Whitelist optimization method, device, equipment and computer-readable storage medium

Abstract

The present invention discloses a whitelist optimization method, including: if an interface to be detected is detected, determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist; if so, determining the page to be detected corresponding to the interface to be detected, and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page; if the similarity is less than a preset threshold, deleting the whitelist interface from the whitelist, and performing vulnerability detection on the interface to be detected. The present invention also discloses a whitelist optimization device, equipment, and computer-readable storage medium. In addition to determining whether the interface to be detected is in the whitelist, the present invention also detects the page to be detected of the interface to be detected, and determines whether the interface to be detected needs to be optimized based on the similarity between the page to be detected and the whitelist page recorded in the whitelist, thereby accurately optimizing the whitelist and realizing intelligent optimization of the whitelist.

Description

Technical Field

[0001] The present invention relates to the field of financial technology (Fi ntech) technology, and in particular to a whitelist optimization method, device, equipment and computer-readable storage medium. Background Art

[0002] In recent years, with the continuous development of Fintech, especially Internet finance, information security technology has been introduced into the daily services of banks and other financial institutions. In the daily service process of banks and other financial institutions, in order to prevent the service system from being attacked maliciously, it is necessary to scan the interfaces connected to the service system for vulnerabilities. In the process of vulnerability scanning, in order to speed up the scanning speed and reduce the false alarm rate, whitelist technology is usually used, that is, the interfaces in the whitelist are trustworthy and do not need to be scanned and detected. While improving security, the speed is also greatly improved. Therefore, how to maintain and manage the whitelist is an important task for banks and other financial institutions.

[0003] In the prior art, generally, the interface connected to the service system is checked for vulnerabilities, and after passing the test, it is added to the whitelist. Subsequently, the pages sent from the interface are no longer checked for vulnerabilities. However, this method cannot identify web page vulnerabilities, such as Trojan viruses embedded in the page. This is because the interface itself has not changed, and the service system still passes it according to the whitelist rules, causing the service system to be attacked.

[0004] In order to avoid this situation, the prior art also regularly detects the interfaces in the whitelist, that is, re-detects the interfaces, if they are fine, they are retained, if a vulnerability is detected, the interface is deleted from the whitelist, and the whitelist is updated. However, this method is not updated in a timely manner, and the vulnerability detection needs to be repeated, which is obviously not smart enough. Summary of the invention

[0005] The main purpose of the present invention is to propose a whitelist optimization method, device, equipment and computer-readable storage medium, aiming to achieve intelligent optimization of the whitelist.

[0006] To achieve the above object, the present invention provides a whitelist optimization method, which comprises the following steps:

[0007] If an interface to be detected is detected, determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist;

[0008] If so, determine the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculate the similarity between the page to be detected and the whitelist page;

[0009] If the similarity is less than a preset threshold, the whitelist interface is deleted from the whitelist, and vulnerability detection is performed on the interface to be detected.

[0010] Preferably, the step of calculating the similarity between the page to be detected and the whitelist page comprises:

[0011] Determine the length of the text that is the same as the text content of the page to be detected and the whitelist page, and the total length of the text of the page to be detected and the whitelist page;

[0012] Based on the text length and the total text length, the similarity between the page to be detected and the whitelist page is calculated.

[0013] Preferably, the step of determining the text length of the to-be-detected page having the same text content as the whitelist page comprises:

[0014] Acquire a first text of the page to be detected and a second text of the whitelist page, and determine that the terminal character of the first text is a first character to be matched, and determine that the terminal character of the second text is a second character to be matched;

[0015] Determine whether the first character to be matched is consistent with the second character to be matched;

[0016] If they are consistent, then remove the terminal character from the first text and the second text, determine the removed terminal character as the target character, and continue to perform the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0017] If they are inconsistent, removing the terminal character from the first text or the second text, and performing the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0018] If all characters of the first text or the second text are matched, a character set corresponding to the target character is obtained, and the character set includes at least one;

[0019] Based on the character set, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0020] Preferably, the step of determining the length of the text to be detected that is the same as the text content of the whitelist page based on the character set includes:

[0021] If the character set is one, counting a first number of target characters in the character set, and determining, based on the first number, a text length of the page to be detected that is identical to the text content of the whitelist page;

[0022] If there are multiple character sets, the character set with the most target characters is determined as the target character set, and the second number of target characters in the target character set is counted. Based on the second number, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0023] Preferably, if present, the step of determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page comprises:

[0024] If it exists, determine the page to be detected corresponding to the interface to be detected, and the first running text of the page to be detected, and determine the whitelist page corresponding to the whitelist interface, and the second running text of the whitelist page, wherein the running text refers to the content used to record the processing order of the page;

[0025] The first running text and the second running text are replaced with preset texts, and the similarity between the replaced page to be detected and the replaced whitelist page is calculated.

[0026] Preferably, if present, the step of determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page comprises:

[0027] If so, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected;

[0028] If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated.

[0029] Preferably, the step of determining the page to be detected corresponding to the interface to be detected includes:

[0030] Sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests;

[0031] Determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface;

[0032] The first returned page whose first request time is within the Gaussian distribution range is determined as a target page, and based on the target page, a page to be detected corresponding to the interface to be detected is determined.

[0033] Preferably, after the step of determining whether the first request time of each first return page is within the Gaussian distribution range of the whitelist interface, the whitelist optimization method further includes:

[0034] If the first request time of each of the first return pages is not within the Gaussian distribution range, the first return page with the latest return time among the first return pages is determined as the page to be detected corresponding to the interface to be detected.

