A method, device, electronic device and medium for protecting website data

Abstract

The present application discloses a method, device, electronic device and medium for protecting website data, mainly relating to the field of data protection. The method first executes a preset code to hijack the target function to obtain a rewrite function, and the target function is used to call the webrtc protocol for communication; then, when the rewrite function is called by the website, the attribute information of the website is obtained through the preset code, and the attribute information includes the domain name and address of the website; then it is judged whether the domain name of the website is in the blacklist; if it is in the blacklist, the website is blocked from calling the rewrite function. The method can accurately capture whether the webrtc protocol is used by dynamically calling the rewrite function, and then judge whether the website abuses the webrtc protocol by whether the domain name of the website is in the blacklist. When the domain name of the website is in the blacklist, the website is blocked from calling the rewrite function, which can efficiently and accurately block the abuse of the webrtc protocol, and effectively solve the problem of abusing the webrtc protocol to steal user privacy.

Description

Technical Field

[0001] The present application relates to the field of data protection, and in particular to a method, device, electronic device, and medium for protecting website data. Background Art

[0002] With the development of Hypertext Markup Language (HTML) technology, more and more protocols have been introduced into the HTML5 standard, resulting in richer content and more powerful functionality in browser dialog boxes. To enable peer-to-peer audio and video communication, the WebRTC protocol was introduced into browsers. Two browser users can establish peer-to-peer communication with a third-party server using the WebRTC protocol. Because this communication is peer-to-peer and WebRTC's underlying protocol is the User Datagram Protocol (UDP), browser proxy settings cannot override the WebRTC protocol, and the network tag in browser debugging cannot capture related traffic. Furthermore, some newer defense strategies, such as Content Security Policy (CSP), can be bypassed by the WebRTC protocol. The numerous risks posed by the WebRTC protocol can easily lead to data breaches, and the threat to professional users should not be underestimated.

[0003] Currently, devices like the Sangfor Internet Behavior Management System detect and match keywords on web pages visited by users at the traffic level. If a webpage is found to be abusing the WebRTC protocol to steal user privacy, access is blocked. This current approach performs static analysis on webpages visited by users, but because static analysis is easily evaded, it can fail to detect the misuse of the WebRTC protocol to steal user privacy.

[0004] It can be seen that how to solve the problem of abusing the webrtc protocol to steal user privacy is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a method, device, electronic device and medium for protecting website data, which can efficiently and accurately block the abuse of the WebRTC protocol and solve the problem of abusing the WebRTC protocol to steal user privacy.

[0006] To solve the above technical problems, this application provides a method for protecting website data, including:

[0007] Execute the preset code to hijack the target function to get the rewritten function. The target function is used to call the webrtc protocol for communication;

[0008] When the rewritten function is called by the website, the attribute information of the website is obtained through the preset code, and the attribute information includes the domain name and address of the website;

[0009] Determine whether the website's domain name is on the blacklist;

[0010] If it is in the blacklist, the website is blocked from calling the rewrite function.

[0011] Preferably, before determining whether the domain name of the website is in the blacklist, the method further includes:

[0012] Determine whether the website's domain name is in the whitelist;

[0013] If it is in the whitelist, the website is allowed to call the rewrite function.

[0014] Preferably, if the domain name is neither in the blacklist nor in the whitelist, the following is further included:

[0015] Call the threat intelligence interface to determine whether the website's attribute information is threat intelligence;

[0016] If it is threat intelligence, the website is blocked from calling the rewrite function; otherwise, the call is allowed.

[0017] Preferably, it also includes:

[0018] The domain names in the blacklist and the domain names that are neither in the blacklist nor in the whitelist are reported to the management server, which is used to perform data determination and manual analysis on the domain names.

[0019] Preferably, the whitelist and the blacklist are lists issued by the management server.

[0020] Preferably, it also includes:

[0021] Use the data exchange format Json to communicate with the management server.

[0022] Preferably, if the domain name of the website is on a blacklist, an alert is issued.

