target webpage has changed, the website server may detect whether the target webpage is a newly added webpage before detecting whether the webpage structure of the target webpage has changed.
  • the website server can detect whether the received target URL exists in the URL database to detect whether the target web page corresponding to the target URL is a newly added web page. If the target URL exists in the URL database, it can determine that the target web page is not In order to add a new web page, the web server may perform the step of detecting whether the web page content of the target web page has changed, or the web server may directly perform the step of detecting whether the web page structure of the target web page has changed. If the target URL does not exist in the URL database, it can be determined that the target webpage is a newly added webpage. At this time, the website server can directly trigger a vulnerability detection on the target website.
  • the web server may When it is determined that the received target URL is the URL received for the first time, the target webpage corresponding to the target URL is confirmed as a new webpage, and then a vulnerability detection is triggered, so as to ensure that the user terminal is triggered in time before the new webpage is accessed.
  • the vulnerability detection of the target website reduces the security risks of the target website.
  • the URL included in the URL database may be a URL accessed by all user terminals before the current moment. In this way, the website server may compare the received target URL with the URL in the URL database. This is used to determine whether the target URL is the first received URL.
  • Step 303 If it is detected that the webpage structure of the target webpage corresponding to the target URL has changed, trigger a vulnerability detection on the target website to which the target webpage belongs.
  • the web server If the web server detects that the web page structure of the target web page corresponding to the target URL has changed, it means that the target web page has been changed. At this time, the web server can trigger vulnerability detection of the target web site to avoid possible Existing vulnerabilities threaten the security of the target website.
  • the website server when receiving the target URL sent by the user terminal, can detect whether the webpage structure of the target webpage corresponding to the target URL has changed, and when it detects that the webpage structure of the target webpage has changed. Trigger vulnerability detection on the target website. In this way, if the page structure of the target page in the target website changes, the change can be detected in time when the target URL sent by the user terminal is received, and the vulnerability detection operation is triggered in time, which is effective. Reduced security risks caused by failure to trigger vulnerability detection in a timely manner.
  • the embodiment of the present application may be timely by detecting whether the target URL exists in the URL database or directly detecting whether the content or structure of the webpage of the target URL changes. Trigger vulnerability detection of the target website, thereby effectively reducing the security risks caused by the newly added web pages.
  • the embodiment of the present application detects the webpage structure of the target webpage corresponding to the target URL after receiving the target URL, and can also trigger the vulnerability detection in time before the user terminal obtains the webpage information of the target webpage. , Which effectively reduces the security risks caused by web page updates.
  • the website server needs to detect the page structure of all the pages in the website every cycle in order to determine whether to trigger vulnerability detection. In this case, for some large websites that include thousands of pages For example, when a vulnerability detection is triggered by a method in the related art, it takes a lot of time to detect a change in the structure of a webpage. In the embodiment of the present application, the website server can determine whether to trigger the vulnerability detection by detecting the webpage structure of the webpage corresponding to a received URL, which consumes short time and ensures the timeliness of triggering.
  • the device for triggering vulnerability detection provided in the embodiment of the present application is described next.
  • an embodiment of the present application provides a device for triggering vulnerability detection.
  • the device includes:
  • the receiving module 601 is configured to perform step 301 in the foregoing embodiment
  • the first triggering module 603 is configured to perform step 303 in the foregoing embodiment.
  • the first detection module 602 includes:
  • a first obtaining unit configured to obtain a first webpage structure of a target webpage, where the first webpage structure refers to a stored webpage structure of the target webpage before the current time, and the first webpage structure includes at least one type of tree structure;
  • a second obtaining unit configured to render the target webpage and obtain a second webpage structure of the target webpage at the current moment, and the second webpage structure includes a tree structure of the same type as the tree structure included in the first webpage structure;
  • the judging unit is configured to judge whether the webpage structure of the target webpage has changed based on the first webpage structure and the second webpage structure.
  • the judgment unit is specifically configured to:
  • a first determining subunit configured to determine, for each webpage structure in the first webpage structure and the second webpage structure, multiple parameter values of each type of tree structure in each webpage structure;
  • a second determining subunit configured to determine each type of tree structure based on multiple parameter values of each type of tree structure in the first web page structure and multiple parameter values of each type of tree structure in the second web page structure Parameter values of corresponding multiple target parameters;
  • a judging subunit is configured to judge whether a webpage structure of a target webpage has changed based on parameter values of multiple target parameters corresponding to each type of tree structure.
  • the first determining subunit is specifically configured to:
  • the judging subunit is specifically configured to:
  • the parameter values of multiple target parameters corresponding to each type of tree structure are used as the input of the neural network model, and the network structure change status value output by the neural network model is obtained.
  • the neural network model is obtained by training on multiple sample sets. Each sample set in the sample set contains a set of parameter values of multiple target parameters corresponding to each type of tree structure and a network structure change state value corresponding to the corresponding sample set;
  • the network structure change status value output by the neural network model is greater than the first threshold, it is determined that the webpage structure of the target webpage has changed.
  • the device further includes:
  • a second detection module configured to detect whether the webpage content of the target webpage has changed
  • the second triggering module is configured to trigger the first detecting module to detect whether the webpage structure of the target webpage corresponding to the target URL has changed if the webpage content of the target webpage has changed.
  • the second detection module is specifically configured to:
  • the hash value of the web page content of the target web page at the current time is different from the hash value of the web page content of the target web page before the current time, it is determined that the web page content of the target web page has changed.
  • the device further includes:
  • a third detection module configured to detect whether the target URL exists in the URL database, and the URL database stores all URLs of the target website received before the current moment;
  • the third triggering module is configured to trigger the first detecting module to detect whether the webpage structure of the target webpage corresponding to the target URL has changed if the target URL exists in the URL database.
  • the device is further used for:
  • the vulnerability detection of the target website is triggered.
  • a target URL sent by a user terminal when a target URL sent by a user terminal is received, it can be detected whether the webpage structure of the target webpage corresponding to the target URL has changed, and when the webpage structure of the target webpage has been detected, When a change occurs, a vulnerability detection is triggered on the target website. In this way, if the page structure of the target webpage in the target website changes, the change can be detected in time when the target URL sent by the user terminal is received, and the vulnerability detection operation is triggered in time , Which effectively reduces the security risks caused by failure to trigger vulnerability detection in a timely manner.
  • the embodiment of the present application may be timely by detecting whether the target URL exists in the URL database or directly detecting whether the content or structure of the webpage of the target URL changes. Trigger vulnerability detection of the target website, thereby effectively reducing the security risks caused by the newly added web pages.
  • the embodiment of the present application detects the webpage structure of the target webpage corresponding to the target URL after receiving the target URL, and can also trigger the vulnerability detection in time before the user terminal obtains the webpage information of the target webpage. , Which effectively reduces the security risks caused by web page updates.
  • the device for triggering vulnerability detection when the device for triggering vulnerability detection provided in the foregoing embodiment triggers vulnerability detection, only the above-mentioned division of functional modules is used as an example. In actual applications, the above functions may be allocated by different functional modules as required. Finished, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • the device for triggering vulnerability detection and the method for triggering vulnerability detection provided by the foregoing embodiments belong to the same concept. For specific implementation processes, refer to the method embodiments, and details are not described herein again.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center via wired (for example: coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (for example: infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the available medium may be a magnetic medium (for example: a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a Digital Versatile Disc (DVD)), or a semiconductor medium (for example, a solid state disk (Solid State Disk) )Wait.
  • a magnetic medium for example: a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a Digital Versatile Disc (DVD)
  • DVD Digital Versatile Disc
  • semiconductor medium for example, a solid state disk (Solid State Disk)
  • the program may be stored in a computer-readable storage medium.
  • the storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请公开了一种触发漏洞检测的方法及装置，属于互联网技术领域。本申请可以在接收到用户终端发送的目标URL时，检测该目标URL对应的目标网页的网页结构是否已发生变化，并在检测到目标网页的网页结构已发生变化时触发对目标网站进行漏洞检测，这样，若目标网站中的目标网页的网页结构发生变化，则在接收到用户终端发送的目标URL时即可以及时发现该变化，并及时触发漏洞检测操作，从而有效降低了由于未能及时触发漏洞检测所带来的安全风险。

