A method for distinguishing violation event categories based on JavaScript scripts

Abstract

The present invention proposes a method for distinguishing the categories of violation events based on JavaScript scripts, running JavaScript scripts on the browser of a terminal device, and analyzing using JavaScript running logic to achieve category judgment of violation events. When a user accesses any application system or http-like file on a terminal device, the terminal device browser automatically initiates access to an external alarm service system through the injected JavaScript, and the external alarm service system provides different http interfaces and received parameters to judge the type of violation event. Once the external alarm service system is able to receive these accesses, it not only indicates that the terminal device has a violation event, but also can judge the specific event type. The user can initiate emergency measures according to the event type to avoid leakage of important information and strengthen the security of intranet information.

Description

[Technical field]

[0001] The present invention relates to the technical field of network information security, and in particular to a method for distinguishing illegal event categories based on JavaScript scripts. [Background technology]

[0002] The rapid development of Internet information has brought convenience and speed to people's lives, but with the continuous deepening of information development, the security challenges faced by the intranets of government agencies and enterprises and institutions are becoming more and more severe. According to the statistics of security incidents in recent years, various illegal access, illegal interconnection, information leakage and other behaviors on the intranet have become more and more serious, which has buried many security risks, especially the direct connection between the intranet and the intranet. In serious cases, it may even cause the intranet to be directly invaded and destroyed by Internet hackers, foreign intelligence agencies, etc., causing irreversible harm. At present, there are many methods in the industry to automatically detect the interconnection behavior of terminal devices between the intranet and the intranet, but for specific violations, they cannot distinguish the types of violations well, nor can they judge the severity of violations. In order to solve the above problems and strengthen network information security, it is necessary to propose a method that can automatically analyze and determine the category of terminal equipment's intranet and intranet interconnection behavior. [Summary of the invention]

[0003] The purpose of the present invention is to solve the problems in the prior art and to propose a method for distinguishing the categories of violation events based on JavaScript scripts, which aims to accurately determine the types of various network boundary violation events and facilitate the qualitative management and disposal of violation events.

[0004] To achieve the above purpose, the present invention proposes a method for distinguishing the categories of violation events based on JavaScript scripts. The JavaScript script is run on the browser of the terminal device, and the JavaScript running logic is used for analysis to realize the category judgment of the violation events. The specific steps are as follows:

[0005] S1. The end user uses a browser to open the intranet system page or a locally saved HTML-like file. The browser will load the JavaScript script injected by the gateway device or saved locally.

[0006] S2. Use the protocol property of the JavaScript script window.location object to determine the document protocol type. If it is a file protocol, proceed to step S3; if not, proceed to step S4;

[0007] S3. Use Ajax technology or http script tags to automatically initiate access to the http interface provided by the external alarm service system, and use whether the external alarm service system can receive the requested data as the basis for judgment. If it can receive the data, it is judged that the event is a web page leakage; if not, it is judged that it is not a violation event.

[0008] S4. Use Ajax technology or http script tags to automatically initiate access to the http interface provided by the external alarm service system. If the external alarm service system can be accessed, it means that the external network can be connected. At the same time, this page is not a file protocol, that is, an http protocol. From the side, it shows that the content page is obtained by accessing the web system through the intranet, and it is connected to the intranet. It is determined that the event is directly connected to the internal and external networks; if it cannot be accessed, it proceeds to step S5;

[0009] S5. Use the setInterval() method in the JavaScript script to configure the extended timer task, and perform access to the external network at a certain interval. If the access is unsuccessful, it will enter the next cycle to perform access to the external network again; if the access is successful, it will proceed to step S6;

[0010] S6. Use the JavaScript script window.location object to obtain the intranet access address, and use Ajax technology to automatically initiate an asynchronous access request to the intranet address. If the access is successful, it means that the terminal is connected to the intranet and the intranet at the same time, and the event is judged to be a direct connection between the intranet and the intranet; if not, it means that the terminal is only connected to the external network at this time, and the event is judged to be an unauthorized external connection.

[0011] Preferably, in step S1, if the intranet application system is accessed, the browser runs the JavaScript script injected by the gateway device; if a locally saved HTML-like file is opened, the browser runs the JavaScript script saved locally together with the HTML-like file.

[0012] Preferably, the specific steps of step S3 are: the JavaScript script utilizes the browser's built-in objects, OCX plug-ins, and WebRTC interfaces to obtain key information such as the time of event occurrence, terminal IP, MAC, and then utilizes Ajax technology or http's script tag to dynamically construct access to the receiving interface of the web page leakage event of the external alarm server. If the browser's access to the receiving interface of the web page leakage event of the external alarm service system is successful, it can be determined that the event is a web page leakage.

