WO2020206662A1

WO2020206662A1 - Browser anti-hijacking method and device, electronic equipment and storage medium

Info

Publication number: WO2020206662A1
Application number: PCT/CN2019/082334
Authority: WO
Inventors: 赵剑萍
Original assignee: 深圳市欢太科技有限公司; Oppo广东移动通信有限公司
Priority date: 2019-04-11
Filing date: 2019-04-11
Publication date: 2020-10-15
Also published as: CN113348655A; CN113348655B

Abstract

Disclosed are a browser anti-hijacking method and device, an electronic equipment and a storage medium, relating to the technical field of the browsers. The method comprises: receiving webpage data by a browser; obtaining the volume of legal data in the webpage data as a first numerical value; obtaining the actual data volume of the webpage data as a second numerical value; if the first numerical value is different from the second numerical value, determining that a webpage corresponding to the webpage data is hijacked and performing anti-hijacking processing on the webpage to improve the security of the webpage.

Description

Browser anti-hijacking method, device, electronic equipment and storage medium

Technical field

This application relates to the technical field of browsers, and more specifically to a browser anti-hijacking method, device, electronic equipment and storage medium.

Background technique

With the development of economy and society, the number of people surfing the Internet is increasing, leading to ever-changing web pages. It is often the case that browser web pages are hijacked by operators or third-party web pages, which poses threats to users’ data security and property security. Therefore, browsing Anti-hijacking by the device is very important.

Summary of the invention

In view of the above problems, this application proposes a browser anti-hijacking method, device, electronic equipment and storage medium to improve the above problems.

In the first aspect, an embodiment of the present application provides a browser anti-hijacking method, the method includes: the browser receives webpage data; obtains the amount of legal data in the webpage data as the first value; and obtains the The actual data amount of the web page data is used as the second value; if the first value is different from the second value, it is determined that the web page corresponding to the web page data is hijacked, and the web page is subjected to anti-hijacking processing.

In a second aspect, an embodiment of the present application provides a browser anti-hijacking device. The device includes: a data receiving module for the browser to receive webpage data; a first data acquisition module for acquiring data in the webpage data The data volume of legal data is used as the first value; the second data acquisition module is used to obtain the actual data volume of the web page data as the second value; the anti-hijacking processing module is used to determine if the first value is different from the If the second value is different, it is determined that the webpage corresponding to the webpage data is hijacked, and anti-hijacking processing is performed on the webpage.

In a third aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a memory; and one or more programs. The one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the aforementioned method.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium in which program code is stored, and the program code can be invoked by a processor to execute the above-mentioned method.

The browser anti-hijacking method, device, electronic device, and storage medium provided by the embodiments of this application compare the amount of legal data in the webpage with the amount of actual data. If the two data amounts are different, it can be determined The web page is hijacked, and the anti-hijacking process is performed to improve the security of the web page.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

Fig. 1 shows a flowchart of a browser anti-hijacking method provided by an embodiment of the present application.

Fig. 2 shows a flowchart of a browser anti-hijacking method provided by another embodiment of the present application.

Fig. 3 shows a schematic diagram of a multi-frame webpage provided by an embodiment of the present application.

Fig. 4 shows a flowchart of a browser anti-hijacking method provided by another embodiment of the present application.

Figures 5 to 7 respectively output schematic flow diagrams of different anti-hijacking methods in the embodiments of the present application.

Fig. 8 shows a functional module diagram of a browser anti-hijacking device provided by an embodiment of the present application.

Fig. 9 shows a structural block diagram of an electronic device provided by an embodiment of the present application.

Fig. 10 is a storage unit for storing or carrying program code for implementing the browser anti-hijacking method according to the embodiment of the present application.

detailed description

In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

During the web browsing process of the browser, the browser may be hijacked. Hijackers such as operators, third-party web pages or hijacking software may attack the user's browser, such as tampering with the web page by changing the display mode and display content of the web page. , Or cause the browser to be redirected to a malicious webpage when visiting a normal website, and the browser homepage or search page is modified to the website address designated by the hijacker.

Generally, the hijacking of all web pages relies on the HTTPS security protocol of the web page to achieve data encryption protection. However, this security protocol is actually not secure enough, and it can also be hijacked by the server in disguise. The disguised server gives the disguised encryption key. The data decrypted by the browser is actually the hijacked data from the camouflage server. The browser cannot know that the web page is hijacked and cannot fully achieve the purpose of anti-hijacking. It simply reduces the probability of hijacking. In addition, the anti-hijacking method cannot recover the hijacked data, and can only add mistakes.

The inventor found that when visiting a normal website, it is redirected to a malicious webpage, the homepage or search page of the browser is modified to the website address specified by the hijacker, etc., the actual website visited by the browser is different from the website you want to visit, you can directly It is determined that the browser is hijacked. At this time, if the browser can obtain the web address that it wants to visit, it can obtain data from the server through the web address that it wants to visit.

As for the hijacking of webpages being tampered with, operations such as adding data, deleting data, and replacing data on the basis of the legal data of the webpage will cause the amount of data in the webpage to change, that is to say, the data of the webpage data actually received by the browser The amount of data is different from the amount of legal data on the web page. Therefore, when the amount of webpage data actually received by the browser is different from the amount of legal data of the webpage, it can be determined that the webpage is hijacked and anti-hijacking processing can be performed.