Description

触发漏洞检测的方法及装置 技术领域
本申请涉及互联网技术领域，特别涉及一种触发漏洞检测的方法及装置。
背景技术
在复杂的网络环境中，各类网站存在着大量潜在的可利用的漏洞，为了防止他人利用网站的漏洞对网站进行恶意攻击，可以在网站中新增网页或者是网站包括的网页的网页结构发生变化时，触发对网站进行漏洞检测。
相关技术中，可以按照预设周期对该网站包括的所有网页的网页结构进行检测，若检测到该网站包括的网页中存在网页结构发生变化的网页，则可以触发对该网站进行漏洞检测。
然而，由于相关技术中只能定期的对所有网页的网页结构进行检测，因此，当网页的网页结构发生变化的时间与定期检测网页的网页结构的时间之间存在时间差时，将无法及时发现网页的网页结构发生变化，也就无法及时触发对网站进行漏洞检测，从而导致网站存在较大的安全风险。
发明内容
本申请提供了一种触发漏洞检测的方法及装置，可以用于解决相关技术中由于无法及时触发对网站进行漏洞检测而导致的网站存在较大的安全风险的问题。所述技术方案如下：
第一方面，提供了一种触发漏洞检测的方法，该方法包括：接收用户终端发送的用于访问目标网页的目标统一资源定位符(uniform resource locator，URL)；检测目标URL对应的目标网页的网页结构是否已发生变化；若检测到目标URL对应的目标网页的网页结构已发生变化，则触发对目标网页所属的目标网站进行漏洞检测。
本申请实施例可以在接收到用户终端发送的目标URL时，检测该目标URL对应的目标网页的网页结构是否已发生变化，并在检测到目标网页的网页结构已发生变化时触发对目标网站进行漏洞检测，这样，若目标网站中的目标网页的网页结构发生变化，则在接收到用户终端发送的目标URL时即可以及时发现该变化，并及时触发漏洞检测操作，从而有效降低了由于未能及时触发漏洞检测所带来的安全风险。
可选地，检测目标URL对应的目标网页的网页结构是否发生变化的实现过程，可以包括：获取目标网页的第一网页结构，第一网页结构是指存储的在当前时刻之前的目标网页的网页结构，且第一网页结构包括至少一种类型的树结构；对目标网页进行渲染，并获取目标网页在当前时刻的第二网页结构，第二网页结构包括有与第一网页结构包括的树结构相同类型的树结构；基于第一网页结构和第二网页结构，判断目标网页的网页结构是否已发生变化。
其中，第一网页结构可以包括文档对象模型(document object model，DOM)树 结构、JavaScript结构和层叠样式表(cascading style sheets，CSS)样式结构中至少一种。本申请实施例对此不做具体限定。第二网页结构包括有与第一网页结构包括的树结构相同类型的树结构。
可选地，基于第一网页结构和第二网页结构，判断目标网页的网页结构是否已发生变化的实现过程，可以包括：对于第一网页结构和第二网页结构中的每个网页结构，确定每个网页结构中每种类型的树结构的多个参数值；基于第一网页结构中每种类型的树结构的多个参数值和第二网页结构中每种类型的树结构的多个参数值，确定每种类型的树结构对应的多个目标参数的参数值；基于每种类型的树结构对应的多个目标参数的参数值，判断目标网页的网页结构是否已发生变化。
其中，每种类型的树结构的多个参数值可以包括相应类型的树结构的总长度值、平均长度值、最大长度值、最小长度值以及相应类型的树结构的节点的数量中的至少两个。相应地，每种类型的树结构对应的多个目标参数的参数值可以包括总长度变化率、平均长度变化率、最大长度变化率、最小长度变化率以及结构重合度中的至少两个。
可选地，确定每个网页结构中每种类型的树结构的多个参数值的实现过程，可以包括：确定每个网页结构中每种类型的树结构中的根节点与每个叶子节点之间的长度值，得到相应网页结构中相应类型的树结构的多个长度值；基于每个网页结构中每种类型的树结构的多个长度值确定相应网页结构中相应类型的树结构的总长度值、平均长度值、最大长度值和最小长度值；获取每个网页结构中每种类型的树结构的节点的数量，并将每个网页结构中每种类型的树结构的节点的数量、总长度值、平均长度值、最大长度值和最小长度值作为相应网页结构中相应类型的树结构的多个参数值。
可选地，基于每种类型的树结构对应的多个目标参数的参数值，判断目标网页的网页结构是否已发生变化的实现过程，可以包括：将每种类型的树结构对应的多个目标参数的参数值作为神经网络模型的输入，并获取神经网络模型输出的网络结构变化状态值，神经网络模型是通过多个样本集训练得到，多个样本集中的每个样本集包含有每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值；若神经网络模型输出的网络结构变化状态值大于第一阈值，则确定目标网页的网页结构已发生变化。
其中，该神经网络模型可以为全连接神经网络模型，且该神经网络模型的输出层可以使用sigmoid神经元。第一阈值可以根据该神经网络模型的训练过程中的多个样本集中的网络结构变化状态值来设置的一个值，例如，第一阈值可以为0.5。
可选地，在本申请实施例中，在检测目标URL对应的目标网页的网页结构是否已发生变化之前，还可以检测目标网页的网页内容是否已发生变化；若目标网页的网页内容已发生变化，则执行检测目标URL对应的目标网页的网页结构是否已发生变化的步骤。
在本申请中，可以先检测目标网页的网页内容是否已发生变化，若是，再检测目标URL对应的目标网页的网页结构是否已发生变化。这样，由于网页结构发生变化的网页，其网页内容均会发生变化，且检测网页内容是否发生变化的计算量相较于检测网页结构是否发生变化的计算量较小，因此，在对目标网页的网页内容进行检测之后， 对于网页内容未发生变化的网页则不必再进行网页结构的检测，降低了对网站服务器资源的占用。
可选地，检测目标网页的网页内容是否已发生变化的实现过程，可以包括：确定当前时刻的目标网页的网页内容的哈希值；获取存储的当前时刻之前的目标网页的网页内容的哈希值；若当前时刻的目标网页的网页内容的哈希值与当前时刻之前的目标网页的网页内容的哈希值不同，则确定目标网页的网页内容已发生变化。
可选地，在本申请中，在检测目标URL对应的目标网页的网页结构是否已发生变化之前，还可以先检测目标URL是否存在于URL数据库中，URL数据库中存储有当前时刻之前接收到的目标网站的所有URL；若目标URL存在于URL数据库中，则执行检测目标URL对应的目标网页的网页结构是否已发生变化的步骤。若目标URL不存在于URL数据库中，则触发对目标网站进行漏洞检测。
在本申请中，URL数据库中包括的URL可以是当前时刻之前所有用户终端访问过的URL。在检测目标URL对应的目标网页的网页结构是否已发生变化之前，可以通过检测目标URL是否存在与URL数据库中来判断该目标URL是否为首次接收到的URL，若是，则可以将该目标URL对应的目标网页确认为新增网页，进而触发漏洞检测，以此来保证在用户终端对该新增网页进行访问之前及时触发目标网站的漏洞检测，降低目标网站的安全风险。
第二方面，提供了一种触发漏洞检测的装置，所述触发漏洞检测的装置具有实现上述第一方面中触发漏洞检测的方法行为的功能。所述触发漏洞检测的装置包括至少一个模块，该至少一个模块用于实现上述第一方面所提供的触发漏洞检测的方法。
第三方面，提供了一种触发漏洞检测的装置，所述触发漏洞检测的装置的结构中包括处理器和存储器，所述存储器用于存储支持触发漏洞检测的装置执行上述第一方面所提供的触发漏洞检测的方法的程序，以及存储用于实现上述第一方面所提供的触发漏洞检测的方法所涉及的数据。所述处理器被配置为用于执行所述存储器中存储的程序。所述存储设备的操作装置还可以包括通信总线，该通信总线用于该处理器与存储器之间建立连接。
第四方面，提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的触发漏洞检测的方法。
