Web page tampering detection method, device, electronic device and readable storage medium

Abstract

The embodiments of the present application provide a web page tampering detection method, device, electronic device and readable storage medium, which relate to the field of communication technology. The method includes: obtaining a target title, initial web page text and initial image included in the target web page; obtaining a first tampering detection result based on the target title and target text classification model; obtaining a second tampering detection result based on the initial web page text and target named entity recognition model; obtaining a third tampering detection result based on the initial image and target image classification model; obtaining a target detection result of the target web page based on the first tampering detection result, the second tampering detection result and the third tampering result, wherein the target detection result is used to indicate whether the target web page has been tampered with. In this way, by performing web page tampering detection from three aspects: title, web page text and image, the scope of application of tampering detection can be broadened and the accuracy of detection results can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a web page tampering detection method, device, electronic device and readable storage medium. Background Art

[0002] With the gradual development of the internet and network technology, more and more people are becoming proficient in network security. Among these, there are a large number of opportunists who attack various web pages for personal gain, and tampering with target web pages is a common attack method. Currently, the method of determining whether a web page has been tampered with is based on a comparison between sensitive word libraries and benchmark web page libraries. However, detection methods based on sensitive word libraries have low detection accuracy, and detection methods based on benchmark web page libraries have low universality. Summary of the Invention

[0003] The embodiments of the present application provide a web page tampering detection method, device, electronic device and readable storage medium, which detect web page tampering from three aspects: title, web page text and image, which can broaden the scope of application of tampering detection and improve the accuracy of detection results.

[0004] The embodiments of the present application can be implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for detecting webpage tampering, the method comprising:

[0006] Obtaining a target title, initial webpage text, and initial image included in the target webpage;

[0007] Obtaining a first tampering detection result according to the target title and the target text classification model, wherein the target text classification model is trained based on the title of the tampered webpage;

[0008] Obtaining a second tampering detection result based on the initial webpage text and a target named entity recognition model, wherein the target named entity recognition model is trained based on the webpage text of the tampered webpage;

[0009] Obtaining a third tampering detection result based on the initial image and the target image classification model, wherein the target image classification model is trained based on images containing tampered content in the tampered webpage;

[0010] A target detection result of the target webpage is obtained according to the first tampering detection result, the second tampering detection result, and the third tampering result, wherein the target detection result is used to indicate whether the target webpage has been tampered with.

[0011] In a second aspect, an embodiment of the present application provides a webpage tampering detection device, the device comprising:

[0012] An information acquisition module is used to obtain a target title, an initial webpage text and an initial image included in a target webpage;

[0013] a detection module, configured to obtain a first tampering detection result based on the target title and a target text classification model, wherein the target text classification model is trained based on the title of the tampered web page;

[0014] The detection module is further configured to obtain a second tampering detection result based on the initial webpage text and a target named entity recognition model, wherein the target named entity recognition model is trained based on the webpage text of the tampered webpage;

[0015] The detection module is further configured to obtain a third tampering detection result based on the initial image and a target image classification model, wherein the target image classification model is trained based on images containing tampered content in the tampered webpage;

[0016] The processing module is configured to obtain a target detection result of the target webpage according to the first tampering detection result, the second tampering detection result, and the third tampering result, wherein the target detection result is used to indicate whether the target webpage has been tampered with.

[0017] In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the web page tampering detection method described in the aforementioned embodiment.

[0018] In a fourth aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the web page tampering detection method as described in the aforementioned embodiment.

[0019] The web page tampering detection method, device, electronic device and readable storage medium provided in the embodiments of the present application first obtain the target title, initial web page text and initial image included in the target web page, and then use the model to perform tampering detection on the target title, initial web page text and initial image respectively to obtain tampering detection results in three aspects, and finally obtain the target detection result of the target web page based on the above tampering detection results. Among them, the model used in tampering detection is trained based on the tampered web page, and the target detection result is used to indicate whether the target web page has been tampered with. The embodiments of the present application perform web page tampering detection from three aspects: title, web page text and image, which can broaden the scope of application of tampering detection and improve the accuracy of detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A block diagram of an electronic device provided in an embodiment of the present application;

[0022] Figure 2 This is a flow chart of a web page tampering detection method according to an embodiment of the present application;

[0023] Figure 3 This is a second flow chart of the web page tampering detection method provided in an embodiment of the present application;

[0024] Figure 4 for Figure 2 Schematic diagram of the flow of sub-steps included in step S130;

[0025] Figure 5 for Figure 2 Schematic diagram of the flow of sub-steps included in step S140;

[0026] Figure 6 A block diagram of a web page tampering detection device provided in an embodiment of the present application.