Therefore, the inventor proposes the browser anti-hijacking method, device, electronic device, and storage medium provided by the embodiments of the application. By comparing the amount of legal data in the web page with the actual amount of data, it is judged whether the web page is hijacked. Undertake anti-hijacking processing. In the following, specific embodiments will be used to describe in detail the browser anti-hijacking method, device, electronic equipment, and storage medium provided by the embodiments of the present application.

Fig. 1 shows a browser anti-hijacking method provided by an embodiment of the present application, which can be applied to a browser in an electronic device. Specifically, the method includes:

Step S110: the browser receives web page data.

The browser can initiate a web page acquisition request to the server, and receive various data information of the web page returned by the browser. The webpage obtaining request may be an encrypted request, such as a data obtaining request of the https protocol. The obtained data information may include one or more of codes, texts, pictures, etc., which is not limited in the embodiment of the present application. If the webpage is not hijacked, the webpage data received by the browser is the data returned by the server; if the webpage is hijacked, the actual webpage data received by the browser is different from the data returned by the server.

Step S120: Obtain the data amount of legal data in the webpage data as the first value.

Step S130: Obtain the actual data amount of the webpage data as the second value.

If the webpage of the browser is hijacked and the content is tampered with, the amount of legal data of the webpage is different from the amount of webpage data actually received by the browser. Therefore, the browser can obtain the data amount of legal data in the received webpage data, and define the obtained data amount as the first value; obtain the actual amount of received webpage data, which is defined as the second value.

Among them, the legal data of the webpage is the original data of the webpage, or the data of the webpage written by the programmer for the webpage, or the data that the webpage itself should have if it is not hijacked, or the server responds to the browser's webpage acquisition request The data returned. The amount of data indicates the size of the data, or the amount of data, or the number of bytes of the data, or the storage space that the data needs to occupy.

Step S140: If the first value is different from the second value, determine that the webpage corresponding to the webpage data is hijacked, and perform anti-hijacking processing on the webpage.

Compare whether the amount of legal data is the same as that of the actual received web page. If they are different, it indicates that the webpage has been tampered with, and the webpage is processed against hijacking.

In the browser anti-hijacking method provided by the embodiment of the present application, whether the amount of legal data of the webpage is the same as the amount of data actually received is judged whether the webpage is hijacked, so that the browser can accurately know whether the webpage is hijacked, And in the case of being hijacked, conduct anti-hijacking processing to improve the security of the webpage.

Another embodiment of the present application provides a browser anti-hijacking method, which includes a method for determining the amount of legal data. See Figure 2. The method includes:

Step S210: the browser receives web page data.

Step S220: Obtain the data of the recorded data amount in the web page data as stored value data.

Step S230: Parse the data amount of the webpage data from the stored value data as the data amount of the legal data in the webpage data, and use the data amount as the first value.

Step S240: Obtain the actual data amount of the webpage data as the second value.

The browser receives the web page data, and can obtain the amount of legal data in it.

Specifically, the amount of data of the webpage is written in the legal data of the webpage. That is to say, after the programmer completes the legal data of the webpage, he can write the data of the webpage into the legal data.

Among them, it may be data that specifically records the size of the data in the legal data of the webpage, such as a label, a segment of bytes, etc. In the embodiment of the application, the data that records the size of the legal data in the webpage may be defined as stored value data. Write the amount of data in the legal data of the webpage, which can be written into the stored value data. The data of the legal data in the webpage data can be obtained by analyzing the stored value data in the webpage data. the amount. For example, a tag is set as the stored value data in a webpage. After the webpage is written, the webpage has a data volume of 20M, and the programmer writes the data of 20M into the tag. Through the analysis of the tag, the legal data of the webpage can be obtained as 20M.

Therefore, after receiving the web page data, the data of the recorded data amount can be obtained, and the data amount of the legal data of the web page can be analyzed from the data. And, the amount of data can be stored for later comparison. Among them, the acquisition and analysis process can be completed by the browser kernel. For example, the browser kernel obtains stored value data from the web page data through the web page data analysis module, and parses the data amount of legal data from the stored value data, and stores it in In the data storage module of the browser.

Optionally, in this embodiment of the present application, the stored value data may be data encrypted according to a preset encryption algorithm. The browser can decrypt the stored value data according to the preset encryption algorithm, and then obtain the amount of legal data in the webpage data from the decrypted stored value data.

Wherein, the specific algorithm of the preset encryption algorithm is not limited in the embodiments of the present application, and it may be an encryption algorithm that is known to the browser but unknown to the hijacker. In other words, the specific algorithm of the preset encryption algorithm has not been publicly announced, so the hijacker does not know the encryption algorithm used by the stored value data, even if the hijacker writes it when tampering with the legal data of the webpage. The amount of changed data, such as the increased amount of data written to it, the browser analyzes the amount of data written by the hijacker through a preset encryption algorithm, and the result of the analysis should also be garbled, which will not affect the amount of legal data. Of access.

The browser then counts the actual data volume of the web page data. The specific statistical method is not limited. For example, the amount of storage space occupied by the received webpage data can be counted, and the calculation can be based on the webpage data receiving speed and receiving time.

Step S250: If the first value is different from the second value, determine that the webpage corresponding to the webpage data is hijacked, and perform anti-hijacking processing on the webpage.

Compare whether the first value and the second value are the same. If they are different, it indicates that the amount of legal data in the webpage data is different from the amount of data actually received, indicating that the webpage has been hijacked and corresponding anti-hijacking processing can be performed.