[0035] Preferably, before the step of determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist if an interface to be detected is detected, the whitelist optimization method further includes:

[0036] Sending a second preset number of second page requests to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page requests;

[0037] The second request time of each of the second return pages is determined, and based on the second request time and a preset calculation formula, the Gaussian distribution range of the whitelist interface is determined.

[0038] In addition, to achieve the above object, the present invention further provides a whitelist optimization device, the whitelist optimization device comprising:

[0039] A detection module, for determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist if an interface to be detected is detected;

[0040] A calculation module, used for determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, if any, and calculating the similarity between the page to be detected and the whitelist page;

[0041] The optimization module is used to delete the whitelist interface from the whitelist if the similarity is less than a preset threshold, and perform vulnerability detection on the interface to be detected.

[0042] Preferably, the calculation module is also used for:

[0043] Determine the length of the text that is the same as the text content of the page to be detected and the whitelist page, and the total length of the text of the page to be detected and the whitelist page;

[0044] Based on the text length and the total text length, the similarity between the page to be detected and the whitelist page is calculated.

[0045] Preferably, the calculation module is also used for:

[0046] Acquire a first text of the page to be detected and a second text of the whitelist page, and determine that the terminal character of the first text is a first character to be matched, and determine that the terminal character of the second text is a second character to be matched;

[0047] Determine whether the first character to be matched is consistent with the second character to be matched;

[0048] If they are consistent, then remove the terminal character from the first text and the second text, determine the removed terminal character as the target character, and continue to perform the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0049] If they are inconsistent, removing the terminal character from the first text or the second text, and performing the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0050] If all characters of the first text or the second text are matched, a character set corresponding to the target character is obtained, and the character set includes at least one;

[0051] Based on the character set, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0052] Preferably, the calculation module is also used for:

[0053] If the character set is one, counting a first number of target characters in the character set, and determining, based on the first number, a text length of the page to be detected that is identical to the text content of the whitelist page;

[0054] If there are multiple character sets, the character set with the most target characters is determined as the target character set, and the second number of target characters in the target character set is counted. Based on the second number, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0055] Preferably, the calculation module is also used for:

[0056] If it exists, determine the page to be detected corresponding to the interface to be detected, and the first running text of the page to be detected, and determine the whitelist page corresponding to the whitelist interface, and the second running text of the whitelist page, wherein the running text refers to the content used to record the processing order of the page;

[0057] The first running text and the second running text are replaced with preset texts, and the similarity between the replaced page to be detected and the replaced whitelist page is calculated.

[0058] Preferably, the calculation module is also used for:

[0059] If so, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected;

[0060] If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated.

[0061] Preferably, the calculation module is also used for:

[0062] Sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests;

[0063] Determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface;

[0064] The first returned page whose first request time is within the Gaussian distribution range is determined as a target page, and based on the target page, a page to be detected corresponding to the interface to be detected is determined.

[0065] Preferably, the calculation module is also used for:

[0066] If the first request time of each of the first return pages is not within the Gaussian distribution range, the first return page with the latest return time among the first return pages is determined as the page to be detected corresponding to the interface to be detected.

[0067] Preferably, the calculation module is also used for:

[0068] Sending a second preset number of second page requests to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page requests;

[0069] The second request time of each of the second return pages is determined, and based on the second request time and a preset calculation formula, the Gaussian distribution range of the whitelist interface is determined.

[0070] In addition, to achieve the above-mentioned purpose, the present invention also provides a whitelist optimization device, which includes: a memory, a processor, and a whitelist optimization program stored in the memory and executable on the processor, and the whitelist optimization program implements the steps of the whitelist optimization method described above when executed by the processor.

[0071] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a whitelist optimization program is stored, and when the whitelist optimization program is executed by a processor, the steps of the whitelist optimization method described above are implemented.

[0072] The whitelist optimization method proposed in the present invention, if an interface to be detected is detected, determines whether there is a whitelist interface matching the interface to be detected in the preset whitelist; if so, determines the page to be detected corresponding to the interface to be detected, and the whitelist page corresponding to the whitelist interface, and calculates the similarity between the page to be detected and the whitelist page; if the similarity is less than a preset threshold, deletes the whitelist interface from the whitelist, and performs vulnerability detection on the interface to be detected. In addition to determining whether the interface to be detected is in the whitelist, the present invention also detects the page to be detected of the interface to be detected, and determines whether the interface to be detected needs to be optimized based on the similarity between the page to be detected and the whitelist page recorded in the whitelist, thereby accurately optimizing the whitelist and realizing intelligent optimization of the whitelist. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention;

[0074] Figure 2 It is a flowchart of the first embodiment of the whitelist optimization method of the present invention.

[0075] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0076] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0077] like Figure 1 As shown, Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention.

[0078] The device in the embodiment of the present invention may be a mobile terminal or a server device.

[0079] like Figure 1As shown, the device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Dis l ay), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-vol at ile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0080] Those skilled in the art will understand that Figure 1 The device structure shown in the figure does not constitute a limitation of the device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0081] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a whitelist optimization program.

[0082] Among them, the operating system is a program that manages and controls whitelist optimization devices and software resources, and supports the operation of network communication modules, user interface modules, whitelist optimization programs and other programs or software; the network communication module is used to manage and control network interface 1004; the user interface module is used to manage and control user interface 1003.

[0083] exist Figure 1 In the whitelist optimization device shown, the whitelist optimization device calls the whitelist optimization program stored in the memory 1005 through the processor 1001, and executes the operations in each embodiment of the following whitelist optimization method.