[0027] Icon: 100 - electronic device; 110 - memory; 120 - processor; 130 - communication unit; 200 - web page tampering detection device; 210 - information acquisition module; 220 - detection module; 230 - processing module. DETAILED DESCRIPTION

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0029] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present application.

[0030] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0031] Currently, web page tampering detection is generally performed through the following two solutions.

[0032] Solution 1: Create a pre-built sensitive word library. If the text on the webpage to be inspected contains sensitive words, the frequency of their occurrence can be used to determine whether the webpage has been tampered with. However, in Chinese, some words have different meanings in different semantic contexts. Creating a sensitive word library cannot avoid the interference of polysemous words, which will increase the false recognition rate.

[0033] Solution 2: Build a pre-built standard library of benchmark web pages and calculate the textual similarity between the web page to be tested and the corresponding benchmark pages. If the similarity falls below a threshold, the web page is considered tampered. This solution has limited universality. If the web page to be tested does not have benchmark data in the library, then the tampering detection cannot be performed on that web page.

[0034] In response to the above situation, the embodiments of the present application provide a web page tampering detection method, device, electronic device and readable storage medium, which detect web page tampering from three aspects: title, web page text and image, which can broaden the scope of application of tampering detection and improve the accuracy of detection results.

[0035] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0036] Please refer to Figure 1 , Figure 1 This is a block diagram of an electronic device 100 provided in an embodiment of the present application. The electronic device 100 may be, but is not limited to, a computer, a server, or the like. The electronic device 100 may include a memory 110, a processor 120, and a communication unit 130. The memory 110, the processor 120, and the communication unit 130 are electrically connected to each other, directly or indirectly, to enable data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses or signal lines.

[0037] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0038] The processor 120 is used to read / write data or programs stored in the memory 110 and execute corresponding functions. For example, the memory 110 stores a webpage tampering detection device 200, which includes at least one software function module that can be stored in the memory 110 in the form of software or firmware. The processor 120 executes various functional applications and data processing by running software programs and modules stored in the memory 110, such as the webpage tampering detection device 200 in the embodiment of the present application, thereby implementing the webpage tampering detection method in the embodiment of the present application.

[0039] The communication unit 130 is used to establish a communication connection between the electronic device 100 and other communication terminals through a network, and to send and receive data through the network.

[0040] It should be understood that Figure 1 The structure shown is only a schematic diagram of the structure of the electronic device 100. The electronic device 100 may also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0041] Please refer to Figure 2 , Figure 2 This is one of the flow diagrams of the webpage tampering detection method provided in an embodiment of the present application. The method can be applied to the electronic device 100 described above. The specific process of the webpage tampering detection method is described in detail below. In this embodiment, the method may include steps S110 to S150.

[0042] Step S110 , obtaining the target title, initial webpage text, and initial image included in the target webpage.

[0043] In this embodiment, the target webpage is the webpage that requires tampering detection. The target webpage's title, webpage text, and images can be obtained through a crawler strategy or other means to serve as the target title, initial webpage text, and initial image. Alternatively, the target webpage can be first obtained based on the IP address corresponding to the target webpage, and then the target title, initial webpage text, and initial image can be extracted from the target webpage. It will be appreciated that the number of initial images is determined by the target webpage and may be one or more.

[0044] Step S120: Obtain a first tampering detection result according to the target title and target text classification model.

[0045] Step S130: Obtain a second tampering detection result based on the initial webpage text and the target named entity recognition model.

[0046] Step S140: Obtain a third tampering detection result according to the initial image and target image classification model.

[0047] When the target title, initial webpage text and initial image are obtained, steps S120 to S140 may be executed in parallel, or sequentially, and the execution order may be set according to actual needs.

[0048] Among them, the target text classification model is trained based on the title of the tampered web page, that is, it is trained based on the tampered web page title (that is, the tampered title). The target named entity recognition model is trained based on the web page text of the tampered web page. The target image classification model is trained based on the image with tampered content in the tampered web page. The target text classification model, target named entity recognition model and target image classification model can be pre-trained by the electronic device 100, or trained by other devices. The specific method of obtaining the model and the training method can be determined in combination with actual needs.

[0049] The target title, initial webpage text, and initial image can be directly input into the corresponding models, respectively, to obtain the first tampering detection result, the second tampering detection result, and the third tampering detection result. Alternatively, the target title, initial webpage text, and initial image can be processed accordingly based on actual needs, and the processed data can be input into the corresponding models, thereby obtaining the first tampering detection result, the second tampering detection result, and the third tampering detection result. The use of named entity recognition models combined with contextual semantics can effectively eliminate the interference of polysemous feature words, thereby improving detection accuracy.