In the embodiment of the present application, the size of the legal data in the webpage is recorded by stored value data, and then the data size recorded by the handling data is compared with the actual received data size to determine whether the webpage is hijacked. If hijacked, anti-hijacking is handled.

In the embodiment of the present application, the webpage may include multiple parts, and each part has its own corresponding independent webpage data. The embodiment of the present application takes a frame webpage as an example for description. A framed web page includes multiple frames in a web page, or more than one page is displayed in the same browser window, and each page acts as a frame. Each frame is independent of other frames and has its own independent web page data. For example, you can define how to divide a window into frames through the frame structure tag, and define the web page data in each frame through the frame tag. For example, define how to divide the web page into frames through the frame structure tag frameset, and pass the corresponding frame of each frame The tag frame defines the HTML document placed in the frame. For example, FIG. 3 shows a schematic diagram of a framed webpage, where the webpage 110 includes three frames, namely a first frame 101, a second frame 102, and a third frame 103.

Another embodiment of the present application provides a browser anti-hijacking method. In this embodiment, the data volume of the legal data of each frame can be compared with the actual data volume to determine whether the frame is hijacked, so as to determine whether to perform anti-hijacking processing on the webpage or the frame. That is to say, in this embodiment, the web page data can be data information of a frame, the first value is the amount of legal data received by the frame, and the second value is the actual web page received after the frame is received. The amount of data. That is, in this embodiment, for each frame, as shown in Figure 4, the following steps are performed:

Step S310: The browser receives the webpage data of the frame.

Step S320: Obtain the data amount of the legal data in the webpage data as the first value.

Step S330: Obtain the actual data amount of the webpage data as the second value.

Step S340: If the first value is different from the second value, it is determined that the webpage corresponding to the webpage data is hijacked, and anti-hijacking processing is performed on the webpage.

For any frame, the browser can receive the web page data of the frame. When receiving the data recording the data volume of the legal data in the frame, that is to say, the stored value data in the web page data of the frame is received, the stored value data can be analyzed to obtain the data volume of the legal data in the frame, As the first value of the frame.

When the data in the frame is received, the actual data amount of the received frame's webpage data can be obtained, and the actual data amount is used as the second value of the frame.

Compare whether the first value and the second value are different. If the first value is the same as the second value, it indicates that the frame is not hijacked, and there is no need to perform anti-hijacking processing on the frame, and the frame can be processed normally, such as performing operations such as rendering and displaying. If the first value and the second value of each frame in the webpage indicate that none of the frames have been hijacked, the webpage has not been hijacked.

If the first value of a frame is different from the second value, it indicates that the data in the frame has been tampered with. It can be determined that the frame is hijacked, and at the same time, it can be determined that the web page is hijacked, and anti-hijacking processing is performed on the web page.

As an implementation manner, since each frame has its own webpage data, if it is determined that a certain frame is hijacked, the anti-hijacking processing for the webpage may be an anti-hijacking processing for the frame to reduce the amount of data processing. That is, when it is determined that the first value and the second value in the webpage data of a certain frame are different, the frame corresponding to the webpage data is subjected to anti-hijacking processing. Wherein, the anti-hijacking processing of the framework may be to reacquire the data of the framework from the server to restore the data of the framework. Specifically, as shown in Figure 5, the anti-hijacking processing of the framework may include the following steps:

Step S3411: Obtain the URL information of the frame.

Each frame has its link address, that is, has its website information, and the website information can be used to request legal data of the frame from the browser. Therefore, when it is determined that a certain frame is hijacked, that is, by comparing the amount of legal data in the web page data with the actual amount, it is determined that the frame is hijacked, and the URL information of the frame can be obtained. The specific acquisition method is not limited in the embodiment of the present application. For example, the web address information of the frame is parsed from the web page data of the frame.

Step S3421: Initiate a webpage acquisition request carrying the website information to the server, so that the server returns the framed webpage data according to the webpage acquisition request.

According to the URL information, the address of the server can be parsed to determine the server for obtaining legal data. Therefore, you can initiate a web page acquisition request to the server and also acquire the legal data of the frame. When the server receives the request for obtaining the webpage, it returns the webpage data of the frame again.

Step S3431: Obtain new webpage data of the frame from the server, and replace the webpage data of the frame.

After receiving the web page data returned by the server, the web page data is replaced with the original web page data of the frame to realize the recovery of the hijacked web page data in the frame.

Optionally, in this implementation manner, an anti-hijacking mark may be carried in the webpage acquisition request, and the anti-hijacking mark indicates that the webpage data of the browser is hijacked, and a new copy of the webpage data corresponding to the website information needs to be obtained from the server. Among them, the anti-hijacking mark can only be a mark known to the legitimate server. If an illegal server hijacks the web page acquisition request, the anti-hijacking mark cannot be correctly identified because the existence of the anti-hijacking mark cannot be correctly identified. Parse the request for the web page.

In addition, the anti-hijacking mark added in the web page acquisition request can be used by the server to add an anti-hijacking response mark to the returned web page data according to the anti-hijacking mark, so that when the browser receives the web page data, it will be based on the anti-hijacking response. The mark is determined to be the data returned by the legitimate server. Therefore, in this embodiment of the present application, when the browser receives the web page data returned by the server in response to the web page acquisition request carrying the anti-hijacking flag, it can determine whether the received web page data carries the anti-hijacking flag. If it is carried, it is determined that the web page data returned by the legitimate server can be replaced, that is, the original web page data in the frame is replaced with new web page data.