[0084] Based on the above hardware structure, an embodiment of the whitelist optimization method of the present invention is proposed.

[0085] Reference Figure 2 , Figure 2 This is a flow chart of a first embodiment of a whitelist optimization method of the present invention, wherein the method comprises:

[0086] Step S10: if an interface to be detected is detected, determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist;

[0087] Step S20: if it exists, determine the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculate the similarity between the page to be detected and the whitelist page;

[0088] Step S30: If the similarity is less than a preset threshold, the whitelist interface is deleted from the whitelist, and vulnerability detection is performed on the interface to be detected.

[0089] The whitelist optimization method of this embodiment is applied to the whitelist optimization device of financial institutions such as financial institutions or banking systems. The whitelist optimization device can be a terminal, a robot or a PC device. For the convenience of description, the whitelist optimization device is referred to as the optimization device. The optimization device of this embodiment is preferably a mobile terminal such as a mobile phone, which is equipped with a Web Scan (Web vulnerability scanner), that is, the optimization device detects the security service of Web website vulnerabilities through the Web vulnerability scanner, and the Web vulnerability scanner is provided with a whitelist, and the target corresponding to the whitelist is the page to be detected corresponding to the interface to be detected, which is used to make the Web vulnerability scanner skip the vulnerability scan of the interface.

[0090] When the optimization device of this embodiment detects the interface to be detected, it first determines whether the interface to be detected is in the whitelist, so as to decide whether it is necessary to perform a vulnerability scan on the interface to be detected. When it is determined that there is a whitelist interface corresponding to the interface to be detected in the whitelist, the similarity between the page to be detected of the interface to be detected and the whitelist page of the whitelist interface is calculated, so as to determine whether the logic of the web interface has changed and whether the outdated whitelist rules should be removed, thereby realizing intelligent optimization of the whitelist with more sophisticated optimization logic.

[0091] The following is a detailed description of each step:

[0092] Step S10: If an interface to be detected is detected, it is determined whether there is a whitelist interface matching the interface to be detected in a preset whitelist.

[0093] In this embodiment, if the optimization device detects an interface to be detected, it first determines whether there is a whitelist interface matching the interface to be detected in the preset whitelist through the interface information of the interface to be detected, wherein the interface information may be the URL address of the interface to be detected. The optimization device searches the whitelist for a whitelist interface with the same URL address based on the URL address of the interface to be detected.

[0094] In addition, the interface information can also be an interface identifier, which is sent to the interface in advance by the optimization device. That is, for a trusted interface, the optimization device will send a trust identifier to it. When the trusted interface is connected to the optimization device, the interface identifier will be carried in the corresponding connection request. The optimization device will search the whitelist for a whitelist interface with the same interface identifier based on the interface identifier.

[0095] It can be understood that if there is no whitelist interface matching the interface to be detected in the whitelist, a vulnerability scan is performed on the interface to be detected.

[0096] Step S20: If it exists, determine the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculate the similarity between the page to be detected and the whitelist page.

[0097] In this embodiment, if there is a whitelist interface matching the interface to be detected in the whitelist, the page to be detected corresponding to the interface to be detected is obtained, and the whitelist page corresponding to the whitelist interface is obtained, and then the similarity between the page to be detected and the whitelist page is calculated.

[0098] That is, by calculating the similarity between the page to be detected and the whitelist page, it is determined whether there is any logical change in the interface to be detected, wherein the page to be detected is the current page of the interface to be detected, and the whitelist page is the page when the interface to be detected is determined to be a secure interface, that is, when the optimization device stores the interface to be detected as a whitelist interface in the whitelist, it also stores the page at that time.

[0099] Specifically, in one embodiment, the step of calculating the similarity between the page to be detected and the whitelist page includes:

[0100] Step a, determining the length of the text of the page to be detected that has the same text content as the whitelist page, and the total length of the text of the page to be detected and the whitelist page;

[0101] In one embodiment, after determining the page to be detected of the interface to be detected and the whitelist page of the whitelist interface, the length of the text with the same text content of the two and the total text length of the two texts are determined. For example, if the text of the page to be detected is aebaghbgg and the text of the whitelist page is bcdgegjh, then the text with the same text content of the two is bgh, that is, the length of the text with the same text content of the two is 3, and the total text length of the two is 17.

[0102] In one embodiment, the similarity between the page to be detected and the whitelist page may be determined by the Hamming distance or the Jaccard distance, or the length of the longest common subsequence, which will not be described in detail here.

[0103] Further, in one embodiment, step a includes:

[0104] Step a1, obtaining a first text of the page to be detected and a second text of the whitelist page, and determining that the end character of the first text is a first character to be matched, and determining that the end character of the second text is a second character to be matched;

[0105] In one embodiment, a calculation method for determining the similarity between a page to be detected and a whitelist page is proposed. Specifically, a first text of the page to be detected and a second text of the whitelist page are first obtained, such as the first text is aebaghbgg and the second text is bcdgegjh. Then, the end character of the first text is determined to be the first character to be matched, such as g, and the end character of the second text is determined to be the second character to be matched, such as h.

[0106] Step a2, determining whether the first character to be matched is consistent with the second character to be matched;

[0107] Next, the first character to be matched is compared with the second character to be matched to determine whether the first character to be matched is consistent with the second character to be matched. There are only two results, one is consistent and the other is inconsistent. If consistent, execute step a3, if inconsistent, execute step a4.

