Clone website detection method, device, electronic device and storage medium

Abstract

The present invention provides a method, apparatus, electronic device, and storage medium for detecting cloned websites. The method includes: issuing an authentication code embedded in the webpage code of a legitimate website; when executed, the authentication code is used to upload information about the website currently connected to the network in a resource request; receiving a resource request sent by a user when executing the webpage code of a website to be accessed using a browser; the resource request carrying at least the requested target resource information; and determining whether the website to be accessed is a clone based on the target legitimate website information corresponding to the target resource information and the resource request. This solution enables real-time detection of cloned websites.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method, device, electronic device and storage medium for detecting cloned websites. Background Art

[0002] Website cloning occurs when attackers use technical means to copy the webpage content of legitimate websites to build and operate websites with nearly identical interfaces. Attackers trick users into visiting these fake cloned websites. Because the pages of these cloned websites are essentially identical to the legitimate ones, attackers can easily steal the user's account and password information.

[0003] Currently, website security mechanisms primarily rely on website HTTPS certificates and browser certificate signature verification mechanisms to determine a website's legitimacy. However, attackers often exploit users' lack of security awareness and clone websites using similar domain names to steal user information. Website cloning incidents typically occur only after user information has been stolen and losses have occurred, leading to user reports or complaints. Website administrators then discover the cloning and take remedial measures. Therefore, there is an urgent need for a real-time method to detect cloned websites. Summary of the Invention

[0004] The embodiments of the present invention provide a cloned website detection method, device, electronic device and storage medium, which can detect cloned websites in real time.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting cloned websites, comprising:

[0006] Issuing an authentication code for embedding in the webpage code of a legitimate website, and when executed, the authentication code is used to: carry the website information of the current network connection in the resource request for uploading;

[0007] Receiving a resource request sent by a user terminal when executing web page code of a website to be visited using a browser; the resource request at least carries requested target resource information;

[0008] Based on the target legitimate website information corresponding to the target resource information and the resource request, it is determined whether the website to be accessed is a clone website.

[0009] In a possible implementation, before issuing the authentication code for embedding in the webpage code of the legal website, the method further includes: registering the legal website information and resource information uploaded by the website management terminal to establish an association relationship between the legal website information and the resource information.

[0010] In a possible implementation, determining whether the website to be accessed is a cloned website based on the target legitimate website information corresponding to the target resource information and the resource request includes:

[0011] Determining whether the resource request carries website information;

[0012] If the website information is carried, determining whether the carried website information is the same as the target legitimate website information; if not, determining that the website to be visited is a cloned website;

[0013] If no website information is carried, it is determined that the website to be visited is a cloned website.

[0014] In a possible implementation, after determining that the resource request carries website information and before determining whether the carried website information is the same as the target legitimate website information, the method further includes:

[0015] Determine whether the carried website information is the website information required to be uploaded by the authentication code. If so, determine whether the carried website information is the same as the target legitimate website information; if not, determine that the website to be visited is a cloned website.

[0016] In a possible implementation, the legal website information includes: at least one of a domain name, an IP address, and a host name;

[0017] The authentication code is required to carry the website information uploaded in the resource request, which is one or more of the legal website information.

[0018] In a possible implementation, the authentication code is an obfuscated authentication code that has undergone code obfuscation processing.

[0019] In a possible implementation, the method further includes:

[0020] Registering the alarm information uploaded by the website management terminal;

[0021] When it is determined that the website to be visited is a clone website, an alarm is issued for the clone website detection result based on the alarm information.

[0022] In a second aspect, an embodiment of the present invention further provides a clone website detection device, comprising:

[0023] An authentication code issuing unit is used to issue an authentication code for embedding in the webpage code of a legitimate website, and when the authentication code is executed, it is used to: carry the website information of the current network connection in the resource request for uploading;

[0024] The communication unit is configured to receive a resource request sent by a user terminal when executing a webpage code of a website to be visited using a browser; the resource request at least carries information about the requested target resource;

[0025] The determining unit is configured to determine whether the website to be accessed is a cloned website based on target legitimate website information corresponding to the target resource information and the resource request.

