Methods, apparatuses, devices, systems, and media for defending against phishing attacks

Abstract

Embodiments of the present application disclose a method, device, equipment, system and medium for defending against a network phishing attack to solve the problem of security loopholes in the prior art for defending against a network phishing attack. The system for defending against a network phishing attack comprises a zero-trust gateway configured to receive a service access request sent by a zero-trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero-trust client; and the remote browser service device configured to start a remote browser container instance according to the service access request, send an HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert a security defense interceptor code into an HTML document of the HTTP response, obtain a modified HTTP response, and send the modified HTTP response to the zero-trust gateway.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and specifically to a method, apparatus, device, system, and medium for defending against phishing attacks. Background Art

[0002] Phishing is an attack that attempts to trick users into revealing personal information such as usernames, passwords, and credit card details by posing as a trusted entity. Attackers typically send emails or text messages that appear to be from a trusted entity (e.g., a bank), directing users to click on a link that leads to a fake website, where they can steal their login credentials and other sensitive data.

[0003] Against this backdrop, the concept of zero-trust security emerged. The core of the zero-trust concept is "continuous authentication, never trust," requiring that users or devices be distrusted under any circumstances, even if they are already within the internal network.

[0004] Existing methods for defending against phishing attacks based on the zero-trust framework include:

[0005] Based on the Indicators of Compromise (IOC) intelligence library, blacklist domain names and IP addresses for reputation detection to detect and block access to known malicious domains.

[0006] Detect and block malicious files, links, and attachments on endpoints such as laptops, desktops, and mobile devices with antivirus, antimalware, and anti-phishing capabilities provided by Endpoint Detection and Response (EDR) (endpoint security software).

[0007] However, the above methods still have many security risks when defending against phishing. For example, the IOC intelligence library can only intercept known malicious domain names and IP addresses, but cannot intercept new types of phishing attacks. Summary of the Invention

[0008] The embodiments of the present application provide a method, apparatus, device, system, and medium for defending against phishing attacks to address the security vulnerabilities of existing technologies for defending against phishing attacks.

[0009] In a first aspect, an embodiment of the present application provides a system for defending against phishing attacks, the system comprising:

[0010] A zero trust gateway is configured to receive a service access request sent by a zero trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero trust client.

[0011] The remote browser service device is configured to start a remote browser container instance according to the service access request, send an HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert a security defense interceptor code into an HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway, where the target website is a website to be accessed indicated by the service access request.

[0012] In a second aspect, an embodiment of the present application provides a method for defending against a phishing attack, applied to a remote browser service device, and the method comprises the following steps:

[0013] receiving a service access request sent by a zero trust client redirected by a zero trust gateway;

[0014] starting a remote browser container instance according to the service access request;

[0015] sending an HTTP request to a target website through the remote browser container instance, and receiving an HTTP response returned by the target website, where the target website is a website to be accessed indicated by the service access request;

[0016] inserting a security defense interceptor code into an HTML document of the HTTP response through the remote browser container instance, and obtaining the modified HTTP response;

[0017] sending the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0018] In a third aspect, an embodiment of the present application provides a device for defending against a phishing attack, applied to a remote browser service device, and the device comprises:

[0019] a receiving module configured to receive a service access request sent by a zero trust client redirected by a zero trust gateway;

[0020] a starting module configured to start a remote browser container instance according to the service access request;

[0021] The target website access module is configured to send a hypertext transfer protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is a website to be accessed indicated by the business access request.

[0022] The interception code insertion module is configured to insert security defense interceptor code into an HTML document of the HTTP response through the remote browser container instance, and obtain the modified HTTP response.

[0023] The sending module is configured to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0024] In a fourth aspect, an electronic device is provided, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the embodiments of the second aspect.

[0025] In a fifth aspect, a computer readable medium is provided, having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any one of the embodiments of the second aspect is implemented.