第五方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的触发漏洞检测的方法。
上述第二方面、第三方面、第四方面和第五方面所获得的技术效果与第一方面中对应的技术手段获得的技术效果近似，在这里不再赘述。
本申请提供的技术方案带来的有益效果至少包括：
本申请实施例可以在接收到用户终端发送的目标URL时，检测该目标URL对应的目标网页的网页结构是否已发生变化，并在检测到目标网页的网页结构已发生变化时触发对目标网站进行漏洞检测，这样，若目标网站中的目标网页的网页结构发生变化，则在接收到用户终端发送的目标URL时即可以及时发现该变化，并及时触发漏洞检测操作，从而有效降低了由于未能及时触发漏洞检测所带来的安全风险。
附图说明
图1是本申请实施例提供的触发漏洞检测的方法的实施环境图；
图2是本申请实施例提供的一种计算机设备的结构示意图；
图3是本申请实施例提供的一种触发漏洞检测的方法流程图；
图4是本申请实施例提供的一种判断目标网页的网页结构是否已发生变化的流程图；
图5是本申请实施例提供的一种全连接神经网络模型的示意图；
图6是本申请实施例提供的一种触发漏洞检测的装置结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
在对本申请实施例进行详细的解释说明之前，先对本申请实施例涉及的应用场景予以介绍。
在网站创建之初，由于开发人员的水平和经验的限制，在编写网站的网页代码时，可能会出现编码漏洞。另外，在网站运营过程中，由于业务更新，网站中可能会新增网页，也可能网站中的原始的网页发生了变化，在这种情况下，同样可能会出现网站漏洞。为了避免攻击者利用网站创建过程中或者是网站业务更新过程中产生的漏洞对网站进行恶意攻击，在网站创建完成之后，即可以通过本申请实施例提供的触发漏洞检测的方法在适当的时机触发对网站的漏洞检测。
接下来对本申请实施例提供的触发漏洞检测的方法的实施环境进行介绍。
图1是本申请实施例提供的触发漏洞检测的方法的实施环境图。如图1所示，该实施环境包括用户终端101、网关102和网站服务器103。其中，用户终端101与网关102建立有通信连接，网关102与网站服务器103建立有通信连接。
需要说明的是，用户终端101中可以通过安装的浏览器向网关102发送用于访问目标网页的目标统一资源定位符(Uniform Resource Locator，URL)。网关102在接收到用户终端101发送的目标URL后，可以根据对该目标URL进行解析，并根据解析结果确定该目标URL对应的网站服务器103，并将该目标URL转发至对应的网站服务器103。网站服务器103在接收到网关102转发的目标URL之后，可以通过本申请实施例提供的触发漏洞检测的方法来对该目标URL以及该目标URL对应的目标网页进行处理，进而根据处理结果来决定是否触发对网站进行漏洞检测。
其中，用户终端101可以为指智能手机、平板电脑、笔记本电脑、台式电脑等。 网关102可以具有路由功能的设备，例如，该网关102可以为路由器、启用了路由协议的服务器、代理服务器等。网站服务器103可以是一台服务器，也可以是一个服务器集群，本申请实施例对此不做具体限定。
可选地，在一种可能的实现方式中，本申请实施例提供的触发漏洞检测的方法也可以应用于网关102中。也即，当网关102接收到用户终端101发送的用于访问目标网页的目标URL之后，网关102可以通过本申请实施例提供的触发漏洞检测的方法来对该目标URL以及该目标URL对应的目标网页进行处理，进而根据处理结果来决定是否触发对网站进行漏洞检测。在接下来的实施例中，将以该方法应用于网站服务器为例来对本申请进行详细的解释说明，但这并不构成对本申请实施例的限定。
图2是本发明实施例提供的一种计算机设备的结构示意图。图1中的网站服务器即可以通过图2所示的计算机设备来实现。参见图2，该计算机设备包括至少一个处理器201，通信总线202，存储器203以及至少一个通信接口204。
处理器201可以是一个通用中央处理器(Central Processing Unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信总线202可包括一通路，在上述组件之间传送信息。
存储器203可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，随机存取存储器(random access memory，RAM))或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器203可以是独立存在，通过通信总线202与处理器201相连接。存储器203也可以和处理器201集成在一起。
通信接口204，使用任何收发器一类的装置，用于与其它设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，例如图2中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机设备可以包括多个处理器，例如图2中所示的处理器201和处理器205。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，计算机设备还可以包括输出设备206和输入设备207。输出设备206和处理器201通信，可以以多种方式来显示信息。例如，输出设备206可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪 (projector)等。输入设备207和处理器201通信，可以以多种方式接收用户的输入。例如，输入设备207可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的计算机设备可以是一个通用计算机设备或者是一个专用计算机设备。本申请实施例不限定计算机设备的类型。
其中，存储器203用于存储执行本申请方案的程序代码，并由处理器201来控制执行。处理器201用于执行存储器203中存储的程序代码208。程序代码208中可以包括一个或多个软件模块。图1中所示的网站服务器可以通过处理器201以及存储器203中的程序代码208中的一个或多个软件模块，来触发对网站的漏洞检测。
接下来对本申请实施例提供的触发漏洞检测的方法进行详细的解释说明。
图3是本申请实施例提供的一种触发漏洞检测的方法的流程图。该方法可以应用于图1所示的网站服务器或网关，接下来以应用于网站服务器为例进行说明。参见图3，该方法包括：
步骤301：接收用户终端发送的用于访问目标网页的目标URL。
当用户终端要访问目标网站的目标网页时，可以通过网关向网站服务器发送目标网页的目标URL。网站服务器可以接收该目标URL，进而根据该目标URL获取相应地网页信息，并将获取的网页信息返回给用户终端。
其中，网站中的每个网页均对应有唯一的URL，也即，目标URL可以用于唯一标识目标网页。
步骤302：检测目标URL对应的目标网页的网页结构是否已发生变化。
由于发送该目标URL的用户终端有可能是恶意攻击者所持有的终端，因此，若目标网页所属的目标网站存在漏洞，则网站服务器直接根据该目标URL中包含的参数来获取目标网页的网页信息将会存在安全风险。基于此，在本申请实施例中，网站服务器在接收到该目标URL之后，可以首先检测目标URL对应的目标网页的网页结构是否已发生变化，并根据检测结果来确定是否触发漏洞检测，进而根据漏洞检测结果来决定是否获取目标网页的网页信息。也即，在本申请实施例中，网站服务器可以在获取并反馈目标网页的网页信息之前，通过检测目标网页的网页结构是否已发生变化来及时触发漏洞检测，从而降低网站的安全风险。
示例性的，在本申请实施例中，参见图4，网站服务器可以通过步骤3021-3023来检测目标URL对应的目标网页的网页结构是否已发生变化。
3021：获取目标网页的第一网页结构。