[0108] Step a3: if they are consistent, remove the terminal character from the first text and the second text, determine the removed terminal character as the target character, and continue to perform the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0109] In one embodiment, if the first character to be matched is consistent with the second character to be matched, the terminal character is removed from the first text and the second text. For example, if the first text is abc and the second text is adc, and the terminal character of both is c, the terminal character c is removed from the first text and the second text, so that the first text is ab and the second text is ad, and the removed terminal character c is used as the target character, and then the terminal character of the first text is determined as the first character to be matched. If the terminal character of the first text is b at this time, b is the first character to be matched, and the terminal character of the second text is determined as the second character to be matched. If the terminal character of the second text is d at this time, d is the second character to be matched, and then the comparison is continued to determine whether the first character to be matched is consistent with the second character to be matched.

[0110] Step a4: if they are inconsistent, remove the terminal character from the first text or the second text, and perform the step of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0111] In one embodiment, if the first character to be matched is inconsistent with the second character to be matched, the terminal character is removed from the first text or the second text. For example, if the first text is abd and the second text is aadf, the terminal character of the first text is d and the terminal character of the second text is f, and the two are inconsistent, the terminal character of the first text is removed, or the terminal character of the second text is removed.

[0112] That is, there are two possibilities at this time. The first is to remove the end character of the first text, and the second text remains unchanged, still aadf, and the first text is ab. Then continue to execute to determine the end character of the first text as the first character to be matched. If the end character of the first text at this time is b, then b is the first character to be matched, and determine the end character of the second text as the second character to be matched. If the end character of the second text at this time is f, then f is the second character to be matched, and then continue to compare whether the first character to be matched is consistent with the second character to be matched.

[0113] The second method is to remove the end character of the second text, and the second text becomes aad. The first text remains unchanged and is still abd. Then, the end character of the first text is determined as the first character to be matched. If the end character of the first text is d at this time, d is the first character to be matched. The end character of the second text is determined as the second character to be matched. If the end character of the second text is d at this time, d is the second character to be matched. Then, the comparison is continued to determine whether the first character to be matched is consistent with the second character to be matched.

[0114] Therefore, it can be understood that if the first character to be matched is inconsistent with the second character to be matched, the corresponding possible situations increase in a square multiple manner.

[0115] Step a5, if all characters of the first text or the second text are matched, obtaining a character set corresponding to the target character, the character set including at least one;

[0116] If all characters of the first text or the second text are matched, it means the loop is terminated, and the character set corresponding to the target character is obtained, wherein if the first character to be matched and the second character to be matched are consistent each time, the character set is one; if there is a situation where the first character to be matched and the second character to be matched are inconsistent, the character set is greater than one.

[0117] If the first text is abc and the second text is acd, then according to the above method, the change process of the first text and the second text is:

[0118] One possibility: (abc, acd) → (ab, acd) → (a, acd) → (null value, acd), the corresponding target character is null value;

[0119] One possibility: (abc, acd) → (ab, acd) → (ab, ac) → (a, ac) → (a, a) (the terminal characters are the same, a is taken as the target character) → (null value, null value), the corresponding target character is a, and its set is (a);

[0120] One possibility: (abc, acd) → (abc, ac) (the terminal characters are consistent, c is used as the target character) → (ab, a) → (a, a) (the terminal characters are consistent, a is used as the target character) → (null value, null value), the corresponding target characters are c and a, and the character set is (ca);

[0121] One possibility...

[0122] It can be seen that if the first text and the second text are not completely identical, multiple character sets may appear.

[0123] Step a6: Based on the character set, determine the text length of the page to be detected that is the same as the text content of the whitelist page.

[0124] Finally, based on the character set, the length of the text that is the same between the page to be detected and the whitelist page is determined.

[0125] As can be seen from the above, there are multiple character sets, so step a6 includes:

[0126] Step a61, if the character set is one, counting a first number of target characters in the character set, and determining the text length of the page to be detected having the same text content as the whitelist page based on the first number;

[0127] In one embodiment, if there is only one character set, that is, the first text is exactly the same as the second text, it is only necessary to count the first number of target characters in the character set, and use the first number as the value of the text length of the page to be detected that is not the same as the text content of the whitelist page. For example, if the target character is 5, the corresponding text length is 5.

[0128] Step a62, if there are multiple character sets, determine the character set with the most target characters as the target character set, and count the second number of target characters in the target character set, and based on the second number, determine the text length of the page to be detected that is the same as the text content of the whitelist page.

[0129] In one embodiment, if there are multiple character sets, that is, the first text and the second text are not exactly the same, the number of target characters in each character set is compared, and the character set with the most target characters is determined as the target character set. Then, the second number of target characters in the target character set is counted, and the second number is used as the value of the text length of the page to be detected that is not the same as the text content of the whitelist page.

[0130] Step b: calculating the similarity between the page to be detected and the whitelist page based on the text length and the total text length.

[0131] In one embodiment, after determining the length of the text with the same text content as the whitelist page and the total length of the text of the two pages, the similarity between the page to be detected and the whitelist page can be calculated. The specific formula is as follows:

[0132] S=2×M / T

[0133] Among them, S is the similarity, M is the length of the text with the same content between the page to be detected and the whitelist page, and T is the total length of the text between the page to be detected and the whitelist page.

[0134] Step S30: If the similarity is less than a preset threshold, the whitelist interface is deleted from the whitelist, and vulnerability detection is performed on the interface to be detected.

