Orphaned page embedding attack detection method based on internet intersection search

Abstract

The invention relates to the information security technology, and aims at providing an orphaned page embedding attack detection method based on internet intersection search. The orphaned page embedding attack detection method based on internet intersection search comprises the following steps: settling websites on the internet into a website library, and performing dark link and keyword retrievalon the home page of each website; for the website with high suspicious degree, analyzing risk links in a risk link module thereof one by one; performing combined analysis on the source page and directed page of the illegal link to further confirm the possibility of being illegally tampered or embedded; finding out and confirming the orphaned page from a WEB system located by the page directed by the illegal link. Through the detection method disclosed by the invention, the possibility of confirming the illegal module, the illegal link and the illegal content is variable and learning; the way of analyzing from multiple angles of the entirety is more accurate and credible in comparison with the single content.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for detecting orphan page implantation attacks based on Internet cross search. Background technique [0002] Since the world's first website was born in the early 1990s, WEB websites have continued to develop along with the Internet technology innovation. One of the most important changes is from the unidirectional provision of content (static website) by website information providers in the WEB1.0 era to the wide application of dynamic websites. With the vigorous rise of BBS forums and the advent of the WEB2.0 era, the interactivity of webpages has also increased with the importance of users, and various webpage technologies, database technologies, and web container technologies have also developed rapidly. But technology is a double-edged sword. While improving user experience, user input is also an uncontrollable factor. Various injections and attacks di...

AI Technical Summary

Problems solved by technology

3. Page adding history, system operation log, etc. may be erased, so it is completely clueless to search

[0006] The second method also has the following defects: 1. Although the search engine has fully presented the implanted orphan chain, this information is completely lost in a large amount of non-network security-related information, and there is no automatic way to extract it; 2. Search engines cache too much content, without specificity, and the update cycle becomes longer, resulting in a decrease in timeliness

In addition, a common defect of both is that when searching with sensitive information text, the hit rate of keywords is very high, and its effectiveness cannot be guaranteed.

Images