需要说明的是，第一网页结构是指存储的当前时刻之前的目标网页的网页结构。示例性的，网站服务器可以在第一次触发对目标网站进行漏洞检测，且检测结果为无漏洞时，记录目标网站中的全部网页的网页结构。之后，每当触发一次漏洞检测，若检测结果为无漏洞，则对之前记录的网页结构进行一次更新。这样，当网站服务器接收到用于访问目标网站中的目标网页的目标URL时，网站服务器可以根据该目标URL获取当前时刻之前最近一次检测到该目标网站无漏洞时所更新的目标网页的网页结构，也即目标网页的第一网页结构。
其中，第一网页结构可以包括至少一种类型的树结构。示例性的，第一网页结构 可以包括文档对象模型(document object model，DOM)树结构、JavaScript结构和层叠样式表(cascading style sheets，CSS)样式结构中的至少一种。本申请实施例对此不做具体限定。
3022：对目标网页进行渲染，并获取目标网页在当前时刻的第二网页结构。
在获取到目标网页的第一网页结构之后，网站服务器可以根据目标URL获取目标网页的网页信息，并模拟浏览器根据该目标网页的网页信息渲染该目标网页。之后，网站服务器记录当前时刻渲染得到的该目标网页的网页结构，也即该目标网页的第二网页结构。
需要说明的是，第二网页结构包括有与第一网页结构包括的树结构相同类型的树结构。也即，第一网页结构中包括有什么类型的树结构，第二网页结构中也将包括有什么样类型的树结构。例如，若第一网页结构包括DOM树结构，则第二网页结构也包括DOM树结构。若第一网页结构包括DOM树结构和CSS样式结构，则第二网页结构也包括DOM树结构和CSS样式结构。本申请实施例在此不再赘述。
3023：基于第一网页结构和第二网页结构，判断目标网页的网页结构是否已发生变化。
在获取到目标网页的第一网页结构和第二网页结构之后，网站服务器可以基于目标网页的第一网页结构和第二网页结构，来判断目标网页的网页结构是否已发生变化，进而来决定是否触发对目标网站进行漏洞检测。
其中，网站服务器可以通过步骤(1)-(3)来基于该目标网页的第一网页结构和第二网页结构，判断目标网页的网页结构是否已发生变化。
(1)对于第一网页结构和第二网页结构中的每个网页结构，确定每个网页结构中每种类型的树结构的多个参数值。
其中，由前文所述可知，第一网页结构包括至少一种类型的树结构，而第二网页结构包括有与第一网页结构包括的树结构相同类型的树结构，也即，第二网页结构也包括至少一种类型的树结构。基于此，在本申请实施例中，网站服务器可以确定第一网页结构包括的每种类型的树结构的多个参数值，并确定第二网页结构包括的每种类型的树结构的多个参数值。接下来以确定第一网页结构包括的每种类型的树结构的多个参数值为例来对本步骤的实现方式进行说明。
网站服务器可以确定第一网页结构包括的每种类型的树结构中的根节点与每个叶子节点之间的长度值，得到第一网页结构中相应类型的树结构的多个长度值；基于第一网页结构中每种类型的树结构的多个长度值确定第一网页结构中相应类型的树结构的总长度值、平均长度值、最大长度值和最小长度值；获取第一网页结构中每种类型的树结构的节点的数量，并将第一网页结构中每种类型的树结构的节点的数量、总长度值、平均长度值、最大长度值和最小长度值作为第一网页结构中相应类型的树结构的多个参数值。
其中，对于DOM树结构、JavaScript结构和CSS样式结构中的任一种类型的树结构，其均包括多个节点，且该多个节点中包括根节点、多个中间节点和多个叶子节点。在本申请实施例中，对于第一网页结构包括的每种类型的树结构，以DOM树结构为例，网站服务器可以获取DOM树结构中的根节点与多个叶子节点中每个叶子节点之 间的长度值，得到多个长度值。之后，网站服务器可以计算多个长度值的总和，得到该DOM树结构的总长度值，计算多个长度值的平均值，得到该DOM树结构的平均长度值，从多个长度值中确定最大值，得到该DOM树结构的最大长度值，从多个长度值中确定最小值，得到该DOM树结构的最小长度值。除此之外，网站服务器还可以确定DOM树结构包括的所有节点的数量。上述确定的DOM树结构的总长度值、平均长度值、最大长度值、最小长度值以及DOM树结构的节点的数量即可以作为DOM树结构的多个参数值。当然，在一种可能的实现方式中，该DOM树结构的多个参数值可以包括DOM树结构的总长度值、平均长度值、最大长度值、最小长度值以及DOM树结构的节点的数量中的部分。例如，该DOM树结构的多个参数值可以只包括DOM树结构的总长度值、平均长度值、最大长度值和最小长度值。或者，该DOM树结构的多个参数值还可以包括除上述参数之外的其他的可以用于表征网页结构的参数值。本申请实施例对此不做具体限定。
对于第一网页结构中包括的其他类型的树结构，如JavaScript结构和CSS样式结构，均可以参照上述确定DOM树结构的多个参数值的方法来确定相应类型的树结构的多个参数值。
另外，对于第二网页结构中包括的每种类型的树结构，则可以参照前述介绍的确定第一网页结构包括的每种类型的树结构的多个参数值的方法，来确定第二网页结构包括的每种类型的树结构的多个参数值，本申请实施例在此不再赘述。
需要说明的是，在本申请实施例中，由于要通过比较第一网页结构和第二网页结构来判断目标网页的网页结构是否已发生变化，因此，获取的第一网页结构的每种类型的树结构的多个参数值和第二网页结构中相应类型的树结构的多个参数值应当包括相同参数的参数值。例如，如果获取的第一网页结构中DOM树结构的多个参数值包括DOM树结构的总长度值、平均长度值以及DOM树结构的节点的数量，则获取的第二网页结构中DOM树结构的多个参数值应当也包括DOM树结构的总长度值、平均长度值以及DOM树结构的节点的数量中的至少两种。
(2)基于第一网页结构中每种类型的树结构的多个参数值和第二网页结构中每种类型的树结构的多个参数值，确定每种类型的树结构对应的多个目标参数的参数值。
在确定第一网页结构中每种类型的树结构的多个参数值以及第二网页结构中每种类型的树结构的多个参数值之后，网站服务器可以将第一网页结构中每种类型的树结构的多个参数值与第二网页结构中相应类型的树结构的多个参数值进行比较，从而得到相应类型树结构对应的多个目标参数的参数值。其中，多个目标参数可以包括总长度变化率、平均长度变化率、最大长度变化率、最小长度变化率以及结构重合度中的至少两个。
接下来仍以DOM树结构为例来进行解释说明，网站服务器可以将第一网页结构中DOM树结构的多个参数值中的每个参数值和第二网页结构中DOM树结构的相应参数值进行比较，从而得到二者对应的目标参数的参数值。示例性的，若第一网页结构中DOM树结构的多个参数值和第二网页结构中DOM树结构的多个参数值中均包括总长度值、平均长度值、最大长度值、最小长度值和节点的数量，则网站服务器可以根据第一网页结构中DOM树结构的总长度值和第二网页结构中DOM树结构的总长度值， 通过下述公式(1)确定DOM树结构的总长度变化率，根据第一网页结构中DOM树结构的平均长度值和第二网页结构中DOM树结构的平均长度值，通过下述公式(2)确定DOM树结构的平均长度变化率，根据第一网页结构中DOM树结构的最大长度值和第二网页结构中DOM树结构的最大长度值，通过下述公式(3)确定DOM树结构的最大长度变化率，根据第一网页结构中DOM树结构的最小长度值和第二网页结构中DOM树结构的最小长度值，通过下述公式(4)确定DOM树结构的最小长度变化率，根据第一网页结构中DOM树结构的节点的数量和第二网页结构中DOM树结构的节点的数量，通过下述公式(5)确定DOM树结构的结构重合度。
Figure PCTCN2019106297-appb-000001
其中，δ sum为DOM树结构的总长度变化率，L sum2为第二网页结构中DOM树结构的总长度值，L sum1为第一网页结构中DOM树结构的总长度值。
Figure PCTCN2019106297-appb-000002