[0135] In this embodiment, after calculating the similarity between the page to be detected and the whitelist page, the obtained similarity is compared with a preset threshold, wherein the preset threshold is an empirical value, preferably 0.8. If the obtained similarity is less than the preset threshold, it is considered that a logical change has occurred in the interface to be detected, resulting in a large difference between the page to be detected and the whitelist page, and there is a risk of embedding files such as Trojan viruses. Therefore, the original whitelist rules are no longer applicable, so the whitelist interface is deleted from the whitelist, and a vulnerability detection is performed on the interface to be detected that has lost trust to avoid vulnerability attacks.

[0136] If the interface to be detected is detected in this embodiment, it is determined whether there is a whitelist interface matching the interface to be detected in the preset whitelist; if so, the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface are determined, and the similarity between the page to be detected and the whitelist page is calculated; if the similarity is less than a preset threshold, the whitelist interface is deleted from the whitelist, and a vulnerability detection is performed on the interface to be detected. In addition to determining whether the interface to be detected is in the whitelist, the present invention also detects the page to be detected of the interface to be detected, and determines whether the interface to be detected needs to be optimized based on the similarity between the page to be detected and the whitelist page recorded in the whitelist, thereby accurately optimizing the whitelist and realizing intelligent optimization of the whitelist.

[0137] Furthermore, based on the first embodiment of the whitelist optimization method of the present invention, a second embodiment of the whitelist optimization method of the present invention is proposed.

[0138] The second embodiment of the whitelist optimization method is different from the first embodiment of the whitelist optimization method in that step S20 includes:

[0139] Step c, if it exists, determining the page to be detected corresponding to the interface to be detected, and determining the response code of the page to be detected;

[0140] Step d: If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated.

[0141] In this embodiment, since the process of calculating similarity is relatively time-consuming, before performing similarity calculation, it is first determined whether similarity calculation is required through the response code of the page to be detected. This can quickly identify certain special pages to be detected without executing the similarity calculation step, thereby improving the intelligence of whitelist optimization.

[0142] The following is a detailed description of each step:

[0143] Step c: if it exists, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected.

[0144] In this embodiment, if it is determined that there is a whitelist interface in the whitelist that matches the interface to be detected, the page to be detected corresponding to the interface to be detected is obtained, and the response code of the page to be detected is further determined, where the response code refers to the response status of the page, such as a response code of 404 (Not Found) indicating that the server cannot find the requested web page, a response code of 500 indicating (Server Internal Error) indicating that the server encountered an error and could not complete the request, etc.

[0145] Step d: If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated.

[0146] In this embodiment, preset response codes such as 200, 201, 202, 203, 204, 205 and 206 represent successful requests, and other response codes such as 404 and 500 are non-preset response codes. The response code of the page to be detected is compared with the preset response code. If the response code of the page to be detected is the preset response code, the whitelist page corresponding to the whitelist interface is obtained, and the similarity between the page to be detected and the whitelist page is calculated. Prevent whitelist errors caused by network fluctuations and other problems from being removed.

[0147] It is understandable that if the response code of the page to be detected is a non-preset response code, it means that the current page to be detected is not a successful response page. At this time, if the similarity between the page to be detected and the whitelist page is calculated, it is very likely that the two are completely different, thereby making an incorrect judgment on the interface to be detected, and it is meaningless. Therefore, when the response code of the page to be detected is a non-preset response code, it is directly detected for vulnerabilities without calculating the similarity, thereby reducing processing time.

[0148] Further, in another embodiment, step S20 includes:

[0149] Step e, if it exists, determining the page to be detected corresponding to the interface to be detected, and the first running text of the page to be detected, and determining the whitelist page corresponding to the whitelist interface, and the second running text of the whitelist page, wherein the running text refers to the content used to record the processing order of the page;

[0150] In another embodiment, if it is determined that there is a whitelist interface in the whitelist that matches the interface to be detected, the page to be detected corresponding to the interface to be detected and the first running text of the page to be detected are obtained, and the whitelist page corresponding to the whitelist interface and the second running text of the whitelist page are determined, wherein the running text refers to the content used to record the processing order of the page, such as the text content such as the serial number, timestamp and serial number in the page to be detected and the whitelist page.

[0151] Step f: replacing the first running text and the second running text with preset text, and calculating the similarity between the replaced page to be detected and the replaced whitelist page.

[0152] Then, the first running text and the second running text are replaced with preset texts. This is because although the contents of the running texts are inconsistent, they do not affect other contents of the page to be detected and the whitelist page. Instead, they are interference factors in calculating the similarity between the two. Therefore, the first running text and the second running text can be replaced with preset texts. For example, if the date is 03-31, it is replaced with MM-dd to avoid subsequent interference in the calculation of similarity, making the subsequent similarity calculation more accurate.

[0153] Further, in another embodiment, step S20 includes:

[0154] Step g, if it exists, determining the page to be detected corresponding to the interface to be detected, and the first main content of the page to be detected, and determining the whitelist page corresponding to the whitelist interface, and the second main content corresponding to the whitelist page;

[0155] In another embodiment, if it is determined that there is a whitelist interface in the whitelist that matches the interface to be detected, the page to be detected corresponding to the interface to be detected and the first main content of the page to be detected are obtained, and the whitelist page corresponding to the whitelist interface and the second main content of the whitelist page are determined, wherein the main content refers to the body text (main text) of the page to be detected and the whitelist page.

[0156] Step h: calculating the simplified similarity between the first main content and the second main content. If the simplified similarity is greater than a preset value, calculating the similarity between the page to be detected and the whitelist page.