[0026] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0027] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0028] Embodiments of the present invention provide a cloned website detection method, apparatus, electronic device, and storage medium. By embedding an authentication code into the webpage code of a legitimate website, a user terminal, when executing the webpage code and the authentication code embedded therein using a browser, can upload a resource request containing information about the website currently connected to the network. The legitimate website information is then used to verify the legality of the website information of the website to be accessed, requesting access to the corresponding resource, to determine whether the website to be accessed is a cloned website. This solution implements cloned website detection during the resource request process, ensuring real-time detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 This is a flow chart of a method for detecting cloned websites provided by one embodiment of the present invention;

[0031] Figure 2 This is a flow chart of another method for detecting cloned websites provided by one embodiment of the present invention;

[0032] Figure 3 This is a hardware architecture diagram of an electronic device provided by one embodiment of the present invention;

[0033] Figure 4 This is a structural diagram of a clone website detection device provided by one embodiment of the present invention;

[0034] Figure 5 This is a structural diagram of a clone website detection device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0036] Currently, various methods for detecting cloned websites suffer from poor real-time performance. Analysis of this issue reveals that cloned websites are typically constructed by stealing web page code and resources from legitimate websites. When a user uses a browser to access a legitimate website or its clone, the web page resources are requested from the same server that stores them.

[0037] Based on this, the inventive concept of the present invention is that: the server that stores web page resources serves as a clone detection server, and the authentication code is embedded in the web page code of the legitimate website, so that when the authentication code is executed, the resource request can be uploaded to the clone detection server, and the resource request carries the website information of the current network connection, so that the clone detection server can use the legitimate website information to verify the website information carried by the resource request.

[0038] The specific implementation of the above concept is described below.

[0039] Please refer to Figure 1 , an embodiment of the present invention provides a method for detecting cloned websites, the method comprising:

[0040] Step 100: issuing an authentication code for embedding in the webpage code of a legitimate website, and when executed, the authentication code is used to: carry the website information of the current network connection in the resource request for uploading;

[0041] Step 102: receiving a resource request sent by a user terminal when executing webpage code of a website to be visited using a browser; the resource request at least carries requested target resource information;

[0042] Step 104: Determine whether the website to be accessed is a cloned website based on the target legitimate website information corresponding to the target resource information and the resource request.

[0043] In this embodiment of the present invention, by embedding the authentication code into the webpage code of a legitimate website, a user, when using a browser to execute the webpage code and the authentication code embedded therein, can upload a resource request containing the website information of the current network connection. This information can then be used to verify the legitimacy of the website information of the website to be accessed, requesting access to the corresponding resource, to determine whether the website to be accessed is a clone. This solution enables clone website detection during the resource request process, ensuring real-time detection of clone websites.

[0044] Described below Figure 1 How to perform the steps shown.

[0045] First, with respect to step 100, an authentication code is issued for embedding in the webpage code of a legitimate website, and when the authentication code is executed, the authentication code is used to carry the website information of the current network connection in the resource request for uploading.

[0046] The website management end needs to use web resources to build web pages, where the web resources may include pictures, videos, etc. In order to ensure that the web page content can be displayed when the user end uses a browser to access the web page, the website management end needs to store the web page resources on the server, and the user end requests the corresponding resources from the server to realize the normal display of the web page.

[0047] In the embodiment of the present invention, the server storing the web page resources is used as a clone detection server, which generates an authentication code and sends it to the website management terminal. After receiving the authentication code, the website management terminal embeds the authentication code into the web page code of the legitimate website.

[0048] In an embodiment of the present invention, in order to make clone website detection more accurate, before the clone detection server issues the authentication code for embedding in the web page code of the legitimate website, the website management end uploads the legitimate website information corresponding to the resource information to the clone detection server. The clone detection server registers the legitimate website information and resource information uploaded by the network management end to establish an association relationship between the legitimate website information and the resource information.

[0049] Furthermore, when a legitimate website managed by the website management terminal adds a new web page or resource, the clone detection server can also register and update the new web page or resource uploaded by the website management terminal.

[0050] In the embodiment of the present invention, the legal website information is unique information used to characterize a website, and may specifically include at least one of a domain name, an IP address, and a host name.

[0051] Furthermore, the clone detection server can also register the alarm information uploaded by the website management terminal, so that when the website to be visited is determined to be a clone website, an alarm is issued based on the alarm information. The alarm information may include but is not limited to: mobile phone number, email address.

[0052] The clone detection server can also provide functions such as adding, deleting, modifying, and downloading legitimate website information and resource information for easy maintenance.

[0053] In one embodiment of the present invention, the authentication codes sent to different website management terminals may be the same or different.