其中，δ avg为DOM树结构的平均长度变化率，L avg2为第二网页结构中DOM树结构的平均长度值，L avg1为第一网页结构中DOM树结构的平均长度值。
Figure PCTCN2019106297-appb-000003
其中，δ max为DOM树结构的最大长度变化率，L max2为第二网页结构中DOM树结构的最大长度值，L max1为第一网页结构中DOM树结构的最大长度值。
Figure PCTCN2019106297-appb-000004
其中，δ min为DOM树结构的最小长度变化率，L min2为第二网页结构中DOM树结构的最小长度值，L min1为第一网页结构中DOM树结构的最小长度值。
Figure PCTCN2019106297-appb-000005
其中，为DOM树结构的结构重合度，为第二网页结构中DOM树结构的节点的数量，为第一网页结构中DOM树结构的节点的数量。
需要说明的是，上述仅仅是本申请实施例给出的一种示例，在一种可能的实现方式中，第一网页结构中DOM树结构的多个参数值和第二网页结构中DOM树结构的多个参数值可能包括总长度值、平均长度值、最大长度值、最小长度值和节点的数量中的部分，在这种情况下，网站服务器基于第一网页结构中DOM树结构的多个参数值和第二网页结构中DOM树结构的多个参数值确定的多个目标参数也相应地包括总长度变化率、平均长度变化率、最大长度变化率、最小长度变化率以及结构重合度的部分。当然，第一网页结构中DOM树结构的多个参数值和第二网页结构中DOM树结构的多个参数值也可以包括除上述几个参数值之外的其他参数值，在这种情况下，目标参数也可以包括除上述几个目标参数之外的其他参数，本申请实施例对此不做具体限定。
上述主要是以DOM树结构为例来说明确定DOM树结构对应的多个目标参数的参数值的实现方式，对于第一网页结构和第二网页结构中包括的其他类型的树结构，则 可以参照上述方式来确定其他类型的树结构对应的目标参数的参数值，本申请实施例在此不再赘述。
(3)基于每种类型的树结构对应的多个目标参数的参数值，判断目标网页的网页结构是否已发生变化。
在确定每种类型的树结构对应的多个目标参数的参数值之后，网站服务器可以基于每种类型的树结构对应的多个目标参数的参数值，来判断目标网页的网页结构是否已发生变化。
示例性的，网站服务器可以将每种类型的树结构对应的多个目标参数的参数值作为神经网络模型的输入，并获取神经网络模型输出的网络结构变化状态值，该神经网络模型是通过多个样本集训练得到，多个样本集中的每个样本集包含有每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值；若神经网络模型输出的网络结构变化状态值大于第一阈值，则确定目标网页的网页结构已发生变化。
其中，该神经网络模型可以为如图5所示的全连接神经网络模型，且该神经网络模型的输出层可以使用sigmoid神经元。在使用该神经网络模型之前，网站服务器可以根据多个样本集对该神经网络模型进行训练。其中，该多个样本集中的每个样本集中包含有多种类型的树结构中每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值。在训练该神经网络模型时，网站服务器可以将第一个样本集包含的多个目标参数的一组参数值作为该神经网络模型的输入，并获取对应的输出结果，比较该输出结果与第一个样本集中包括的网络结构变化状态值之间的偏差，并通过该偏差利用反向传播算法来更新该神经网络模型中的权重和偏移。之后，将第二个样本集包含的多个目标参数的一组参数值作为该神经网络模型的输入，重复上述步骤，直到该神经网络模型的输出结果与该输出结果对应的样本集中的网络结构变化状态值之间的偏差小于预设值为止，则认为该神经网络模型已训练好。其中，该预设值可以根据要求的该神经网络模型的精度来设置。
在该神经网络模型训练好之后，当网站服务器获取到每种类型的树结构对应的多个目标参数的参数值时，可以将每种类型的树结构对应的多个目标参数的参数值作为该神经网络模型的输入值，并获取该神经网络模型输出的网络结构变化状态值，由于该神经网络模型的输出层采用sigmoid神经元，因此，该网络结构变化状态值将位于0-1之间。网站服务器可以判断该网络结构变化状态值是否大于第一阈值，若大于第一阈值，则可以确定该目标网页的网页结构已发生变化，若不大于第一阈值，则认为该目标网页的网页结构未发生变化。
需要说明的是，第一阈值可以根据该神经网络模型的训练过程中的多个样本集中的网络结构变化状态值来设置的一个值，例如，第一阈值可以为0.5。
另外，在本申请实施例中，在根据该神经网络模型输出的网页结构变化状态值判断网页结构是否已发生变化之后，网站服务器还可以根据该网页结构变化状态值对前述的第一阈值进行调整。例如，若该网页结构变化状态值大于0.5，此时，则可以将该网页结构变化状态值结合该神经网络模型之前输出的用于表征该网页的网页结构已发生变化的网页结构变化状态值来对该第一阈值进行调整。若该网页结构变化状态值不 大于0.5，此时，则可以将该网页结构变化状态值结合该神经网络模型之前输出的用于表征该网页的网页结构未发生变化的网页结构变化状态值来对该第一阈值进行调整。
上述步骤301和步骤302介绍了网站服务器在接收到用户终端发送的目标URL之后，直接检测该目标URL的网页结构是否已发生变化的过程，可选地，在本申请实施例中，当接收到目标URL之后，网站服务器也可以首先检测该目标URL对应的目标网页的网页内容是否已发生变化，若该目标网页的网页内容已发生变化，再检测该目标网页的网页结构是否已发生变化。也即，在步骤302之前，网站服务器还可以执行检测该目标URL对应的目标网页的网页内容是否已发生变化的步骤，并在检测到该目标网页的网页内容已发生变化时，再执行步骤302。这样，由于网页结构发生变化的网页，其网页内容均会发生变化，且检测网页内容是否发生变化的计算量相较于检测网页结构是否发生变化的计算量较小，因此，在对目标网页的网页内容进行检测之后，对于网页内容未发生变化的网页则不必再进行网页结构的检测，降低了对网站服务器资源的占用。
示例性的，在本申请实施例中，在检测目标网页的网页内容是否已发生变化时，网站服务器可以根据目标URL获取目标网页的网页信息，并根据获取的目标网页的网页信息确定当前时刻该目标网页的网页内容的哈希值。与此同时，网站服务器可以获取存储的当前时刻之前的该目标网页的网页内容的哈希值，并将当前时刻该目标网页的网页内容的哈希值与当前时刻之前的该目标网页的网页内容的哈希值进行比较，若二者不相同，则说明该目标网页的网页内容已发生变化，否则，则可以确定该目标网页的网页内容并未发生变化。
可选地，在某些情况下，用户终端发送的目标URL对应的目标网页可能是新增的网页，且在该目标网页新增之后，还未进行过漏洞检测。在这种情况下，网站服务器可以不必再检测该目标网页的网页内容以及网页结构是否发生变化，而是直接触发对目标网站进行漏洞检测。也即，在本申请实施例中，在检测目标网页的网页内容是否发生变化之前，网站服务器可以先检测该目标URL对应的目标网页是否为新增网页。或者，若网站服务器不执行检测目标网页的网页内容是否发生变化的步骤，则网站服务器可以在检测目标网页的网页结构是否发生变化之前，检测该目标网页是否为新增网页。
其中，网站服务器可以通过检测接收到的目标URL是否存在于URL数据库中来检测该目标URL对应的目标网页是否为新增网页，若该目标URL存在于URL数据库中，则可以确定该目标网页不为新增网页，此时，网站服务器可以执行检测该目标网页的网页内容是否已发生变化的步骤，或者，网站服务器可以直接执行检测该目标网页的网页结构是否已发生变化的步骤。若该目标URL不存在于URL数据库中，则可以确定该目标网页为新增网页，此时，网站服务器可以直接触发对目标网站进行漏洞检测。