[0026] The method, device, equipment, system and medium for defending against phishing attacks provided by the embodiments of the present application can redirect the business access request sent by the zero trust client to the remote browser service device, the remote browser service device is physically isolated from the zero trust client, and the operation of accessing the target website by the zero trust client is completed by the remote browser service device through the remote browser container instance, thereby ensuring the security of the zero trust client accessing the target website. In addition, since the remote browser container instance can add security defense interceptor code in the HTML document of the HTTP response returned by the target website, the technical solution provided by the embodiments can defend against attack behaviors in the phishing scene, enrich detection means in different scenes, realize omnidirectional and multifunctional detection capability, and effectively prevent download during passing by, deceptive induction leakage, malicious advertising and other situations. The problem of security vulnerability in defending against phishing attacks in the prior art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0027] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings:

[0028] Figure 1 is a structural schematic diagram of one embodiment of the system for defending against phishing attacks of the present application;

[0029] Figure 2 yes Figure 1 The schematic diagram of the structure of the remote browser service device in the system for defending against phishing attacks of the present application is shown;

[0030] Figure 3 is a structural diagram of another embodiment of the system for defending against phishing attacks of the present application;

[0031] Figure 4 is a flowchart of an embodiment of a method for defending against phishing attacks of the present application;

[0032] Figure 5 This is a schematic structural diagram of an embodiment of a device for defending against phishing attacks of the present application;

[0033] Figure 6 It is a structural diagram of an electronic device used to implement an embodiment of the present application. DETAILED DESCRIPTION

[0034] All actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0035] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0036] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0037] Please refer to Figure 1 , which shows a schematic diagram of the structure of an embodiment of a system for defending against phishing attacks according to the present application. The devices in the system for defending against phishing attacks can be various electronic devices with data processing capabilities. For example, the electronic devices may include, but are not limited to, cloud servers and physical servers. The execution entity of the devices in the system for defending against phishing attacks can be a processor in the electronic devices described above.

[0038] like Figure 1 As shown, the system for defending against phishing attacks may include: a zero trust gateway 101 and a remote browser service device 102, wherein the structural diagram of the remote browser service device 102 can be found in FIG. Figure 2 shown.

[0039] The zero trust gateway 101 is used to receive a service access request sent by a zero trust client, redirect the service access request to the remote browser service device 102, receive a modified HTTP response returned by the remote browser service device 102, and forward the modified HTTP response to the zero trust client.

[0040] In this embodiment, the user first uses a zero-trust client to log in with his identity, accesses the zero-trust network after the identity authentication is passed, and then uses a browser or other application to access the Internet application, which is specifically manifested as: a business access request sent through the zero-trust client; the Domain Name System (DNS) agent of the internal network where the zero-trust client is located will first obtain the domain name of the target website, and then filter it through the Internet web application whitelist issued by the zero-trust dynamic policy center to determine whether it is within the authorized list of the zero-trust Internet behavior control policy. If it is not within this range, a non-control identifier is added to the business access request. Specifically, the non-control identifier can be added to the 7-layer protocol header field of the business access request, and the business access request with the non-control identifier is sent to the zero-trust gateway. If it is not within this range, public network access is performed according to other routing decision methods.

[0041] At this time, the zero-trust gateway 101 is further configured to redirect the service access request to the remote browser service device 102 if the service access request carries a non-control identifier; and to obtain an Internet behavior control list if the service access request does not carry a non-control identifier, and redirect the service access request to the remote browser service device 102 based on the Internet behavior control list. In this embodiment, the control list can be a whitelist and / or a blacklist.

[0042] The above method can effectively reduce the number of business access requests sent to the zero-trust gateway, thereby reducing the load on the remote browser service device. For the entire zero-trust network, normal network access accounts for the vast majority of cases, while network attacks only hide in a small part. Therefore, when designing the solution, in addition to considering security defense functions, noise elimination methods are also considered. Access requests without attack behavior are filtered out as much as possible through the whitelist configuration of Internet domain assets. This helps to reduce false alarm rates, reduce the pressure on cache operators, and improve the accuracy of identifying suspicious resources.

[0043] The remote browser service device 102 is used to start the remote browser container instance 201 according to the business access request, send a HyperText Transfer Protocol (HTTP) request to the target website through the remote browser container instance 201, receive the HTTP response returned by the target website, insert the security defense interceptor code into the HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway 101, wherein the target website is the website to be visited indicated by the business access request.

[0044] In this embodiment, the remote browser service device 102 can also be used to receive a business access request through the service adaptation layer 202, forward the business access request to the service management layer 203, parse the business access request through the service management layer 203, obtain the security defense control policy, and send the security defense control policy to the remote browser container instance 201. The remote browser container instance 201 generates a security defense interceptor code according to the security defense control policy.

[0045] In this embodiment, the remote browser service device 102 can transparently transmit the security defense control policy to the container session management module 204, which then sends it to the remote browser container instance 201. The container session management module 204 is primarily responsible for status query, instance management, and resource recovery of the remote browser container instance 201.