[0157] Then, the simplified similarity between the first main content and the second main content is calculated, wherein the calculation formula of the simplified similarity is as follows:

[0158] S 简 =minB / maxB

[0159] Among them, S 简 is the simplified similarity between the first main content and the second main content, minB is the main content with the shortest length between the first main content and the second main content, and maxB is the main content with the longest length between the first main content and the second main content.

[0160] In addition, a preset value is set, where the preset value is an empirical value, such as 0.8. The simplified similarity is compared with the preset value. If the simplified similarity is greater than the preset value, it means that the two are very likely to be similar. At this time, the similarity between the page to be detected and the whitelist page is calculated; if the simplified similarity is less than or equal to the preset value, it means that the two are not likely to be similar. At this time, there is no need to calculate the similarity between the page to be detected and the whitelist page. The whitelist interface is directly deleted from the whitelist, and vulnerability detection is performed on the interface to be detected.

[0161] In addition, before calculating the similarity between the page to be detected and the whitelist page, the similarity between the title topic of the page to be detected and the topic of the whitelist page can also be calculated. The calculation method is similar to the above-mentioned calculation of simplified similarity, which will not be repeated here.

[0162] In addition, the page to be detected and the whitelist page may be preprocessed, such as removing HTML tags of the page to be detected and the whitelist page, and then calculating the similarity between the page to be detected and the whitelist page.

[0163] Before performing similarity calculation, this embodiment performs pre-processing on the page to be detected and / or the whitelist page, such as calculating simplified similarity, replacing running text, etc., to quickly identify certain special pages to be detected, reduce the necessary degree of similarity calculation, and improve the intelligence of whitelist optimization.

[0164] Furthermore, based on the first embodiment of the whitelist optimization method of the present invention, a second embodiment of the whitelist optimization method of the present invention is proposed.

[0165] The second embodiment of the whitelist optimization method is different from the first embodiment of the whitelist optimization method in that the step of determining the page to be detected corresponding to the interface to be detected includes:

[0166] Step i, sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests;

[0167] Step j, determining whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface;

[0168] Step k: determine the first returned page whose first request time is within the Gaussian distribution range as the target page, and determine the page to be detected corresponding to the interface to be detected based on the target page.

[0169] In order to ensure that a relatively accurate page to be detected can be obtained when calculating the similarity, so that it can be accurately determined whether the logic of the interface to be detected has changed later, this embodiment determines the page to be detected through the Gaussian distribution range of the whitelist interface, thereby improving the stability when calculating the similarity between the page to be detected and the whitelist page.

[0170] The following is a detailed description of each step:

[0171] Step i: sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests.

[0172] In this embodiment, when the interface to be detected is detected, a first preset number of first page requests are sent to the interface to be detected to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests. That is, the optimization device sends multiple page requests to the interface to be detected, and the interface to be detected responds to the multiple page requests and returns multiple pages, wherein the first preset number is an empirical value, which may be selected as 5, etc.

[0173] Step j: determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface.

[0174] In this embodiment, the first request time of each return page is determined, and each first request time is compared with the Gaussian distribution range of the whitelist interface one by one to determine whether the first request time of each first return page is within the Gaussian distribution range, wherein the Gaussian distribution range of the whitelist interface is a request time range with higher stability obtained by prior testing, that is, if the request time of the return page returned by the interface to be detected is within the Gaussian distribution range, then the return page is considered to be stable and can be used as the page to be detected.

[0175] Among them, before this, the whitelist optimization method also includes:

[0176] Step m. Sending a second preset number of second page requests to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page requests;

[0177] In one embodiment, in the process of storing a trusted interface as a whitelist interface in a whitelist, a second preset number of second page requests are sent to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page request, wherein the second preset number is an empirical value. It should be noted that the second preset number is greater than the first preset number. This is to obtain a larger number of return pages to determine the Gaussian distribution range, so that the Gaussian distribution range is reliable.

[0178] Step n, determining the second request time of each of the second return pages, and determining the Gaussian distribution range of the whitelist interface based on the second request time and a preset calculation formula.

[0179] Then, determine the second request time of each second return page, and then preprocess each second request time, such as removing the maximum and minimum values ​​to make the results converge and concentrate, and then determine the Gaussian distribution range of the whitelist interface based on the preprocessed second request time and the preset calculation formula.

[0180] Specifically, the standard deviation of each second request time and the mean of each second request time are calculated, and the Gaussian coefficient is determined, and then the calculated mean, standard deviation and Gaussian coefficient are substituted into the preset calculation formula to obtain the Gaussian distribution range of the whitelist interface.

[0181] The preset calculation formula is:

[0182] Upper boundary of Gaussian distribution range = mean + Gaussian coefficient * standard deviation

[0183] Gaussian distribution range lower boundary = mean - Gaussian coefficient * standard deviation

[0184] Among them, the Gaussian coefficient can be a fixed value of 7 in one embodiment. It should be explained that the Gaussian distribution range is a bell-shaped graph of a normal distribution. 7 standard deviations are selected instead of other values ​​because 7 standard deviations cover more than 99.997% of the area of ​​the bell-shaped graph, that is, the coverage possibility is wider, so that the request time of the return page returned by the whitelist interface falls within the Gaussian distribution range.