Optionally, the webpage acquisition request may be an encrypted data acquisition request, such as an https request, which may carry an anti-hijacking mark and URL information on the request header. When the server receives the request, it can find the original data of the URL information from the server-side database based on the anti-hijacking flag and URL information, that is, the legal data corresponding to the URL information, and then return it to the browser after being encrypted and compressed, and Add an anti-hijacking response flag in the response header. After the browser kernel receives the corresponding response data, it decrypts and decompresses the received encrypted compressed package according to the anti-hijacking mark and URL information to obtain the original data. The browser kernel replaces the previously hijacked data with the acquired data. , To achieve the purpose of anti-hijacking.

Optionally, in this embodiment of the application, when it is determined that a certain frame is hijacked, an anti-hijacking reminder may be performed, such as displaying a hijacking reminder label to inform the user that the current web page is hijacked. In addition, the anti-hijacking label can also specify which frame is hijacked, so that the user can know the specific hijacking situation of the frame in the webpage.

Optionally, the anti-hijacking reminder may disappear after the user responds, and it is learned that the webpage data of the frame is retrieved and replaced after it disappears.

Optionally, in this implementation manner, after the web page data of the hijacked frame is retrieved and replaced, the judgment and comparison process from step S310 to step S340 may be executed again to display the legitimate data.

Optionally, if the browser performs anti-hijacking processing on a frame for a preset number of consecutive times, all it obtains is the hijacked webpage data, indicating that the frame is more likely to be hijacked, and the request for obtaining webpage data for the frame can be suspended .

Optionally, in this implementation, when it is determined that a certain frame is hijacked, in the process of anti-hijacking the frame, it can continue to determine whether other frames are hijacked and whether anti-hijacking processing is required, thereby improving the protection against webpages. The processing speed of hijacking. Of course, after the anti-hijacking process is performed on the frame that is determined to be hijacked, the judgment on whether other frames have been hijacked can be continued.

Optionally, after determining that a framework is hijacked, the relevant hijacking information can be uploaded to the backend server, which can be used to record the hijacking situation, count which frameworks are hijacked, the probability of hijacking, etc., for subsequent tracking and optimization Provide data support. For example, optimize the framework with a high probability of being hijacked to reduce the probability of being hijacked. Wherein, the background server is a server used to perform statistics on hijacking information, and may be the same as or different from the server that obtains legal webpage data. If the hijacking information fails to be uploaded for many times, such as uploading failed three times, the hijacking information can be saved locally and re-uploaded when the network condition is detected next time.

As another implementation manner, when it is determined that a certain frame is hijacked, it indicates that the webpage is hijacked, and other frames in the webpage are more likely to be hijacked. In order to improve the data processing speed, it is no longer necessary to judge whether other frames in the web page are hijacked, and perform anti-hijacking processing on the web page. When carrying out anti-hijacking processing on a web page, anti-hijacking processing is performed on the entire web page. In other words, when it is determined that a certain frame is hijacked, the entire webpage is processed for anti-hijacking, and the webpage data of the entire webpage is obtained from the server and replaced. Specifically, as shown in Figure 6, anti-hijacking processing on a web page includes:

Step S3412: Obtain the URL information of the webpage.

Step S3422: Initiate a webpage acquisition request carrying the website address information to the server, so that the server returns all webpage data of the webpage according to the webpage acquisition request.

Step S3432: Obtain new webpage data of the webpage from the server, and replace the webpage data of the webpage.

The webpage itself corresponds to a web site information. As shown in Figure 3, the first frame 101, the second frame 102 and the third frame 103 respectively correspond to web site information. The web page 110 itself also corresponds to a web site information, which is a link to the web page 110 itself. address. Through the URL information, a server for obtaining the overall webpage data of the webpage can be found, and all data information in the webpage can be obtained from the server. The browser can obtain the website address information of the webpage, and the specific obtaining method is not limited. For example, the data stored in the website address information of the webpage is analyzed to obtain the website address information of the webpage.

Then initiate a web page acquisition request carrying the URL information to the server, so that the server that receives the web page acquisition request returns all the web page data to the browser. After the browser obtains all the web page data of the web page, it replaces all the web page data in the web page Is the newly acquired web page data. In other words, the web page data of all frames in the web page are replaced with newly acquired web page data.

Optionally, after the browser obtains and replaces all the webpage data of the webpage, in order to prevent the re-obtained webpage data from being hijacked, it can judge whether the webpage is hijacked again.

As another implementation manner, when it is determined that a certain frame is hijacked, it indicates that the web page is hijacked, and the possibility of other frames in the web page being hijacked is also higher. In order to increase the data processing speed, when anti-hijacking processing is performed on a web page, all web page data of the entire web page is obtained from the server, and the web page data of the hijacked frame in all web page data is used to replace the hijacked frame. Specifically, as shown in Figure 7, the anti-hijacking processing on the web page includes:

Step S3413: Obtain the website address information of the webpage, and continue to determine whether other frames that are not determined to be hijacked are hijacked.

Step S3423: Initiate a webpage acquisition request carrying the website address information to the server, so that the server returns all webpage data of the webpage according to the webpage acquisition request.