[0023] To solve the above technical problems, the present application also provides a device for protecting website data, comprising:

[0024] The execution module is used to execute the preset code to hijack the target function to obtain the rewritten function. The target function is used to call the webrtc protocol for communication;

[0025] An acquisition module, used to acquire the attribute information of the website through a preset code when the rewriting function is called by the website, the attribute information including the domain name and address of the website;

[0026] A judgment module is used to determine whether the website's domain name is in the blacklist;

[0027] The blocking module is used to block the website from calling the rewrite function when the website's domain name is in the blacklist.

[0028] To solve the above technical problems, the present application further provides an electronic device, comprising:

[0029] memory for storing computer programs;

[0030] A processor is used to implement the steps of the above-mentioned method for protecting website data when executing a computer program.

[0031] To solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method for protecting website data are implemented.

[0032] This application proposes a method for protecting website data, including first executing a preset code to hijack a target function to obtain a rewrite function, the target function is used to call the webrtc protocol for communication; then, when the rewrite function is called by the website, the preset code is used to obtain the website's attribute information, the attribute information including the website's domain name and address; then, it is determined whether the website's domain name is on the blacklist; if it is on the blacklist, the website is blocked from calling the rewrite function. This method can accurately capture whether the webrtc protocol is used by dynamically calling the rewrite function, and then determine whether the website abuses the webrtc protocol by whether the website's domain name is on the blacklist. When the website's domain name is on the blacklist, the website is blocked from calling the rewrite function, thereby blocking the website from calling the webrtc protocol. It can efficiently and accurately block the abuse of the webrtc protocol, effectively solving the problem of abusing the webrtc protocol to steal user privacy.

[0033] In addition, the device, electronic device, and medium for protecting website data provided in this application correspond to the method for protecting website data, and the effects are as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0035] Figure 1 A flowchart of a method for protecting website data provided by this application;

[0036] Figure 2 A structural diagram of a device for protecting website data provided by this application;

[0037] Figure 3 This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0038] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0039] The core of this application is to provide a method for protecting website data, which can efficiently and accurately block the abuse of the WebRTC protocol and effectively solve the problem of abusing the WebRTC protocol to steal user privacy.

[0040] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0041] Figure 1 This is a flowchart of a method for protecting website data provided by this application. Figure 1 As shown, the method includes:

[0042] S1: Execute the preset code to hijack the target function to obtain the rewritten function. The target function is used to call the webrtc protocol for communication.

[0043] There are multiple tags in the HTML page, among which the tag that can dynamically execute code is the script tag. The script tag can execute JavaScript code in the page. The JavaScript code can render the browser page for the user and dynamically process, obtain, and update data. Before executing the JavaScript code, this embodiment injects and executes a preset code to hijack the target function through the browser plug-in. When the WebRTC protocol is in use, it is necessary to use the target function to initialize the real-time communication (RTC) object, and then further call the method in the RTC object to realize the communication of the WebRTC protocol link. In this embodiment, the target function is hijacked by executing the preset code to rewrite it to obtain the rewrite function. When a website initializes the RTC object, it can be captured whether the website calls the WebRTC protocol by sensing whether the rewrite function is called. It should be noted that the target function in this embodiment is the window.RTCPeerConnection function, but it is not limited to this in the specific implementation. This embodiment does not limit the type of target function.

[0044] S2: When the rewriting function is called by the website, the attribute information of the website is obtained through the preset code, and the attribute information includes the domain name and address of the website.

[0045] In this embodiment, when the rewrite function is called by a website, a preset code is used to obtain attribute information of the website currently executing the rewrite function, facilitating a subsequent determination based on the website's attribute information whether the website is permitted to call the rewrite function. It should be noted that the attribute information includes the website's domain name and address. The determination of whether the website is permitted to call the rewrite function based on the website's domain name and address is not limited to the determination based on the website's domain name and address in specific implementations. Other information, such as the website's program, may also be used to determine whether the website is permitted to call the rewrite function. This embodiment does not impose any limitations on this.