需要说明的是，对于目标网站中的新增网页，由于在用户终端对该新增网页进行访问时才可能因该新增网页可能存在的漏洞对该目标网站造成威胁，因此，网站服务器可以在确定接收到的目标URL为首次接收到的URL时，将该目标URL对应的目标网页确认为新增网页，进而触发漏洞检测，以此来保证在用户终端对该新增网页进行 访问之前及时触发目标网站的漏洞检测，降低目标网站的安全风险。换句话说，在本申请实施例中，URL数据库中包括的URL可以是当前时刻之前所有用户终端访问过的URL，这样，网站服务器可以将接收到目标URL与URL数据库中的URL进行比对，以此来确定该目标URL是否为初次接收到的URL。
步骤303：若检测到目标URL对应的目标网页的网页结构已发生变化，则触发对目标网页所属的目标网站进行漏洞检测。
若网站服务器检测到目标URL对应的目标网页的网页结构已发生变化，则说明该目标网页被更改过，此时，网站服务器即可以触发对该目标网站进行漏洞检测，以避免该目标网页中可能存在的漏洞对目标网站的安全造成威胁。
在本申请实施例中，网站服务器在接收到用户终端发送的目标URL时，可以检测该目标URL对应的目标网页的网页结构是否已发生变化，并在检测到目标网页的网页结构已发生变化时触发对目标网站进行漏洞检测，这样，若目标网站中的目标网页的网页结构发生变化，则在接收到用户终端发送的目标URL时即可以及时发现该变化，并及时触发漏洞检测操作，从而有效降低了由于未能及时触发漏洞检测所带来的安全风险。另外，在本申请实施例中，对于网站中新增网页的场景，本申请实施例通过检测目标URL是否存在于URL数据库或者通过直接检测目标URL的网页内容或网页结构是否发生变化，均可以及时触发对目标网站的漏洞检测，从而有效降低由于新增网页所带来的安全风险。对于网站中网页更新的场景，本申请实施例通过在接收到目标URL之后对目标URL对应的目标网页进行网页结构的检测，也可以在用户终端获取到该目标网页的网页信息之前及时触发漏洞检测，从而有效降低了由于网页更新所带来的安全风险。
还需要说明的是，相关技术中网站服务器按周期每次需要对网站中所有网页的网页结构进行检测，才能确定是否触发漏洞检测，在这种情况下，对于某些包括数千网页的大型网站来说，通过相关技术中的方法来触发漏洞检测时，检测网页结构的变化将花费大量的时间。而在本申请实施例中，网站服务器通过检测接收到的一个URL对应的网页的网页结构就可以来决定是否触发漏洞检测，耗费时间短，保证了触发的及时性。
接下来对本申请实施例提供的触发漏洞检测的装置进行介绍。
参见图6，本申请实施例提供了一种触发漏洞检测的装置，该装置包括：
接收模块601，用于执行上述实施例中的步骤301；
第一检测模块602，用于执行上述实施例中的步骤302；
第一触发模块603，用于执行上述实施例中的步骤303。
可选地，第一检测模块602包括：
第一获取单元，用于获取目标网页的第一网页结构，第一网页结构是指存储的在当前时刻之前的目标网页的网页结构，且第一网页结构包括至少一种类型的树结构；
第二获取单元，用于对目标网页进行渲染，并获取目标网页在当前时刻的第二网页结构，第二网页结构包括有与第一网页结构包括的树结构相同类型的树结构；
判断单元，用于基于第一网页结构和第二网页结构，判断目标网页的网页结构是 否已发生变化。
可选地，判断单元具体用于：
第一确定子单元，用于对于第一网页结构和第二网页结构中的每个网页结构，确定每个网页结构中每种类型的树结构的多个参数值；
第二确定子单元，用于基于第一网页结构中每种类型的树结构的多个参数值和第二网页结构中每种类型的树结构的多个参数值，确定每种类型的树结构对应的多个目标参数的参数值；
判断子单元，用于基于每种类型的树结构对应的多个目标参数的参数值，判断目标网页的网页结构是否已发生变化。
可选地，第一确定子单元具体用于：
确定每个网页结构中每种类型的树结构中的根节点与每个叶子节点之间的长度值，得到相应网页结构中相应类型的树结构的多个长度值；
基于每个网页结构中每种类型的树结构的多个长度值确定相应网页结构中相应类型的树结构的总长度值、平均长度值、最大长度值和最小长度值；
获取每个网页结构中每种类型的树结构的节点的数量，并将每个网页结构中每种类型的树结构的节点的数量、总长度值、平均长度值、最大长度值和最小长度值作为相应网页结构中相应类型的树结构的多个参数值。
可选地，判断子单元具体用于：
将每种类型的树结构对应的多个目标参数的参数值作为神经网络模型的输入，并获取神经网络模型输出的网络结构变化状态值，神经网络模型是通过多个样本集训练得到，多个样本集中的每个样本集包含有每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值；
若神经网络模型输出的网络结构变化状态值大于第一阈值，则确定目标网页的网页结构已发生变化。
可选地，该装置还包括：
第二检测模块，用于检测目标网页的网页内容是否已发生变化；
第二触发模块，用于若目标网页的网页内容已发生变化，则触发第一检测模块检测目标URL对应的目标网页的网页结构是否已发生变化。
可选地，第二检测模块具体用于：
确定当前时刻的目标网页的网页内容的哈希值；
获取存储的当前时刻之前的目标网页的网页内容的哈希值；
若当前时刻的目标网页的网页内容的哈希值与当前时刻之前的目标网页的网页内容的哈希值不同，则确定目标网页的网页内容已发生变化。
可选地，该装置还包括：
第三检测模块，用于检测目标URL是否存在于URL数据库中，URL数据库中存储有当前时刻之前接收到的目标网站的所有URL；
第三触发模块，用于若目标URL存在于URL数据库中，则触发第一检测模块检测目标URL对应的目标网页的网页结构是否已发生变化。
可选地，该装置还用于：
若目标URL不存在于URL数据库中，则触发对目标网站进行漏洞检测。
综上所述，在本申请实施例中，在接收到用户终端发送的目标URL时，可以检测该目标URL对应的目标网页的网页结构是否已发生变化，并在检测到目标网页的网页结构已发生变化时触发对目标网站进行漏洞检测，这样，若目标网站中的目标网页的网页结构发生变化，则在接收到用户终端发送的目标URL时即可以及时发现该变化，并及时触发漏洞检测操作，从而有效降低了由于未能及时触发漏洞检测所带来的安全风险。另外，在本申请实施例中，对于网站中新增网页的场景，本申请实施例通过检测目标URL是否存在于URL数据库或者通过直接检测目标URL的网页内容或网页结构是否发生变化，均可以及时触发对目标网站的漏洞检测，从而有效降低由于新增网页所带来的安全风险。对于网站中网页更新的场景，本申请实施例通过在接收到目标URL之后对目标URL对应的目标网页进行网页结构的检测，也可以在用户终端获取到该目标网页的网页信息之前及时触发漏洞检测，从而有效降低了由于网页更新所带来的安全风险。
需要说明的是：上述实施例提供的触发漏洞检测的装置在触发漏洞检测时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的触发漏洞检测的装置与触发漏洞检测的方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意结合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如：同轴电缆、光纤、数据用户线(Digital Subscriber Line，DSL))或无线(例如：红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如：软盘、硬盘、磁带)、光介质(例如：数字通用光盘(Digital Versatile Disc，DVD))、或者半导体介质(例如：固态硬盘(Solid State Disk，SSD))等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述为本申请提供的实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (18)