[0046] In this embodiment, after the remote browser service device 102 receives the service access request, the container session management module 204 first performs a status query to determine whether there is an idle browser container instance 201 currently available. If so, the browser container instance 201 is directly reused to access the target website. If not, a new browser container instance 201 is established and started, and the new browser container instance 201 is used to access the target website.

[0047] In this embodiment, the security defense control policy may include, but is not limited to, disabling the text input box function on a webpage and prohibiting the download of files of preset types on the page. It should be noted that this embodiment does not specifically limit the preset types; in actual use, the preset types can be set according to security protection requirements.

[0048] In this embodiment, the specific implementation logic of the remote browser service device 102 inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance 201 may include:

[0049] When the security defense control policy prohibits downloading files of a preset type in a page, the remote browser container instance 201 traverses and determines whether there is a downloadable file of the preset type in the HTML document (specifically, an H5 document). If so, its download link is set to empty ("about:blank").

[0050] When the security defense control policy is to disable the text input box function of the web page, the remote browser container instance 201 will set the properties of the form and text box controls in the h5 document to a disabled state.

[0051] In order to further improve the security of website browsing and avoid phishing attacks, in this embodiment, the remote browser service device 102 can also be used to send the modified HTTP response to the zero trust gateway in a pixel stream transmission manner.

[0052] By sending modified HTTP responses to the Zero Trust gateway via pixel streaming, the local client eliminates the need to process complex web functions, focusing instead on displaying pixels and transmitting user input. This collaborative operation is performed in full-duplex mode, with one channel receiving and displaying screenshots of the remote page, while another channel transmits user interaction controls and data, resulting in a more streamlined and manageable process. Furthermore, the Zero Trust client does not receive any web application code, and users only interact with image or video rendering, significantly enhancing security.

[0053] In the system for defending against phishing attacks provided by the embodiment of the present application, the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device. The remote browser service device is physically isolated from the zero-trust client. The operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, thereby ensuring the security of the zero-trust client accessing the target website. In addition, because the remote browser container instance can add security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against attacks in deceptive phishing scenarios, enrich the detection methods in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent various situations such as drive-by downloads, deceptive induced leaks, and malicious advertising. This solves the problem of security vulnerabilities in the existing technology for defending against phishing attacks.

[0054] Please refer to Figure 3, which shows a schematic diagram of the structure of an embodiment of a system for defending against phishing attacks according to the present application. The devices in the system for defending against phishing attacks can be various electronic devices with data processing capabilities. For example, the electronic devices may include, but are not limited to, cloud servers and physical servers. The execution entity of the devices in the system for defending against phishing attacks can be a processor in the electronic devices described above.

[0055] like Figure 3 As shown, the system for defending against phishing attacks is Figure 1 The system is basically the same as shown, except that the system may further include:

[0056] Zero Trust Dynamic Policy Center 103, used to dynamically generate and maintain Internet behavior control lists and security defense control policies;

[0057] The zero trust console 104 is used to send the Internet behavior control list to the zero trust gateway 101 and send the security defense control policy to the remote browser service device 102.

[0058] The system for defending against phishing attacks provided in this embodiment can achieve Figure 1 Based on the beneficial effects brought about by the technical solution shown, the zero-trust dynamic policy center and the zero-trust console can perform zero-trust management and provide dynamically updated security defense control policies for the remote browser service device 102, further improving network security.

[0059] Please refer to Figure 4 , which illustrates a process 400 of one embodiment of a method for defending against phishing attacks according to the present application. This method for defending against phishing attacks can be applied to the remote browser service device 102 described above, which can be any electronic device with data processing capabilities. For example, the electronic device may include, but is not limited to, a cloud server, a physical server, etc. The execution entity of this method for defending against phishing attacks may be a processor in the electronic device described above.

[0060] like Figure 4 As shown, the method for defending against phishing attacks includes the following steps:

[0061] Step 401: Receive a service access request sent by a zero trust client redirected by a zero trust gateway.

[0062] In this embodiment, the user first uses a zero-trust client to log in with his identity, accesses the zero-trust network after the identity authentication is passed, and then uses a browser or other application to access the Internet application, which is specifically manifested as: a business access request sent through the zero-trust client; the internal network DNS proxy where the zero-trust client is located will first obtain the domain name of the target website, and then filter it through the Internet web application whitelist issued by the zero-trust dynamic policy center to determine whether it is within the authorized list of the zero-trust Internet behavior control policy. If it is not within this range, a non-control identifier is added to the business access request. Specifically, the non-control identifier can be added to the 7-layer protocol header field of the business access request, and the business access request with the non-control identifier is sent to the zero-trust gateway. If it is not within this range, public network access is performed according to other routing decision methods.