[0046] S3: Determine whether the website's domain name is in the blacklist.

[0047] In this embodiment, the data in the blacklist is derived from data accumulation and threat intelligence, and the hosts in the threat intelligence will be directly included in the blacklist to prevent them from establishing a communication tunnel with the browser.

[0048] S4: If it is in the blacklist, the website is blocked from calling the rewrite function.

[0049] In this embodiment, if the domain name of the website is in the blacklist, it means that the website is maliciously using the rewrite function to call the webrtc protocol, so the website will be blocked from calling the rewrite function.

[0050] This embodiment proposes a method for protecting website data, including first executing preset code to hijack the target function to obtain a rewrite function, the target function is used to call the webrtc protocol for communication; then, when the rewrite function is called by the website, the preset code is used to obtain the website's attribute information, the attribute information including the website's domain name and address; then, it is determined whether the website's domain name is on the blacklist; if it is on the blacklist, the website is blocked from calling the rewrite function. This method can accurately capture whether the webrtc protocol is used by dynamically calling the rewrite function, and then determine whether the website abuses the webrtc protocol by whether the website's domain name is on the blacklist. When the website's domain name is on the blacklist, it indicates that the website abuses the webrtc protocol. At this time, the website will be blocked from calling the rewrite function, thereby preventing the website from calling the webrtc protocol. This method can efficiently and accurately block the abuse of the webrtc protocol, effectively solving the problem of abusing the webrtc protocol to steal user privacy.

[0051] Before determining whether the website's domain name is in the blacklist in the above embodiment, it is necessary to first determine whether the website's domain name is in the whitelist. This step includes:

[0052] Determine whether the website's domain name is in the whitelist;

[0053] If it is in the whitelist, the website is allowed to call the rewrite function.

[0054] In this embodiment, the data in the whitelist comes from data accumulation. If the domain name of the website is in the whitelist, it means that the website is not maliciously calling the webrtc protocol, so the website is allowed to call the rewrite function. If the domain name of the website is not in the whitelist, it is further determined whether the domain name of the website is in the blacklist to determine whether the website is allowed to call the rewrite function.

[0055] This embodiment supplements the situation where a website is allowed to call the rewrite function. It determines whether the website's domain name is in the whitelist. If it is in the whitelist, the website is allowed to call the rewrite function. There is no need to determine whether the domain name is in the blacklist, which simplifies the operation steps.

[0056] The above embodiment determines whether to allow the rewrite function to be called based on whether the domain name is in the blacklist or whitelist. If the domain name is neither in the blacklist nor in the whitelist, further determination of the website's attribute information is required. This step includes:

[0057] Call the threat intelligence interface to determine whether the website's attribute information is threat intelligence;

[0058] If it is threat intelligence, the website is blocked from calling the rewrite function; otherwise, the call is allowed.

[0059] In this embodiment, since the data in the blacklist comes from threat intelligence, it is not enough to just determine whether the domain name of the website is threat intelligence. It is necessary to comprehensively judge whether to allow the website to call the rewrite function based on the attribute information of the website.

[0060] This embodiment illustrates the situation where the domain name is neither in the blacklist nor in the whitelist. When it is determined that the domain name of the website is neither in the blacklist nor in the whitelist, the threat intelligence interface is called to obtain threat intelligence, and it is determined whether the attribute information of the website is threat intelligence. When the attribute information of the website is threat intelligence, the website is blocked from calling the rewrite function; otherwise, the website is allowed to call the rewrite function, so as to determine whether the website whose domain name is neither in the blacklist nor in the whitelist is allowed to call the rewrite function.

[0061] After the above embodiment completes the domain name determination, this embodiment reports the domain name of the maliciously called website to the management server for unified management and processing. This step includes:

[0062] The domain names in the blacklist and the domain names that are neither in the blacklist nor in the whitelist are reported to the management server, which is used to perform data determination and manual analysis on the domain names.