  1. 一种触发漏洞检测的方法，其特征在于，所述方法包括：
    接收用户终端发送的用于访问目标网页的目标统一资源定位符URL；
    检测所述目标URL对应的目标网页的网页结构是否已发生变化；
    若检测到所述目标URL对应的目标网页的网页结构已发生变化，则触发对所述目标网页所属的目标网站进行漏洞检测。
  2. 如权利要求1所述的方法，其特征在于，所述检测所述目标URL对应的目标网页的网页结构是否发生变化，包括：
    获取所述目标网页的第一网页结构，所述第一网页结构是指存储的在当前时刻之前的所述目标网页的网页结构，且所述第一网页结构包括至少一种类型的树结构；
    对所述目标网页进行渲染，并获取所述目标网页在当前时刻的第二网页结构，所述第二网页结构包括有与所述第一网页结构包括的树结构相同类型的树结构；
    基于所述第一网页结构和所述第二网页结构，判断所述目标网页的网页结构是否已发生变化。
  3. 如权利要求2所述的方法，其特征在于，所述基于所述第一网页结构和所述第二网页结构，判断所述目标网页的网页结构是否已发生变化，包括：
    对于所述第一网页结构和所述第二网页结构中的每个网页结构，确定每个网页结构中每种类型的树结构的多个参数值；
    基于所述第一网页结构中每种类型的树结构的多个参数值和所述第二网页结构中每种类型的树结构的多个参数值，确定每种类型的树结构对应的多个目标参数的参数值；
    基于所述每种类型的树结构对应的多个目标参数的参数值，判断所述目标网页的网页结构是否已发生变化。
  4. 如权利要求3所述的方法，其特征在于，所述确定每个网页结构中每种类型的树结构的多个参数值，包括：
    确定每个网页结构中每种类型的树结构中的根节点与每个叶子节点之间的长度值，得到所述相应网页结构中相应类型的树结构的多个长度值；
    基于所述每个网页结构中每种类型的树结构的多个长度值确定所述相应网页结构中相应类型的树结构的总长度值、平均长度值、最大长度值和最小长度值；
    获取所述每个网页结构中每种类型的树结构的节点的数量，并将所述每个网页结构中每种类型的树结构的节点的数量、总长度值、平均长度值、最大长度值和最小长度值作为所述相应网页结构中相应类型的树结构的多个参数值。
  5. 如权利要求3或4所述的方法，其特征在于，所述基于所述每种类型的树结构对应的多个目标参数的参数值，判断所述目标网页的网页结构是否已发生变化，包括：
    将所述每种类型的树结构对应的多个目标参数的参数值作为神经网络模型的输入， 并获取所述神经网络模型输出的网络结构变化状态值，所述神经网络模型是通过多个样本集训练得到，所述多个样本集中的每个样本集包含有所述每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值；
    若所述神经网络模型输出的网络结构变化状态值大于第一阈值，则确定所述目标网页的网页结构已发生变化。
  6. 如权利要求1-5任一所述的方法，其特征在于，所述检测所述目标URL对应的目标网页的网页结构是否已发生变化之前，还包括：
    检测所述目标网页的网页内容是否已发生变化；
    若所述目标网页的网页内容已发生变化，则执行检测所述目标URL对应的目标网页的网页结构是否已发生变化的步骤。
  7. 如权利要求6所述的方法，其特征在于，所述检测所述目标网页的网页内容是否已发生变化，包括：
    确定当前时刻的所述目标网页的网页内容的哈希值；
    获取存储的当前时刻之前的所述目标网页的网页内容的哈希值；
    若当前时刻的所述目标网页的网页内容的哈希值与当前时刻之前的所述目标网页的网页内容的哈希值不同，则确定所述目标网页的网页内容已发生变化。
  8. 如权利要求1-5任一所述的方法，其特征在于，所述检测所述目标URL对应的目标网页的网页结构是否已发生变化之前，还包括：
    检测所述目标URL是否存在于URL数据库中，所述URL数据库中存储有当前时刻之前接收到的所述目标网站的所有URL；
    若所述目标URL存在于所述URL数据库中，则执行所述检测所述目标URL对应的目标网页的网页结构是否已发生变化的步骤。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    若所述目标URL不存在于所述URL数据库中，则触发对所述目标网站进行漏洞检测。
  10. 一种触发漏洞检测的装置，其特征在于，所述装置包括：
    接收模块，用于接收用户终端发送的用于访问目标网页的目标统一资源定位符URL；
    第一检测模块，用于检测所述目标URL对应的目标网页的网页结构是否已发生变化；
    第一触发模块，用于若检测到所述目标URL对应的目标网页的网页结构已发生变化，则触发对所述目标网页所属的目标网站进行漏洞检测。
  11. 如权利要求10所述的装置，其特征在于，所述第一检测模块包括：
    第一获取单元，用于获取所述目标网页的第一网页结构，所述第一网页结构是指存储的在当前时刻之前的所述目标网页的网页结构，且所述第一网页结构包括至少一种类型的树结构；
    第二获取单元，用于对所述目标网页进行渲染，并获取所述目标网页在当前时刻的第二网页结构，所述第二网页结构包括有与所述第一网页结构包括的树结构相同类型的树结构；
    判断单元，用于基于所述第一网页结构和所述第二网页结构，判断所述目标网页的网页结构是否已发生变化。
  12. 如权利要求11所述的装置，其特征在于，所述判断单元具体用于：
    第一确定子单元，用于对于所述第一网页结构和所述第二网页结构中的每个网页结构，确定每个网页结构中每种类型的树结构的多个参数值；
    第二确定子单元，用于基于所述第一网页结构中每种类型的树结构的多个参数值和所述第二网页结构中每种类型的树结构的多个参数值，确定每种类型的树结构对应的多个目标参数的参数值；
    判断子单元，用于基于所述每种类型的树结构对应的多个目标参数的参数值，判断所述目标网页的网页结构是否已发生变化。
  13. 如权利要求12所述的装置，其特征在于，所述第一确定子单元具体用于：
    确定每个网页结构中每种类型的树结构中的根节点与每个叶子节点之间的长度值，得到所述相应网页结构中相应类型的树结构的多个长度值；
    基于所述每个网页结构中每种类型的树结构的多个长度值确定所述相应网页结构中相应类型的树结构的总长度值、平均长度值、最大长度值和最小长度值；
    获取所述每个网页结构中每种类型的树结构的节点的数量，并将所述每个网页结构中每种类型的树结构的节点的数量、总长度值、平均长度值、最大长度值和最小长度值作为所述相应网页结构中相应类型的树结构的多个参数值。
  14. 如权利要求12或13所述的装置，其特征在于，所述判断子单元具体用于：
    将所述每种类型的树结构对应的多个目标参数的参数值作为神经网络模型的输入，并获取所述神经网络模型输出的网络结构变化状态值，所述神经网络模型是通过多个样本集训练得到，所述多个样本集中的每个样本集包含有所述每种类型的树结构对应的多个目标参数的一组参数值和相应样本集对应的网络结构变化状态值；
    若所述神经网络模型输出的网络结构变化状态值大于第一阈值，则确定所述目标网页的网页结构已发生变化。
  15. 如权利要求10-14任一所述的装置，其特征在于，所述装置还包括：
    第二检测模块，用于检测所述目标网页的网页内容是否已发生变化；
    第二触发模块，用于若所述目标网页的网页内容已发生变化，则触发所述第一检测模块检测所述目标URL对应的目标网页的网页结构是否已发生变化。
  16. 如权利要求15所述的装置，其特征在于，所述第二检测模块具体用于：
    确定当前时刻的所述目标网页的网页内容的哈希值；
    获取存储的当前时刻之前的所述目标网页的网页内容的哈希值；
    若当前时刻的所述目标网页的网页内容的哈希值与当前时刻之前的所述目标网页的网页内容的哈希值不同，则确定所述目标网页的网页内容已发生变化。
  17. 如权利要求10-14任一所述的装置，其特征在于，所述装置还包括：
    第三检测模块，用于检测所述目标URL是否存在于URL数据库中，所述URL数据库中存储有当前时刻之前接收到的所述目标网站的所有URL；
    第三触发模块，用于若所述目标URL存在于所述URL数据库中，则触发所述第一检测模块检测所述目标URL对应的目标网页的网页结构是否已发生变化。
  18. 如权利要求17所述的装置，其特征在于，所述装置还用于：
    若所述目标URL不存在于所述URL数据库中，则触发对所述目标网站进行漏洞检测。
PCT/CN2019/106297 2018-09-18 2019-09-18 触发漏洞检测的方法及装置 WO2020057523A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811088927.XA CN109450844B (zh) 2018-09-18 2018-09-18 触发漏洞检测的方法及装置
CN201811088927.X 2018-09-18