[0063] At this time, if the service access request carries a non-control flag, the zero-trust gateway can redirect the service access request to the remote browser service device; if the service access request does not carry a non-control flag, the zero-trust gateway obtains the Internet behavior control list and redirects the service access request to the remote browser service device based on the Internet behavior control list. In this embodiment, the control list can be a whitelist and / or a blacklist.

[0064] Step 402: Start the remote browser container instance according to the service access request.

[0065] In this embodiment, step 402 may specifically first perform a status query through the container session management module to determine whether there is an idle browser container instance currently available. If so, the browser container instance is directly started to access the target website. If not, a new browser container instance is established and started, and the new browser container instance is used to access the target website.

[0066] Step 403: Send an HTTP request to the target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be accessed indicated by the service access request.

[0067] Step 404: insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response.

[0068] Step 405: Send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0069] In this embodiment, step 405 can specifically send the modified HTTP response to the zero trust gateway in a pixel stream transmission manner.

[0070] In this embodiment, step 401 may specifically receive a service access request via the service adaptation layer. Optionally, step 401 may also include forwarding the service access request to the service management layer, parsing the service access request via the service management layer to obtain a security defense control policy, sending the security defense control policy to the remote browser container instance, and generating security defense interceptor code via the remote browser container instance based on the security defense control policy.

[0071] In this embodiment, the security defense control policy includes, but is not limited to, disabling the text input box function on a webpage and prohibiting the download of files of preset types on the page. It should be noted that this embodiment does not specifically limit the preset types; in actual use, the preset types can be set according to security protection requirements.

[0072] In this embodiment, the specific implementation logic of step 404 of inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance may include:

[0073] When the security defense control policy prohibits downloading files of a preset type in a page, the remote browser container instance 201 traverses and determines whether there is a downloadable file of the preset type in the HTML document (specifically, an H5 document). If so, its download link is set to empty ("about:blank").

[0074] When the security defense control policy is to disable the text input box function of the web page, the remote browser container instance 201 will set the properties of the form and text box controls in the h5 document to a disabled state.

[0075] The method for defending against phishing attacks provided by the embodiment of the present application is that the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device. The remote browser service device is physically isolated from the zero-trust client. The operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, thereby ensuring the security of the zero-trust client accessing the target website. In addition, because the remote browser container instance can add security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against attacks in deceptive phishing scenarios, enrich the detection methods in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent various situations such as drive-by downloads, deceptive induced leaks, and malicious advertising. The problem of security vulnerabilities in the existing technology for defending against phishing attacks is solved.

[0076] Please refer to Figure 5, which shows a schematic structural diagram 500 of an embodiment of a device for defending against phishing attacks according to the present application. This device for defending against phishing attacks can be applied to the remote browser service device described above, which can be any electronic device with data processing capabilities. For example, the electronic device described above can include, but is not limited to, a cloud server, a physical server, etc. The execution entity of this device for defending against phishing attacks can be a processor in the electronic device described above.

[0077] like Figure 5 As shown, the device for defending against phishing attacks provided in this embodiment may include:

[0078] The receiving module 501 is used to receive a service access request sent by a zero trust client redirected by a zero trust gateway.

[0079] In this embodiment, the zero-trust gateway can redirect the business access request to the remote browser service device if the business access request carries a non-control identifier; if the business access request does not carry a non-control identifier, it obtains the Internet behavior control list and redirects the business access request to the remote browser service device based on the Internet behavior control list.

[0080] The starting module 502 is configured to start a remote browser container instance according to the service access request.

[0081] The target website access module 503 is configured to send a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be accessed indicated by the service access request.

[0082] The interception code insertion module 504 is used to insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response.

[0083] The sending module 505 is used to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0084] Optionally, the sending module 505 is specifically configured to send the modified HTTP response to the zero-trust gateway in a pixel stream transmission manner.

[0085] Optionally, the receiving module 501 is specifically configured to receive a service access request through the service adaptation layer, and forward the service access request to the service management layer.

[0086] The target website access module 503 is specifically used to parse the business access request through the service management layer, obtain the security defense control policy, send the security defense control policy to the remote browser container instance, and generate the security defense interceptor code according to the security defense control policy through the remote browser container instance.

[0087] The specific implementation method of the device for defending against phishing attacks provided in this embodiment can be found in the system and method for defending against phishing attacks provided in the above embodiments, and will not be repeated here.