[0063] In this embodiment, since it is impossible to directly judge a domain name that is neither in the blacklist nor in the whitelist, when reporting a domain name that is determined to be in the blacklist, it is also necessary to report a domain name that is neither in the blacklist nor in the whitelist so that the management server can make a judgment and analysis on it. In addition, the management server will receive the reported domain name and determine whether the website corresponding to the domain name is a malicious call to webrtc by performing data judgment and manual analysis on the domain name. If it is determined that it is a malicious call to webrtc, the management server will add the domain name to the blacklist to update the data in the blacklist; if it is determined that it is not a malicious call to webrtc, the management server will determine whether the website corresponding to the domain name can provide services normally through regular audio and video website collection. If it can provide services normally, the domain name will be added to the whitelist to update the data in the whitelist.

[0064] This embodiment reports the domain names that are determined to be in the blacklist and the domain names that are neither in the blacklist nor in the whitelist to the management server so that the management server can uniformly manage and process them. After the management server receives the reported domain names, it updates the blacklist and whitelist by performing data judgment and manual analysis on the reported domain names.

[0065] In the above embodiment, it is mentioned that the blacklist and whitelist are derived from data accumulation. The management server needs to perform data judgment and manual analysis on the reported domain names to update the blacklist and whitelist. Based on this, this embodiment defines the whitelist and blacklist used for judgment in the above embodiment. In this embodiment, the whitelist and blacklist are lists issued by the management server.

[0066] This embodiment limits the whitelist and blacklist used for judgment in the above embodiments to the lists issued by the management server, ensuring that the whitelist and blacklist used for judgment are the latest lists updated by the management server, and effectively guarantees the accuracy of judging whether the website is allowed to call the rewrite function based on whether the website's domain name is in the whitelist or blacklist.

[0067] In the above embodiment, it is mentioned that receiving the blacklist and whitelist and reporting the domain name both require communication with the management server. Since the above embodiment does not explain the method of communicating with the management server, this embodiment provides a supplementary explanation. This step includes:

[0068] Use the data exchange format Json to communicate with the management server.

[0069] Table 1 is a classification table of common data formats used in this application, and Table 2 is a table defining the data formats in the whitelist and blacklist. This embodiment uses the lightweight data exchange format JSON to communicate with the management server. As shown in Table 1, this embodiment reports website domain names as strings. As shown in Table 2, the data in the whitelist and blacklist is in array form, specifically as strings. Because the data format in the whitelist and blacklist is consistent with the data format used for management server communication (both strings), after the management server performs data judgment and manual analysis on the reported domain names, the domain names can be directly added to the corresponding lists based on the analysis results.

[0070] Table 1 Common data format classification table

[0071]

[0072] Table 2 Definition of data formats in whitelist and blacklist

[0073]

[0074] This embodiment provides additional explanation on the communication method with the management server, and uses the lightweight data exchange format Json to communicate with the management server, which effectively improves the data transmission rate.

[0075] In the above embodiment, it is mentioned that whether the website is allowed to call the rewrite function is determined based on whether the website's domain name is in the blacklist. In this embodiment, an alarm is issued after it is determined that the website's domain name is in the blacklist.

[0076] This embodiment provides additional explanation for the situation when the domain name of a website is in the blacklist. If the domain name of a website is in the blacklist, an alarm is issued to remind the user that a website has maliciously called the WebRTC protocol.

[0077] In the above embodiments, a method for protecting website data is described in detail. This application also provides corresponding embodiments of an apparatus for protecting website data. It should be noted that this application describes the embodiments of the apparatus from two perspectives: one is based on the functional module perspective, and the other is based on the hardware perspective.

[0078] Figure 2 This is a structural diagram of a device for protecting website data provided by this application. Figure 2 As shown, the device includes:

[0079] An execution module 10 is used to execute a preset code to hijack a target function to obtain a rewritten function, where the target function is used to call the WebRTC protocol for communication;

[0080] The acquisition module 11 is used to acquire the attribute information of the website through a preset code when the rewriting function is called by the website, the attribute information including the domain name and address of the website;

[0081] The judging module 12 is used to judge whether the domain name of the website is in the blacklist;

[0082] The blocking module 13 is used to block the website from calling the rewrite function when the domain name of the website is in the blacklist.