Step S3433: Obtain new webpage data of the webpage from the server, and replace the webpage data of the hijacked frame.

In this embodiment, when it is determined that a certain frame is hijacked, other frames are more likely to be hijacked, and all webpage data of the entire webpage can be obtained first, so as to obtain the webpage data of each frame. Moreover, the process of obtaining webpage data and the process of judging whether other frames are hijacked can be performed in parallel to increase the data processing speed.

After all the webpage data of the webpage is obtained from the server, the original webpage data of the hijacked frame is replaced with the webpage data belonging to the hijacked frame. Also, cache the web page data obtained from the server.

In the process of continuing to determine whether a frame is hijacked, if it is determined that other frames are hijacked, the web page data of the hijacked frame can be obtained from the cached web page data, and the original web page data of the hijacked frame Replace it.

Optionally, this implementation may be performed when there are other frames in the webpage that are not determined to be hijacked, and then it may happen that the frame determined to be hijacked needs to be replaced with webpage data. Specifically, when the first frame determined to be hijacked appears in the webpage, and the frame is not the last frame determined to be hijacked, the process from step S3413 to step S3433 is executed to perform anti-hijacking processing. Therefore, in this embodiment, when more than one frame is hijacked, for other hijacked frames other than the first determined to be hijacked, when performing anti-hijacking processing, you do not need to request data from the server, but directly Use locally cached web page data for replacement, which reduces the number of interactions with the server and improves data processing efficiency.

In addition, when the first frame judged to be hijacked appears in the webpage, but the frame is the last frame judged to be hijacked in the webpage, you can only obtain the webpage data of the frame and the original webpage data of the frame Replace to reduce the amount of data processing and increase the processing speed.

Optionally, in this implementation manner, after all frames are hijacked, the locally cached webpage data can be deleted to reduce the pressure of local data storage on the browser.

In the embodiments of the present application, various implementations can be referred to each other, and the same or similar parts can be applied to each other. For example, when a browser sends a webpage acquisition request carrying web site information to a server, an encrypted acquisition request can be sent; an acquisition request carrying an anti-hijacking flag can be sent for the server to return according to the anti-hijacking flag. An anti-hijacking response mark is added to the web page data; it can be judged whether the received web page data carries an anti-hijacking mark. If it is, the received web page data is considered valid, and the newly received web page data is used for the hijacked frame To replace the web page data.

In addition, in order to increase the data processing speed, in the embodiment of the present application, when web page data of a frame is received, a judgment process of whether the frame is hijacked is executed. In other words, the browser processes the data of the webpage while receiving it. When the data of a frame is received, the data volume of the legal data in the webpage data of the frame is compared with the actual data volume of the webpage data. If the two data volumes are the same, it is determined that the frame is not hijacked; if the two data volumes are different, it is determined that the frame is hijacked.

Optionally, the browser can process multiple frames in parallel to increase the processing speed. That is to say, after receiving the web page data of a frame, judge whether the frame is hijacked or not and anti-hijack processing; if the web page data of other frames are received at this time, the other received frames will also start The judgment of whether to hijack and the handling of anti-hijacking.

Optionally, the browser can perform hijacking judgment and anti-hijacking processing serially to reduce processing pressure while maximizing the processing speed. That is to say, when the browser finishes receiving the web page data of a frame, if it does not judge whether to hijack or anti-hijack other frames at this time, it will start to judge whether the frame is hijacked and anti-hijack processing; If there are other frameworks in the judgment of whether to hijack and anti-hijacking at this time, wait until the browser completes the judgment of whether the previously received frame is hijacked and the anti-hijacking process, and then judges whether the frame is hijacked And the handling of anti-hijacking.

Optionally, the browser can also perform hijacking judgment serially, and anti-hijacking processing serially. That is to say, at the same time, a frame is judged whether to hijack, and a frame is processed at the same time. When the judgment of whether the frame is hijacked is completed, the judgment of whether the next frame is hijacked is performed; when the anti-hijacking processing of the already framed frame is completed, the anti-hijacking processing of the next hijacked frame is performed.

During the web browsing of the browser, the web page may be hijacked or not hijacked. If it is necessary to judge whether each frame of a webpage is hijacked or not, it needs to be judged multiple times, while for webpages that are not hijacked, the multiple judgments are not necessary. Therefore, in the embodiment of the present application, in order to reduce meaningless judgments, it is possible to find which frame is hijacked when it is determined that the webpage is hijacked, so as to perform anti-hijacking processing on the frame.

As an implementation manner, if the first value is different from the second value in each frame, it is determined that the webpage corresponding to the webpage data is hijacked. Before performing anti-hijacking processing on the webpage, it is possible to calculate all The sum of the first values corresponding to the frames is used as the first total value, which represents the size of all legal data in the webpage; the sum of the second values corresponding to all the frames is calculated as the second total value. The total value represents the size of the total data actually received by the web page. It is understandable that when the main frame of the webpage is received, it indicates that the data of the webpage is loaded. The first total value calculated at this time includes the amount of legal data of all frames; the second total value calculated at this time includes The amount of data received by all frames in the web page.

Compare whether the first total value and the second total value are the same. If the first total value is the same as the second total value, it means that the data in the webpage has not been hijacked, and it is not necessary to hijack each frame Judgment and anti-hijacking processing; if the first total value is different from the second total value, it means that the webpage is hijacked and the data of the frame has been tampered with. At this time, the first value and the second value can be compared for each frame Whether they are the same, if the first value is different from the second value, it is determined that the frame is hijacked and an anti-hijacking process is performed.