[0185] In one embodiment, the Gaussian coefficient is a dynamic value, which fluctuates according to the second preset quantity. Specifically, according to the formula:

[0186] Gaussian coefficient = the second preset number after preprocessing - the second preset number before preprocessing × 1 / 10

[0187] If there are 10 second request times, which are 0.714, 0.726, 0.736, 0.716, 0.71, 0.723, 0.724, 0.725, 0.727, and 0.728, and preprocessing is performed to remove the maximum value 0.736 and the minimum value 0.71, the standard deviation of the remaining 8 data is 0.00481, and the mean is 0.72288. Then the Gaussian coefficient is calculated as 8-10×1 / 10=7, then:

[0188] Gaussian distribution range upper boundary = 0.72288 + 7 * 0.00481 = 0.75655

[0189] Gaussian distribution range lower boundary = 0.72288-7*0.00481 = 0.68921

[0190] At this time, the Gaussian distribution range of the whitelist interface is [0.68921, 0.75655].

[0191] Step k: determine the first returned page whose first request time is within the Gaussian distribution range as the target page, and determine the page to be detected corresponding to the interface to be detected based on the target page.

[0192] In this embodiment, the pre-processed Gaussian distribution ranges of each first request time are compared, and the first return page whose first request time falls within the Gaussian distribution range is determined as the target page. Then, the target page is determined as the page to be detected. It should be noted that if there are multiple first return pages whose first request time falls within the Gaussian distribution range, it means that these return pages are reliable pages, and then a first return page is randomly selected as the page to be detected.

[0193] Furthermore, in one embodiment, the whitelist optimization method further includes:

[0194] If the first request time of each of the first return pages is not within the Gaussian distribution range, the first return page with the latest return time among the first return pages is determined as the page to be detected corresponding to the interface to be detected.

[0195] In one embodiment, if the first request times of the first preset number of first return pages are not within the Gaussian distribution range, that is, the multiple return pages returned by the interface to be detected are all unreliable, then the first return page returned for the last time will be used as the page to be detected to avoid the inability to determine the page to be detected. Since none of them are within the Gaussian distribution range, it means that the returned page is unstable, and selecting the page returned for the last time is closer to the current status of the interface to be detected.

[0196] This embodiment determines the page to be detected through the Gaussian distribution range of the whitelist interface, improves the stability of the page to be detected, ensures that a relatively accurate page to be detected can be obtained when calculating the similarity, and makes it possible to accurately judge whether the logic of the interface to be detected has changed in the subsequent process, thereby realizing intelligent optimization of the whitelist.

[0197] The present invention also provides a whitelist optimization device. The whitelist optimization device of the present invention comprises:

[0198] A detection module, for determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist if an interface to be detected is detected;

[0199] A calculation module, used for determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, if any, and calculating the similarity between the page to be detected and the whitelist page;

[0200] The optimization module is used to delete the whitelist interface from the whitelist if the similarity is less than a preset threshold, and perform vulnerability detection on the interface to be detected.

[0201] Preferably, the calculation module is also used for:

[0202] Determine the length of the text that is the same as the text content of the page to be detected and the whitelist page, and the total length of the text of the page to be detected and the whitelist page;

[0203] Based on the text length and the total text length, the similarity between the page to be detected and the whitelist page is calculated.

[0204] Preferably, the calculation module is also used for:

[0205] Acquire a first text of the page to be detected and a second text of the whitelist page, and determine that the terminal character of the first text is a first character to be matched, and determine that the terminal character of the second text is a second character to be matched;

[0206] Determine whether the first character to be matched is consistent with the second character to be matched;

[0207] If they are consistent, then remove the terminal character from the first text and the second text, determine the removed terminal character as the target character, and continue to perform the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0208] If they are inconsistent, removing the terminal character from the first text or the second text, and performing the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched;

[0209] If all characters of the first text or the second text are matched, a character set corresponding to the target character is obtained, and the character set includes at least one;

[0210] Based on the character set, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0211] Preferably, the calculation module is also used for:

[0212] If the character set is one, counting a first number of target characters in the character set, and determining, based on the first number, a text length of the page to be detected that is identical to the text content of the whitelist page;

[0213] If there are multiple character sets, the character set with the most target characters is determined as the target character set, and the second number of target characters in the target character set is counted. Based on the second number, the text length of the page to be detected that has the same text content as the whitelist page is determined.

[0214] Preferably, the calculation module is also used for:

[0215] If it exists, determine the page to be detected corresponding to the interface to be detected, and the first running text of the page to be detected, and determine the whitelist page corresponding to the whitelist interface, and the second running text of the whitelist page, wherein the running text refers to the content used to record the processing order of the page;

[0216] The first running text and the second running text are replaced with preset texts, and the similarity between the replaced page to be detected and the replaced whitelist page is calculated.

[0217] Preferably, the calculation module is also used for:

[0218] If so, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected;

[0219] If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated.

[0220] Preferably, the calculation module is also used for:

[0221] Sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests;

[0222] Determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface;

[0223] The first returned page whose first request time is within the Gaussian distribution range is determined as a target page, and based on the target page, a page to be detected corresponding to the interface to be detected is determined.

[0224] Preferably, the calculation module is also used for:

[0225] If the first request time of each of the first return pages is not within the Gaussian distribution range, the first return page with the latest return time among the first return pages is determined as the page to be detected corresponding to the interface to be detected.

[0226] Preferably, the calculation module is also used for:

[0227] Sending a second preset number of second page requests to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page requests;

[0228] The second request time of each of the second return pages is determined, and based on the second request time and a preset calculation formula, the Gaussian distribution range of the whitelist interface is determined.

[0229] The present invention also provides a computer-readable storage medium.

[0230] The computer-readable storage medium of the present invention stores a whitelist optimization program, and when the whitelist optimization program is executed by a processor, the steps of the whitelist optimization method described above are implemented.