[0083] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, and they will not be repeated here.

[0084] Figure 3 This is a structural diagram of an electronic device provided in another embodiment of the present application, such as Figure 3 As shown, the electronic device includes: a memory 20 for storing computer programs;

[0085] The processor 21 is configured to implement the steps of the method for protecting website data as mentioned in the above embodiment when executing a computer program.

[0086] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0087] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0088] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the method for protecting website data disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include but is not limited to the attribute information of the website, etc.

[0089] In some embodiments, the electronic device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power supply 25 , and a communication bus 26 .

[0090] Those skilled in the art will understand that Figure 3 The structure shown in the figure does not constitute a limitation of the electronic device, and may include more or fewer components than shown in the figure.

[0091] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for protecting website data as described in the above method embodiment.

[0092] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and executes all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0093] The above is a detailed introduction to the method, device, electronic device and medium for protecting website data provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0094] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A method for protecting website data, characterized in that: include: Execute the preset code to hijack the target function to obtain a rewritten function, wherein the target function is used to call the WebRTC protocol for communication; wherein, when the WebRTC protocol is used, the target function is first used to initialize the real-time communication object, and then the method in the real-time communication object is called to implement the communication of the WebRTC protocol link; When a website initializes the real-time communication object, determining that the rewriting function is called by the website, and obtaining attribute information of the website through the preset code, the attribute information including the domain name and address of the website; Determining whether the domain name of the website is in a blacklist; If it is in the blacklist, blocking the website from calling the rewrite function; Before determining whether the domain name of the website is in the blacklist, the method further includes: Determining whether the domain name of the website is in a whitelist; If it is in the whitelist, the website is allowed to call the rewrite function; If the domain name is neither in the blacklist nor in the whitelist, the threat intelligence interface is called to determine whether the attribute information of the website is the threat intelligence; if it is the threat intelligence, the website is blocked from calling the rewrite function, otherwise the call is allowed.

2. The method for protecting website data according to claim 1, characterized in that: Also includes: The domain names in the blacklist and the domain names that are neither in the blacklist nor in the whitelist are reported to a management server, and the management server is used to perform data determination and manual analysis on the domain names.

3. The method for protecting website data according to claim 2, characterized in that: The whitelist and the blacklist are lists issued by the management server.

4. The method for protecting website data according to claim 2, characterized in that: Also includes: The data exchange format Json is used to communicate with the management server.

5. The method for protecting website data according to claim 1, characterized in that: If the domain name of the website is in the blacklist, an alarm is issued.

6. A device for protecting website data, characterized in that: include: An execution module is configured to execute a preset code to hijack a target function to obtain a rewritten function, wherein the target function is used to call the WebRTC protocol for communication; wherein, when the WebRTC protocol is used, the target function is first used to initialize a real-time communication object, and then a method in the real-time communication object is called to implement communication of the WebRTC protocol link; an acquisition module, configured to, when a website initializes the real-time communication object, determine that the rewrite function is called by the website, and acquire attribute information of the website through the preset code, the attribute information including the domain name and address of the website; a judgment module, configured to judge whether the domain name of the website is in a blacklist; before judging whether the domain name of the website is in a blacklist, judge whether the domain name of the website is in a whitelist; if it is in the whitelist, allow the website to call the rewrite function; if the domain name is neither in the blacklist nor in the whitelist, call the threat intelligence interface to judge whether the attribute information of the website is the threat intelligence; if it is the threat intelligence, block the website from calling the rewrite function; otherwise, allow the call; A blocking module is used to block the website from calling the rewrite function when the domain name of the website is in the blacklist.

7. An electronic device, characterized in that: including a memory for storing a computer program; A processor, configured to implement the steps of the method for protecting website data according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for protecting website data according to any one of claims 1 to 5.

Images