As another implementation manner, the webpage may specifically have data recording the total legal data size of the webpage, and the data recording the legal data size of the webpage is defined as the total stored value data. When the web page is loaded, the total stored value data of the web page can be obtained, and the total legal data size in the web page from the total stored value data is used as the first total value. The size of the total data received by the webpage is determined as the second total value. Compare whether the first total value and the second total value are the same. If they are the same, it means that the webpage is not hijacked; if they are different, it means that the webpage is hijacked.

In this embodiment, by comparing the amount of legal data in each frame of the web page with the amount of data actually received, it is possible to determine whether each frame of the web page is hijacked, so as to make a corresponding response in the case of hijacking. Anti-hijacking processing. In this solution, both the discovery of hijacking and the recovery of hijacked data are realized, which greatly reduces the risk of user leakage, improves the security of the browser, and avoids user property losses.

This application also provides an embodiment. In this embodiment, the webpage may include multiple parts, such as multiple frames as exemplified in the preceding embodiments; the webpage may also have only one part, that is, all data information of the webpage is A whole.

In this embodiment, the web page data is defined as all data of the web page. Therefore, when the webpage is hijacked or not and the anti-hijacking process is performed, after receiving all the data of the webpage, the browser obtains the amount of legal data in the webpage data as the first value, which is the total amount of the webpage. The amount of legal data. The actual amount of data in the web page data is obtained as the second value, and the second value represents the total received data amount of the web page. Compare whether the first value and the second value are the same. If they are the same, it means that the webpage has not been hijacked, and subsequent normal processing such as rendering and display can be performed; if the first value is different from the second value, it is determined The webpage corresponding to the webpage data is hijacked, and the webpage is processed against hijacking.

Wherein, in this embodiment, when performing anti-hijacking processing on the webpage, anti-hijacking processing is performed on the entire webpage. In other words, it is possible to obtain the website address information of the webpage; initiate a webpage obtaining request carrying the website address information to the server for the server to return all webpage data of the webpage according to the webpage obtaining request; obtain from the server The new webpage data of the webpage replaces the webpage data of the webpage.

It is understandable that the same or similar parts of this embodiment and the previous embodiment can be referred to each other, and this embodiment may not be repeated. For example, in this embodiment, an anti-hijacking flag may be carried in a webpage acquisition request for use The server adds an anti-hijacking response mark to the returned webpage data according to the anti-hijacking mark. It can be judged whether the received webpage data carries an anti-hijacking mark; if it is, the webpage data is replaced.

In the embodiment of the present application, the webpage is taken as a whole, and the data amount of legal data in all webpage data and the actual data amount are compared to judge whether the webpage is hijacked. If it is determined that the webpage is hijacked, the webpage as a whole is used for anti-hijacking processing, thereby reducing the number of judgments and anti-hijacking processing times, and reducing the pressure of data processing.

In each embodiment of the present application, during the anti-hijacking process, if the browser cannot access the server, such as network interruption, poor network quality, etc., the server cannot be connected to the server, the server initiates a web page acquisition request to the server, or it cannot After receiving the web page data returned by the server according to the web page obtaining request, the data of the web page cannot be restored.

In addition, if the browser cannot obtain the new webpage data from the server for other reasons, for example, if the server does not find the webpage data corresponding to the URL information carried in the browser's webpage obtaining request, it can return an error message to the browser to inform The browser cannot find the corresponding web page data. At this time, the browser can determine that the web page data cannot be obtained from the server for anti-hijacking data recovery.

In the case that webpage data cannot be recovered, in order to avoid the harm caused by the continued operation of the hijacked webpage data, the execution of the hijacked webpage data can be stopped. Specifically, the execution of the webpage data can be stopped by stopping the execution of the script function corresponding to the hijacked webpage data.

Optionally, if it is determined that a certain frame is hijacked, the execution of the webpage data of the frame can be stopped, such as stopping the execution of the script function corresponding to the frame; or the execution of all webpage data of the webpage can be stopped, such as stopping the execution of the webpage Execution of script functions.

Optionally, when it is determined that a certain webpage is hijacked, the execution of all webpage data of the webpage can be stopped, such as stopping the execution of the script function of the webpage.

In addition, a webpage hijacking reminder label can be displayed to remind the user that the webpage is hijacked. Optionally, the URL information, data size, etc. of the hijacked frame can also be obtained and written into the reminder tag, and a prompt box of the reminder tag pops up on the display page of the browser to remind the user in which frame the data has been tampered with. Of course, the pop-up prompt box can also be used to remind the user that the webpage is hijacked, and it is not necessary to remind the user that the frame is hijacked. Wherein, the reminder tag may be created by a script inside the webpage.

Therefore, by hijacking the reminder tag and stopping execution of webpage data, users can be reminded and webpage data can be locked, preventing user data leakage and property loss.

An embodiment of the application also provides a browser anti-hijacking device 400. As shown in FIG. 8, the device 400 includes: a data receiving module 410, configured to receive webpage data by a browser; and a first data acquiring module 420, configured to Obtain the data volume of legal data in the webpage data as the first value; the second data acquisition module 430 is used to obtain the actual data volume of the webpage data as the second value; the anti-hijacking processing module 440 is used for If the first value is different from the second value, it is determined that the webpage corresponding to the webpage data is hijacked, and anti-hijacking processing is performed on the webpage.