[0231] Among them, the method implemented when the whitelist optimization program running on the processor is executed can refer to the various embodiments of the whitelist optimization method of the present invention, and will not be repeated here.

[0232] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0233] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0234] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0235] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A whitelist optimization method, characterized in that: The whitelist optimization method comprises the following steps: If an interface to be detected is detected, determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist; If so, determine the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculate the similarity between the page to be detected and the whitelist page; If the similarity is less than a preset threshold, the whitelist interface is deleted from the whitelist, and vulnerability detection is performed on the interface to be detected; Wherein, if it exists, determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page, including: If so, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected; If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated; The determining the page to be detected corresponding to the interface to be detected includes: Sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests; Determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface; The first returned page whose first request time is within the Gaussian distribution range is determined as a target page, and based on the target page, a page to be detected corresponding to the interface to be detected is determined.

2. The whitelist optimization method according to claim 1, characterized in that: The step of calculating the similarity between the page to be detected and the whitelist page comprises: Determine the length of the text that is the same as the text content of the page to be detected and the whitelist page, and the total length of the text of the page to be detected and the whitelist page; Based on the text length and the total text length, the similarity between the page to be detected and the whitelist page is calculated.

3. The whitelist optimization method according to claim 1, characterized in that: The step of determining the text length of the page to be detected that is the same as the text content of the whitelist page comprises: Acquire a first text of the page to be detected and a second text of the whitelist page, and determine that the terminal character of the first text is a first character to be matched, and determine that the terminal character of the second text is a second character to be matched; Determine whether the first character to be matched is consistent with the second character to be matched; If they are consistent, then remove the terminal character from the first text and the second text, determine the removed terminal character as the target character, and continue to perform the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched; If they are inconsistent, removing the terminal character from the first text or the second text, and performing the steps of determining the terminal character of the first text as the first character to be matched, and determining the terminal character of the second text as the second character to be matched; If all characters of the first text or the second text are matched, a character set corresponding to the target character is obtained, and the character set includes at least one; Based on the character set, the text length of the page to be detected that has the same text content as the whitelist page is determined.

4. The whitelist optimization method according to claim 3, characterized in that: The step of determining, based on the character set, the length of the text of the page to be detected that is identical to the text of the whitelist page comprises: If the character set is one, counting a first number of target characters in the character set, and determining, based on the first number, a text length of the page to be detected that is identical to the text content of the whitelist page; If there are multiple character sets, the character set with the most target characters is determined as the target character set, and the second number of target characters in the target character set is counted. Based on the second number, the text length of the page to be detected that has the same text content as the whitelist page is determined.

5. The whitelist optimization method according to claim 1, characterized in that: If so, the step of determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page includes: If it exists, determine the page to be detected corresponding to the interface to be detected, and the first running text of the page to be detected, and determine the whitelist page corresponding to the whitelist interface, and the second running text of the whitelist page, wherein the running text refers to the content used to record the processing order of the page; The first running text and the second running text are replaced with preset texts, and the similarity between the replaced page to be detected and the replaced whitelist page is calculated.

6. The whitelist optimization method according to claim 1, characterized in that: After the step of determining whether the first request time of each first return page is within the Gaussian distribution range of the whitelist interface, the whitelist optimization method further includes: If the first request time of each of the first return pages is not within the Gaussian distribution range, the first return page with the latest return time among the first return pages is determined as the page to be detected corresponding to the interface to be detected.

7. The whitelist optimization method according to claim 1, characterized in that: Before the step of determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist if the interface to be detected is detected, the whitelist optimization method further includes: Sending a second preset number of second page requests to the whitelist interface to obtain a second preset number of second return pages returned by the whitelist interface based on the second page requests; The second request time of each of the second return pages is determined, and based on the second request time and a preset calculation formula, the Gaussian distribution range of the whitelist interface is determined.

8. A whitelist optimization device, characterized in that: The whitelist optimization device comprises: A detection module, for determining whether there is a whitelist interface matching the interface to be detected in a preset whitelist if an interface to be detected is detected; A calculation module, used for determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, if any, and calculating the similarity between the page to be detected and the whitelist page; An optimization module, configured to delete the whitelist interface from the whitelist if the similarity is less than a preset threshold, and perform vulnerability detection on the interface to be detected; If so, determining the page to be detected corresponding to the interface to be detected and the whitelist page corresponding to the whitelist interface, and calculating the similarity between the page to be detected and the whitelist page, including: If so, determine the page to be detected corresponding to the interface to be detected, and determine the response code of the page to be detected; If the response code is a preset response code, a whitelist page corresponding to the whitelist interface is determined, and a similarity between the page to be detected and the whitelist page is calculated; The determining the page to be detected corresponding to the interface to be detected includes: Sending a first preset number of first page requests to the interface to be detected, so as to obtain a first preset number of first return pages returned by the interface to be detected based on the first page requests; Determine whether the first request time of each of the first return pages is within the Gaussian distribution range of the whitelist interface; The first returned page whose first request time is within the Gaussian distribution range is determined as a target page, and based on the target page, a page to be detected corresponding to the interface to be detected is determined.

9. A whitelist optimization device, characterized in that: The whitelist optimization device comprises: a memory, a processor, and a whitelist optimization program stored in the memory and executable on the processor, wherein the whitelist optimization program implements the steps of the whitelist optimization method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a whitelist optimization program, and when the whitelist optimization program is executed by a processor, the steps of the whitelist optimization method according to any one of claims 1 to 7 are implemented.

Images