Publications (1)

Publication Number Publication Date
WO2020057523A1 true WO2020057523A1 (zh) 2020-03-26

Family

ID=65530593

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/106297 WO2020057523A1 (zh) 2018-09-18 2019-09-18 触发漏洞检测的方法及装置

Country Status (2)

Country Link
CN (1) CN109450844B (zh)
WO (1) WO2020057523A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109450844B (zh) * 2018-09-18 2022-05-10 华为云计算技术有限公司 触发漏洞检测的方法及装置
CN110046295A (zh) * 2019-03-12 2019-07-23 重庆金融资产交易所有限责任公司 网页结构变更检测方法、装置及计算机可读存储介质
CN111782991A (zh) * 2020-07-15 2020-10-16 浙江军盾信息科技有限公司 一种网站异常暗链的检测方法、装置、设备及存储介质
CN112613756B (zh) * 2020-12-25 2024-04-02 北京知因智慧科技有限公司 一种异常企业的检测方法、检测装置及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080244715A1 (en) * 2007-03-27 2008-10-02 Tim Pedone Method and apparatus for detecting and reporting phishing attempts
CN101471818A (zh) * 2007-12-24 2009-07-01 北京启明星辰信息技术股份有限公司 一种恶意注入脚本网页检测方法和系统
CN101534306A (zh) * 2009-04-14 2009-09-16 深圳市腾讯计算机系统有限公司 一种钓鱼网站的检测方法及装置
CN104301304A (zh) * 2014-09-16 2015-01-21 赛尔网络有限公司 基于大型isp互联口的漏洞检测系统及其方法
CN109450844A (zh) * 2018-09-18 2019-03-08 华为技术有限公司 触发漏洞检测的方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102457500B (zh) * 2010-10-22 2015-01-07 北京神州绿盟信息安全科技股份有限公司 一种网站扫描设备和方法
CN103095681B (zh) * 2012-12-03 2016-08-03 微梦创科网络科技（中国）有限公司 一种检测漏洞的方法及装置
US9305169B2 (en) * 2012-12-18 2016-04-05 Tinfoil Security, Inc. System and methods for scalably identifying and characterizing structural differences between document object models
CN104956362B (zh) * 2013-01-29 2017-10-24 慧与发展有限责任合伙企业 分析web应用程序的结构
CN104636664B (zh) * 2013-11-08 2018-04-27 腾讯科技（深圳）有限公司 基于文档对象模型的跨站脚本攻击漏洞检测方法及装置
CN107204956B (zh) * 2016-03-16 2020-06-23 腾讯科技（深圳）有限公司 网站识别方法及装置
CN107085686A (zh) * 2017-03-24 2017-08-22 深圳市九州安域科技有限公司 一种交互xss漏洞的检测方法及其系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080244715A1 (en) * 2007-03-27 2008-10-02 Tim Pedone Method and apparatus for detecting and reporting phishing attempts
CN101471818A (zh) * 2007-12-24 2009-07-01 北京启明星辰信息技术股份有限公司 一种恶意注入脚本网页检测方法和系统
CN101534306A (zh) * 2009-04-14 2009-09-16 深圳市腾讯计算机系统有限公司 一种钓鱼网站的检测方法及装置
CN104301304A (zh) * 2014-09-16 2015-01-21 赛尔网络有限公司 基于大型isp互联口的漏洞检测系统及其方法
CN109450844A (zh) * 2018-09-18 2019-03-08 华为技术有限公司 触发漏洞检测的方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZHANG, CHEN ET AL.: "DOM SQL (SQL Injection Vulnerability Detection Based on Webpage DOM Tree Comparison", COMPUTER ENGINEERING, vol. 38, no. 18, 30 September 2012 (2012-09-30), pages 111 - 115, XP055686683, ISSN: 1000-3428 *

Also Published As

Publication number Publication date
CN109450844A (zh) 2019-03-08
CN109450844B (zh) 2022-05-10

Similar Documents

Publication Publication Date Title
WO2020057523A1 (zh) 触发漏洞检测的方法及装置
WO2017107570A1 (zh) 一种基于HTML5应用缓存的移动Web缓存优化方法
US9147067B2 (en) Security method and apparatus
US10097654B2 (en) Identifying users of client devices for tracking user interactions with content distributed by content provider systems
US11093480B2 (en) Aggregation analysis and remediation of data invalidations
EP3821344B1 (en) Use of cache for content validation and error remediation
US20140101294A1 (en) Transit-mode-based webpage accessing method, system, and crawler route server
CN113452780B (zh) 针对客户端的访问请求处理方法、装置、设备及介质
US9948540B2 (en) Method and system for detecting proxy internet access
CN113726855B (zh) 服务聚合方法、装置、电子设备以及计算机可读存储介质
US20230026599A1 (en) Method and system for prioritizing web-resources for malicious data assessment
US11323537B1 (en) Generating early hints informational responses at an intermediary server
CN111753233B (zh) 第三方h5页面加载的方法、装置及计算机可读存储介质
US11403361B2 (en) Identifying code dependencies in web applications
CN114500368A (zh) 数据传输方法和装置及采用该装置的路由器
CN112153011A (zh) 一种机器扫描的检测方法、装置、电子设备和存储介质
CN110958160A (zh) 网站检测方法、装置、系统以及计算机可读存储介质
US11979420B2 (en) Optimizing selection and dynamic configuration of load balancing techniques to resist cyber attacks
US11689633B2 (en) Systems and methods for tracking user access across web domains
US12028434B2 (en) Generating early hints informational responses at an intermediary server
US20240007537A1 (en) System and method for a web scraping tool
US11647031B2 (en) Determining an origin server is potentially compromised
US11025593B2 (en) Template-based session control in proxy solutions
US20230140645A1 (en) Automatic detection of deserialization attacks with markov chains
US20220417266A1 (en) Systems and methods for autonomous program detection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19861543

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19861543

Country of ref document: EP

Kind code of ref document: A1