[0054] When executing the web page code to request resources from the clone website server, if the web page code is embedded with authentication code, the authentication code is used to carry the website information of the current network (http or https) connection in the resource request for uploading.

[0055] The authentication code requires that the website information uploaded with the resource request be one or more of the valid website information. This ensures that the valid website information can be used to verify the legality of the website information uploaded with the authentication code. For example, if the valid website information is a domain name and IP address, the website information uploaded with the authentication code can be a domain name, an IP address, or both.

[0056] After determining that the website information required to be uploaded with the resource request is included, an authentication code is generated using a language that matches the webpage code, such as JavaScript. After the authentication code is embedded in the webpage code, in order to prevent website cloners from knowing its meaning and deleting it, in one embodiment of the present invention, the authentication code is an obfuscated authentication code after code obfuscation.

[0057] Then, step 102 "receiving a resource request sent by the user terminal when executing the web page code of the website to be visited using a browser; the resource request carries at least the requested target resource information" and step 104 "determining whether the website to be visited is a cloned website based on the target legitimate website information corresponding to the target resource information and the resource request" are explained at the same time.

[0058] Because the authentication code is embedded in the webpage code of a legitimate website, when accessing the legitimate website, the legitimate website's webpage code and the authentication code are executed in the browser. When executing the authentication code, the browser obtains the website information of the current network connection and carries this website information in the resource request. The resource request is used to request the desired target resource information.

[0059] Generally, a cloner copies web page code to build a cloned website. The copied web page code includes the authentication code. If the authentication code is deleted, the resource request may not carry the website information. In this case, please refer to Figure 2 , this step 104 may specifically include:

[0060] Step 200, determining whether the resource request carries website information; if it carries website information, executing step 202; if it does not carry website information, executing step 204;

[0061] Step 202, determining whether the carried website information is the same as the target legitimate website information; if not, executing step 204;

[0062] Step 204: Determine whether the website to be accessed is a cloned website.

[0063] If the resource request does not carry website information, it means that the authentication code has been deleted, indicating that the website is a cloned website; if the resource request carries website information and the website information is different from the target legitimate website information, it means that the website is a cloned website.

[0064] Furthermore, if the resource request carries website information, but the carried website information is not the website information required to be uploaded by the authentication code, indicating that the authentication code has been modified, the website can also be determined to be a cloned website. Specifically, before executing step 202, it is determined whether the carried website information is the website information required to be uploaded by the authentication code. If so, the determination is performed as to whether the carried website information is the same as the target legitimate website information; if not, the website to be accessed is determined to be a cloned website.

[0065] That is to say, only when the authentication code has not been modified or deleted, the resource request sent will carry the website information and target resource information, and the website information carried by the resource request will be verified using the target legitimate website information corresponding to the target resource information. When the verification is successful, it indicates that the website to be accessed is not a cloned website, and the target resource information will be sent to the user end.

[0066] In one embodiment of the present invention, when it is determined that the website to be accessed is a clone website, the target resource information is refused to be provided.

[0067] In addition, if the website management terminal uploads an alarm message when registering, the cloned website detection result can also be alarmed according to the alarm message. Specifically, the domain name, IP address and / or host name of the cloned website can be sent by phone or email in the alarm message to realize the alarm.

[0068] In the embodiment of the present invention, when it is determined that the website to be visited is a cloned website and the target resource information is refused to be provided, the situation of website resource theft can be effectively solved.

[0069] like Figure 3 、 Figure 4 As shown, an embodiment of the present invention provides a clone website detection device. The device embodiment can be implemented by software, hardware, or a combination of software and hardware. From the hardware level, Figure 3 As shown in FIG. 1 , a hardware architecture diagram of an electronic device where a cloned website detection device is provided in an embodiment of the present invention is provided. Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 4 As shown, as a logical device, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it. This embodiment provides a clone website detection device, including:

[0070] The authentication code issuing unit 401 is used to issue an authentication code for embedding in the webpage code of a legitimate website, and when the authentication code is executed, it is used to: carry the website information of the current network connection in the resource request for uploading;

[0071] The communication unit 402 is configured to receive a resource request sent by a user terminal when executing a webpage code of a website to be visited using a browser; the resource request at least carries information about the requested target resource;

[0072] The determining unit 403 is configured to determine whether the website to be accessed is a cloned website based on the target legitimate website information corresponding to the target resource information and the resource request.