[0013] Preferably, in step S3, when the browser disables Ajax, the JavaScript script will dynamically create a script tag for the page, and this step is completed by assigning a value to the src attribute of the script as the http interface address provided by the external alarm service system.

[0014] Preferably, the specific steps of step S4 are: using window.location.protocol to obtain the protocol type, if it is http(s) type, it is considered that the behavior may be a direct connection between the internal and external networks or an unauthorized external connection, and then the JavaScript script uses the browser's built-in objects, OCX plug-ins, and WebRTC interfaces to obtain key information such as the event occurrence time, terminal IP, MAC, and then uses Ajax technology or http's script tag to dynamically build access to the receiving interface of the direct connection between the internal and external networks of the external alarm server. If the access is successful, it can be determined that the event is a direct connection between the internal and external networks; if the access is unsuccessful, proceed to the next step S5.

[0015] Preferably, in step S5, the JavaScript script uses a timer to construct a delayed timed access to the receiving interface of the unauthorized external connection of the external connection alarm server, and once a successful access occurs, the next step S6 is entered.

[0016] Preferably, an external alarm service system is deployed on the external network, and http data receiving interfaces of different event types are provided to receive http requests for violation events, wherein the violation events include web page leakage, direct connection between internal and external networks, and unauthorized external connection.

[0017] Beneficial effects of the present invention: Compared with the prior art, the present invention can not only detect illegal events, but also effectively distinguish the nature and category of the events. The present invention provides a method for distinguishing the categories of illegal events based on JavaScript scripts, which relies on JavaScript and web front-end technology to analyze and judge the categories of various illegal events and clarify the nature and type of specific illegal events. It is based on running JavaScript scripts on the browser of the terminal device, using the identification of protocol types, immediate judgment and delayed judgment of the internal and external network connections, to conduct comprehensive analysis and judgment, and to distinguish the categories of illegal events.

[0018] The features and advantages of the present invention will be described in detail through embodiments in conjunction with the accompanying drawings.

Brief Description of the Drawings

[0019] Figure 1 The present invention is a flowchart of a method for distinguishing the categories of illegal events based on JavaScript scripts. [Specific implementation method]

[0020] See also Figure 1 , an embodiment of the present invention provides a method for distinguishing the categories of violation events based on JavaScript scripts, and the specific steps are as follows:

[0021] Step 1: First, you need to deploy an external alarm service on the external network and provide HTTP data receiving interfaces of different event types to receive specific information of three types of violation events (web page leakage, direct connection between internal and external networks, and unauthorized external connection).

[0022] Step 2: The user accesses the application system or HTML-like file through a browser on the terminal device.

[0023] Step 3: If the intranet application system is accessed, the browser runs the JavaScript script injected by the gateway device; if the HTML-like file saved locally is opened, the browser runs the JavaScript script saved locally together with the HTML-like file.

[0024] Step 4: Use window.location.protocol to obtain the protocol type. If it is a file type, consider the possibility of a webpage leakage event. Then the JavaScript script uses the browser's built-in objects, OCX plug-ins, and WebRTC interfaces to obtain key information such as the time of the event, terminal IP, MAC, and then uses Ajax technology or http's script tag to dynamically build access to the receiving interface of the webpage leakage event of the external alarm server. It should be noted here that considering the security of the external alarm server itself, access to the interface through Ajax is not a complete cross-domain access. If the browser can successfully access the receiving interface of the webpage leakage event of the external alarm service system, it can be determined that the event is a webpage leakage.

[0025] Step 5: Use window.location.protocol to obtain the protocol type. If it is http(s), it is considered that the behavior may be a direct connection between the internal and external networks or an unauthorized external connection. Then the JavaScript script uses the browser's built-in objects, OCX plug-ins, and WebRTC interfaces to obtain key information such as the time of event occurrence, terminal IP, MAC, and then uses Ajax technology or http's script tag to dynamically build access to the receiving interface of the external alarm server's direct connection between the internal and external networks. If the access is successful, it can be determined that the event is a direct connection between the internal and external networks; if the access is unsuccessful, proceed to step 6.

[0026] Step 6: The logic of this step is similar to step 5. Due to the event characteristics of unauthorized external connections, the JavaScript script uses a timer to build a delayed timed access to the receiving interface of the unauthorized external connection of the external connection alarm server. As long as a successful access occurs, it will enter step 7.

[0027] Step 7: Use the JavaScript script window.location object to obtain the intranet access address, and use Ajax technology to automatically initiate an asynchronous access request to the intranet address. If the access is successful, it means that the terminal is connected to both the intranet and the intranet at the same time, and the event can be judged as a direct connection between the intranet and the intranet; if not, it means that the terminal is only connected to the external network at this time, and the event can be judged as an unauthorized external connection.