[0088] In the device for defending against phishing attacks provided by the embodiment of the present application, a zero-trust gateway can redirect service access requests sent by a zero-trust client to a remote browser service device. The remote browser service device is physically isolated from the zero-trust client, and the operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, thereby ensuring the security of the zero-trust client accessing the target website. Moreover, because the remote browser container instance can add security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against attacks in deceptive phishing scenarios, enrich the detection methods in different scenarios, realize comprehensive and multi-functional detection capabilities, and effectively prevent various situations such as drive-by downloads, deceptive induced leaks, and malicious advertising. This solves the problem of security vulnerabilities in the existing technology for defending against phishing attacks.

[0089] Reference below Figure 6 , which shows a structural schematic diagram of an electronic device for implementing some embodiments of the present application. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0090] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0091] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic disk, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0092] In particular, according to some embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from a network via the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of some embodiments of the present application are performed.

[0093] It should be noted that the computer-readable medium described in some embodiments of the present application may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present application, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present application, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0094] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0095] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: receives a business access request sent by a zero-trust client redirected by a zero-trust gateway; starts a remote browser container instance according to the business access request; sends a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receives an HTTP response returned by the target website, wherein the target website is the website to be visited indicated by the business access request; inserts the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response; and sends the modified HTTP response to the zero-trust gateway through the remote browser container instance.

[0096] Computer program code for performing the operations of some embodiments of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++; and also conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, or can be connected to an external computer (for example, through the Internet using an Internet service provider). The above network includes a local area network (LAN) or a wide area network (WAN).

[0097] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0098] The units described in some embodiments of this application may be implemented in software or hardware. The units described may also be provided in a processor. For example, a processor may be described as comprising a first determination unit, a second determination unit, a selection unit, and a third determination unit. The names of these units do not, in some cases, limit the units themselves.

[0099] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0100] The above description is only an illustration of some preferred embodiments of the present application and the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features and the technical features with similar functions disclosed in the embodiments of the present application (but not limited to) are replaced with each other to form a technical solution.

Claims

1. A system for defending against phishing attacks, characterized in that: The system comprises: A zero-trust gateway, configured to receive a service access request sent by a zero-trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero-trust client; The remote browser service device is used to start a remote browser container instance according to the business access request, send a Hypertext Transfer Protocol HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert the security defense interceptor code into the HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway, wherein the target website is the website to be visited indicated by the business access request.

2. The system according to claim 1, wherein: The remote browser service device is further used to receive the business access request through the service adaptation layer, forward the business access request to the service management layer, parse the business access request through the service management layer, obtain the security defense control policy, and send the security defense control policy to the remote browser container instance. The remote browser container instance generates the security defense interceptor code according to the security defense control policy.

3. The system according to claim 2, characterized in that The security defense control strategy includes: disabling the text input box function of the web page and / or prohibiting the download of files of a preset type in the page.

4. The system according to claim 1, wherein: The remote browser service device is also used to send the modified HTTP response to the zero trust gateway in a pixel stream transmission manner.

5. The system according to claim 1, wherein: The zero-trust gateway is also used to redirect the business access request to a remote browser service device when the business access request carries a non-control identifier; and to obtain an Internet behavior control list when the business access request does not carry a non-control identifier, and redirect the business access request to a remote browser service device based on the Internet behavior control list.

6. The system according to claim 1, wherein: The system further comprises: Zero Trust Dynamic Policy Center, used to dynamically generate and maintain Internet behavior control lists and security defense control policies; The zero-trust console is used to send the Internet behavior control list to the zero-trust gateway and send the security defense control policy to the remote browser service device.

7. A method for defending against phishing attacks, characterized in that: Applied to a remote browser service device, the method includes: Receive business access requests sent by zero-trust clients redirected by the zero-trust gateway; Initiate a remote browser container instance based on the service access request; Sending a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receiving an HTTP response returned by the target website, wherein the target website is the website to be accessed indicated by the service access request; Inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain a modified HTTP response; The modified HTTP response is sent to the zero trust gateway through the remote browser container instance.

8. A device for defending against phishing attacks, characterized in that: Applied to a remote browser service device, the device comprises: A receiving module, configured to receive a service access request sent by a zero-trust client redirected by a zero-trust gateway; A startup module, configured to start a remote browser container instance according to the service access request; a target website access module, configured to send a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be accessed indicated by the service access request; An interception code insertion module, configured to insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance, and obtain a modified HTTP response; A sending module is used to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to claim 7.

10. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 7 is implemented.

Images