[0073] In one embodiment of the present invention, please refer to Figure 5 , the clone website detection device may further include:

[0074] The registration unit 404 is used to register the legal website information and resource information uploaded by the website management terminal to establish an association relationship between the legal website information and resource information.

[0075] In one embodiment of the present invention, the determination unit is specifically used to: determine whether the resource request carries website information; if it carries website information, determine whether the carried website information is the same as the target legitimate website information; if they are not the same, determine that the website to be visited is a clone website; if it does not carry website information, determine that the website to be visited is a clone website.

[0076] In one embodiment of the present invention, after determining that the resource request carries website information, and before determining whether the carried website information is the same as the target legitimate website information, the determination unit is also used to determine whether the carried website information is the website information required to be uploaded by the authentication code. If so, the determination of whether the carried website information is the same as the target legitimate website information is executed; if not, it is determined that the website to be visited is a cloned website.

[0077] In one embodiment of the present invention, the legal website information includes: at least one of a domain name, an IP address, and a host name;

[0078] The authentication code is required to carry the website information uploaded in the resource request, which is one or more of the legal website information.

[0079] In one embodiment of the present invention, the authentication code is an obfuscated authentication code that has undergone code obfuscation processing.

[0080] In one embodiment of the present invention, the registration processing unit is further configured to: register the alarm information uploaded by the website management terminal;

[0081] The communication unit is further configured to, when it is determined that the website to be visited is a clone website, issue an alarm on the clone website detection result based on the alarm information.

[0082] It should be understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on a clone website detection device. In other embodiments of the present invention, a clone website detection device may include more or fewer components than illustrated, or may combine or separate certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0083] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0084] An embodiment of the present invention further provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a clone website detection method according to any embodiment of the present invention is implemented.

[0085] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a clone website detection method according to any embodiment of the present invention.

[0086] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0087] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0088] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0089] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0090] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0091] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0092] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting cloned websites, characterized in that: include: Register the legal website information and resource information uploaded by the website management terminal to establish the association relationship between the legal website information and resource information; Issuing an authentication code for embedding in the webpage code of a legitimate website, and when executed, the authentication code is used to: carry the website information of the current network connection in the resource request for uploading; Receiving a resource request sent by a user terminal when executing web page code of a website to be visited using a browser; the resource request at least carries requested target resource information; Based on the target legitimate website information corresponding to the target resource information and the resource request, determining whether the website to be visited is a clone website specifically includes: determining whether the resource request carries website information; if the resource request carries website information, determining whether the carried website information is the same as the target legitimate website information; if they are not the same, determining that the website to be visited is a clone website; if the resource request does not carry website information, determining that the website to be visited is a clone website.

2. The method according to claim 1, characterized in that After determining that the resource request carries website information, and before determining whether the carried website information is the same as the target legitimate website information, the method further includes: Determine whether the carried website information is the website information required to be uploaded by the authentication code. If so, determine whether the carried website information is the same as the target legitimate website information; if not, determine that the website to be visited is a cloned website.

3. The method according to any one of claims 1-2, characterized in that The legal website information includes: at least one of a domain name, an IP address, and a host name; The authentication code is required to carry the website information uploaded in the resource request, which is one or more of the legal website information.

4. The method according to any one of claims 1-2, characterized in that The authentication code is an obfuscated authentication code that has undergone code obfuscation processing.

5. The method according to claim 1, characterized in that Also includes: Registering the alarm information uploaded by the website management terminal; When it is determined that the website to be visited is a clone website, an alarm is issued for the clone website detection result based on the alarm information.

6. A clone website detection device, characterized in that: include: A registration unit is used to register the legal website information and resource information uploaded by the website management terminal to establish an association relationship between the legal website information and resource information; An authentication code issuing unit is used to issue an authentication code for embedding in the webpage code of a legitimate website, and when the authentication code is executed, it is used to: carry the website information of the current network connection in the resource request for uploading; The communication unit is configured to receive a resource request sent by a user terminal when executing a webpage code of a website to be visited using a browser; the resource request at least carries information about the requested target resource; a determining unit, configured to determine whether the website to be accessed is a cloned website based on target legitimate website information corresponding to the target resource information and the resource request; The determination unit is specifically used to: determine whether the resource request carries website information; if it carries website information, determine whether the carried website information is the same as the target legitimate website information; if they are not the same, determine that the website to be visited is a clone website; if it does not carry website information, determine that the website to be visited is a clone website.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

Images