Optionally, the first data acquisition module 420 may be used to acquire data of the amount of recorded data in the webpage data as stored value data; and parse the data amount of the webpage data from the stored value data as the webpage The amount of legal data in the data.

Optionally, the stored value data is data encrypted according to a preset encryption algorithm, and the first data acquisition module 420 may decrypt the stored value data according to the preset encryption algorithm.

Optionally, the web page may include multiple frames. The device may also include a comparison module for calculating the sum of the first numerical values corresponding to all frames as the first total value; calculating the sum of the second numerical values corresponding to all frames as the second total value; comparing the first total Whether the value is the same as the second total value. In the case that the comparison result is different, each frame is processed by the data receiving module 410, the first data acquiring module 420, the second data acquiring module 430, and the anti-hijacking processing module 440.

Optionally, the anti-hijacking processing module 440 may be used to perform anti-hijacking processing on the frame corresponding to the webpage data; or for performing anti-hijacking processing on the entire webpage.

Optionally, the anti-hijacking processing module 440 performing anti-hijacking processing on the frame corresponding to the webpage data may include: obtaining the website address information of the frame corresponding to the webpage data; and initiating a webpage obtaining request carrying the website address information to the server, to The server is used for returning the webpage data of the frame according to the webpage obtaining request; obtaining new webpage data of the frame from the server and replacing the webpage data of the frame.

Optionally, the anti-hijacking processing module 440 performing anti-hijacking processing on the webpage as a whole may include: obtaining the website address information of the webpage; and initiating a webpage obtaining request carrying the website address information to the server for the server according to the webpage The obtaining request returns all the webpage data of the webpage; obtaining new webpage data of the webpage from the server, and replacing the webpage data of the webpage.

Optionally, the anti-hijacking processing module 440 may be configured to carry an anti-hijacking mark in the web page acquisition request, so that the server adds an anti-hijacking response mark to the returned web page data according to the anti-hijacking mark. The anti-hijacking processing module 440 can also be used to determine whether the received web page data carries an anti-hijacking mark; if it does, replace the web page data.

Optionally, when the anti-hijacking processing module 440 performs anti-hijacking processing on the frame corresponding to the web page data, it can also be used to stop the frame corresponding to the frame if the server cannot be accessed or the new web page data cannot be obtained from the server. Execution of script functions.

Optionally, the anti-hijacking processing module 440 performs anti-hijacking processing on the webpage, if the server cannot be accessed, or the new webpage data cannot be obtained from the server, stopping the execution of all webpage data of the webpage.

Optionally, the anti-hijacking processing module 440 may also be used to display a web page hijacking reminder label.

In the embodiment of this application, the webpage data itself can be detected and monitored, the monitored hijacked page can be fed back and reported, and the hijacked page can be anti-hijacked, and the normal page can be restored. The webpage can be protected on the basis of https data The data itself has been double-layered for security detection, which greatly improves the security of web page data. After the web page is hijacked, the web page itself detects and warns the user, and tries to perform anti-hijacking operations to restore the normal page, which greatly reduces the risk of user leakage, improves the security of the browser, and avoids user property losses , And reduce other behaviors that harm the interests of users.

Those skilled in the art can clearly understand that, for convenience and brevity of description, the various method embodiments described above may refer to each other; each method embodiment may also refer to each other in each method embodiment. For the specific working process of the above described device and module, reference may be made to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, the coupling between the modules may be electrical, mechanical or other forms of coupling.

In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.

Please refer to FIG. 9, which shows a structural block diagram of an electronic device 500 provided by an embodiment of the present application. The electronic device 500 may be an electronic device capable of running application programs such as a smart phone, a tablet computer, a desktop computer, an e-reader, etc. The electronic device may be connected to a server through a network, and request webpage data from the server to the server, and upload and hijack the server. Information etc. The electronic device has one or more processors 510 (only one is shown in the figure), a memory 520, and one or more programs. The one or more programs are stored in the memory 520 and configured to be executed by the one or more processors 510. The one or more programs are configured to execute the methods described in the foregoing embodiments.

In the embodiment of the present application, the one or more programs may be application programs and various quick applications respectively.

The processor 510 may include one or more processing cores. The processor 510 uses various interfaces and lines to connect various parts of the entire electronic device 500, and executes by running or executing instructions, programs, code sets, or instruction sets stored in the memory 520, and calling data stored in the memory 520. Various functions and processing data of the electronic device 500. Optionally, the processor 510 may use at least one of digital signal processing (Digital Signal Processing, DSP), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), and Programmable Logic Array (Programmable Logic Array, PLA). A kind of hardware form to realize. The processor 510 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing of display content; the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 510, but may be implemented by a communication chip alone.

The memory 520 may include random access memory (RAM) or read-only memory (Read-Only Memory). The memory 520 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 520 may include a storage program area and a storage data area, where the storage program area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing each of the foregoing method embodiments, and the like. The storage data area can also be data created by the electronic device in use (such as phone book, audio and video data, chat record data), etc.

In addition, the electronic device 500 may also include a display screen for displaying the video to be displayed.

Please refer to FIG. 10, which shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application. The computer-readable storage medium 600 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.