[0028] The present invention provides a method for distinguishing the categories of illegal events based on JavaScript scripts. When a user accesses any application system or a class http file in a terminal device, the terminal device browser automatically initiates access to an external alarm service system through the injected JavaScript. The external alarm service system provides different http interfaces and received parameters to judge the type of illegal events. Once the external alarm service system can receive these accesses, it not only indicates that the terminal device has illegal events, but also can judge the specific event type. The user can initiate emergency measures according to the event type to avoid leakage of important information, thereby strengthening the information security of the intranet.

[0029] The above embodiments are intended to illustrate the present invention, not to limit the present invention. Any solution that is a simple transformation of the present invention belongs to the protection scope of the present invention.

Claims

1. A method for distinguishing the categories of illegal events based on JavaScript scripts, characterized in that: Run JavaScript scripts on the browser of the terminal device, use JavaScript running logic to analyze, and classify the violation events. The specific steps are as follows: S1. The end user uses a browser to open the intranet system page or a locally saved HTML-like file. The browser will load the JavaScript script injected by the gateway device or saved locally. In step S1, if the intranet application system is accessed, the browser runs the JavaScript script injected by the gateway device; If you open a locally saved HTML-like file, the browser runs the JavaScript script that is saved locally along with the HTML-like file; S2. Use the protocol property of the JavaScript script window.location object to determine whether the protocol type is a file protocol. If it is a file protocol, proceed to step S3; if not, proceed to step S4; S3. Use Ajax technology or http script tags to automatically initiate access to the http interface provided by the external alarm service system, and use whether the external alarm service system can receive the requested data as a basis for judgment. If it can receive the data, it is judged that the event is a web page leak; if not, it is judged that it is not a violation event; The specific steps of step S3 are: the JavaScript script uses the browser built-in object, OCX plug-in and WebRTC interface to obtain the event occurrence time, terminal IP and MAC information, and then uses Ajax technology or http script tags to dynamically build access to the receiving interface of the web page leakage event of the external alarm server. If the browser successfully accesses the receiving interface of the web page leakage event of the external alarm service system, it is determined that the event is a web page leakage; S4. Use Ajax technology or http script tag to automatically initiate access to the http interface provided by the external alarm service system. If you can access the external alarm service system, it is determined that the event is directly connected to the internal and external networks; if you cannot access it, proceed to step S5; The specific steps of step S4 are: using window.location.protocol to obtain the protocol type, if it is http(s) type, it is considered that the event is a direct connection between the internal and external networks or an unauthorized external connection, then the JavaScript script uses the browser built-in object, OCX plug-in and WebRTC interface to obtain the event occurrence time, terminal IP and MAC information, and then uses Ajax technology or http script tags to dynamically build access to the receiving interface of the direct connection between the internal and external networks of the external alarm server. If the access is successful, it is determined that the event is a direct connection between the internal and external networks; if the access is unsuccessful, it proceeds to the next step S5; S5. Use the setInterval() method in the JavaScript script to configure the extended timer task, and perform access to the external network at a certain interval. If the access is unsuccessful, it will enter the next cycle to perform access to the external network again; if the access is successful, it will proceed to step S6; S6. Use the JavaScript script window.location object to obtain the intranet access address, and use Ajax technology to automatically initiate an asynchronous access request to the intranet access address. If the access is successful, it means that the terminal is connected to the intranet and the intranet at the same time, and the event is judged to be a direct connection between the intranet and the intranet; if not, it means that the terminal is only connected to the external network at this time, and the event is judged to be an unauthorized external connection.

2. A method for distinguishing the categories of illegal events based on JavaScript scripts as claimed in claim 1, characterized in that: In step S3, when the browser disables Ajax, the JavaScript script will dynamically create a script tag for the page, and this step is completed by assigning the src attribute of the script to the http interface address provided by the external alarm service system.

3. The method for distinguishing the categories of illegal events based on JavaScript scripts as claimed in claim 1, characterized in that: In step S5, the JavaScript script uses a timer to construct a delayed timed access to the unauthorized external connection receiving interface of the external connection alarm server. As long as a successful access occurs, the next step S6 is entered.

4. The method for distinguishing the categories of illegal events based on JavaScript scripts as claimed in claim 1, characterized in that: An external alarm service system is deployed on the external network, and HTTP data receiving interfaces of different event types are provided to receive HTTP requests for violation events, including web page leakage, direct connection between the internal and external networks, and unauthorized external connection.

Images