The computer-readable storage medium 600 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 600 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 600 has a storage space for the program code 610 for executing any method steps in the above methods. These program codes can be read out from or written into one or more computer program products. The program code 610 may be compressed in a suitable form, for example.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application, not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions recorded in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not drive the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

A browser anti-hijacking method, characterized in that the method includes:

The browser receives web page data;

Acquiring the amount of legal data in the webpage data as the first value;

Acquiring the actual data amount of the webpage data as the second value;

If the first value is different from the second value, it is determined that the webpage corresponding to the webpage data is hijacked, and anti-hijacking processing is performed on the webpage.
The method according to claim 1, wherein said obtaining the amount of legal data in the webpage data comprises:

Acquiring data of the amount of recorded data in the web page data as stored value data;

The data amount of the webpage data is parsed from the stored value data as the data amount of the legal data in the webpage data.
The method according to claim 2, wherein the stored value data is data encrypted according to a preset encryption algorithm, and before the data amount of the webpage data is parsed from the stored value data, the method further comprises: Decrypt the stored value data according to the preset encryption algorithm.
The method according to any one of claims 1-3, wherein the web page includes multiple frames, the web page data is data of any one frame, and for any one frame, the browser is executed to receive the web page data From the steps to the step of determining that the webpage corresponding to the webpage data is hijacked if the first value is different from the second value, and performing anti-hijacking processing on the webpage.
The method according to claim 4, wherein if the first value is different from the second value, it is determined that the webpage corresponding to the webpage data is hijacked, and before the anti-hijacking process is performed on the webpage, Also includes:

Calculate the sum of the first values corresponding to all frames as the first total value;

Calculate the sum of the second values corresponding to all frames as the second total value;

Comparing whether the first total value and the second total value are the same,

If they are different, for each frame, perform the step of determining that the webpage corresponding to the webpage data is hijacked if the first value is different from the second value, and performing anti-hijacking processing on the webpage.
The method according to any one of claims 1 to 3, wherein the web page includes multiple frames, and the web page data is data of the frame, and when the web page data of a frame is received, all the frames are executed. From the step of obtaining the data amount of the legal data in the webpage data to if the first value is different from the second value, it is determined that the webpage corresponding to the webpage data is hijacked, and the webpage is subjected to anti-hijacking processing step.
The method according to any one of claims 4-6, wherein the anti-hijacking processing on the webpage comprises:

Perform anti-hijacking processing on the frame corresponding to the webpage data.
8. The method according to claim 7, wherein the anti-hijacking processing on the frame corresponding to the webpage data comprises:

Obtaining the URL information of the frame corresponding to the webpage data;

Initiating a webpage acquisition request carrying the website information to the server, so that the server returns the webpage data of the frame according to the webpage acquisition request;

Obtain the new web page data of the frame from the server, and replace the web page data of the frame.
The method according to claim 7 or 8, wherein the anti-hijacking processing on the frame corresponding to the webpage data comprises:

If the server cannot be accessed, or new web page data cannot be obtained from the server, the execution of the web page data of the frame is stopped.
The method according to any one of claims 4-6, wherein the anti-hijacking processing on the webpage comprises:

Perform anti-hijacking processing on the entire web page.
The method according to any one of claims 1-3, wherein the webpage data is all data of the webpage, and the anti-hijacking processing on the webpage comprises: anti-hijacking the entire webpage deal with.
The method according to claim 10 or 11, wherein the performing anti-hijacking processing on the entire webpage comprises:

Obtaining the URL information of the webpage;

Initiating a webpage acquisition request carrying the web address information to a server, so that the server returns all webpage data of the webpage according to the webpage acquisition request;

Obtain new webpage data of the webpage from the server, and replace the webpage data of the webpage.
The method according to any one of claims 1-8 or 10-12, wherein the anti-hijacking processing on the webpage comprises:

If the server cannot be accessed or new webpage data cannot be obtained from the server, the execution of all webpage data of the webpage is stopped.
The method according to claim 9 or 13, wherein the anti-hijacking processing on the webpage further comprises:

Show webpage hijacking reminder label.
The method according to claim 8 or 12, wherein the web page acquisition request carries an anti-hijacking flag for the server to add an anti-hijacking response to the returned web page data according to the anti-hijacking flag mark.
The method according to claim 15, characterized in that, before replacing the web page data, the method further comprises: determining whether the received web page data carries an anti-hijacking mark;

If there is, replace the web page data.
The method according to any one of claims 1-16, wherein when the webpage includes multiple frames and the webpage data is frame data, if the first value and the second value are If the value is the same, it is determined that the frame corresponding to the web page data is not hijacked;

In the case where the webpage data is all data of the webpage, if the first value is the same as the second value, it is determined that the webpage is not hijacked.
A browser anti-hijacking device, characterized in that the device includes:

Data receiving module for the browser to receive web page data;

The first data acquisition module is configured to acquire the data amount of the legal data in the webpage data as the first value;

The second data acquisition module is configured to acquire the actual data amount of the webpage data as the second value;

The anti-hijacking processing module is configured to determine that the webpage corresponding to the webpage data is hijacked if the first value is different from the second value, and perform anti-hijacking processing on the webpage.
An electronic device, characterized in that it comprises:

One or more processors;

Memory

One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute as claimed The method of any one of 1-17.
A computer-readable storage medium, wherein a program code is stored in the computer-readable storage medium, and the program code can be invoked by a processor to execute the method according to any one of claims 1-17.