[0050] The first tampering detection result is used to indicate whether the title has been tampered with, the second tampering detection result is used to indicate whether the webpage text has been tampered with, and the third tampering detection result is used to indicate whether the image of the webpage has been tampered with.

[0051] Step S150 , obtaining a target detection result of the target webpage according to the first tampering detection result, the second tampering detection result, and the third tampering detection result.

[0052] How to determine the target detection result based on the detection results of the above three aspects can be determined according to actual needs. Wherein, the target detection result is used to indicate whether the target webpage has been tampered with.

[0053] This embodiment of the application comprehensively detects web page tampering from the perspectives of title, text, and images, accurately identifying whether a web page has been tampered with, preventing damage to the website in a timely manner, and reducing the risk of viewers being affected by inappropriate content. Compared to existing web page tampering detection technologies, this solution can effectively broaden its scope of application and improve the accuracy of detection results.

[0054] Optionally, as a possible implementation method, the labels used in training the above-mentioned target text classification model, target named entity recognition model and target image classification model only include tampered and non-tampered, so as to facilitate rapid acquisition of sample sets.

[0055] Optionally, as another possible implementation method, at least one of the target text classification model, target named entity recognition model and target image classification model is trained based on the tampered web page and the corresponding tampering type. That is, the label used in the training of at least one model includes a specific tampering type. At least one of the first tampering detection result, the second tampering detection result and the third tampering result includes the detected tampering type, and the target detection result includes the tampering type included in the first tampering detection result, the second tampering detection result and the third tampering result. In this way, not only can it be identified whether the target web page has been tampered with, but also the type of tampering can be identified.

[0056] Please refer to Figure 3 , Figure 3 This is a second flow chart of the webpage tampering detection method provided in an embodiment of the present application. In the case where the text classification model is trained based on the titles of tampered webpages and the corresponding tampering types, before step S120, the method may further include steps S113 to S115.

[0057] Step S113: Obtain the registered title of the target web page.

[0058] Step S114: Calculate the similarity between the filed title and the target title.

[0059] Step S115 , determining whether the similarity is greater than a preset similarity.

[0060] The valid registered title of the target webpage can be obtained based on the domain name or IP address corresponding to the target webpage. Then, the semantic similarity between the registered title and the extracted target title can be calculated using a semantic similarity model. Next, the calculated similarity is compared with the preset similarity. The specific value of the preset similarity can be set in combination with the needs. If the similarity is greater than the preset similarity, step S116 can be executed: determining that the first tampering result is not tampered with. If the similarity is not greater than the preset similarity, step S120 is executed, that is, using the target text classification model to perform text tampering detection and the specific tampering type. In this way, only when it is determined that tampering may have occurred based on the semantic similarity model, the target text classification model is used to determine whether it has been tampered with and the type of tampering, which can reduce the detection expenses of the subdivided dimension.

[0061] The target title can be directly input into the target text classification model, and the output result can be used as the first tampering detection result. In the case where the labels used in training the target text classification model include specific tampering types, correspondingly, when the target webpage is tampered with, the first tampering detection result includes the detected specific tampering type.

[0062] As a possible implementation, the sample set used by the target named entity recognition model includes a Chinese text sample set, an English text sample set, and a Chinese-English text sample set. This reduces the possibility that the target named entity recognition model may output poor accuracy in detection results due to language influence. The Chinese text sample set contains only Chinese text, the English text sample set contains only English text, and the Chinese-English text sample set contains both Chinese and English text.

[0063] Please refer to Figure 4 Figure 4 for Figure 2 Schematic diagram of the flow of sub-steps included in step S130. In this embodiment, step S130 may include sub-steps S131 and S132.

[0064] Sub-step S131 : determining the target webpage text based on the initial webpage text.

[0065] Optionally, the initial webpage text may be directly used as the target webpage text, or corresponding rules may be set in combination with actual needs to process the initial webpage text, and the processed text may be used as the target webpage text.

[0066] As a possible implementation, the initial webpage text can be directly segmented, and then the Chinese and English vocabulary percentages can be calculated based on the segmentation results. The Chinese and English vocabulary percentages can be compared with preset percentages. The preset percentage can be greater than 0.5 and can be determined based on actual needs, for example, 65%. The preset percentage is used to determine whether to perform language conversion and the conversion direction.

[0067] If the proportion of Chinese words is greater than the preset proportion, it means that the current Chinese content is relatively large. In this case, the English words in the word segmentation results can be translated into Chinese to obtain the target webpage text. The target webpage text includes the original Chinese text of the target webpage and the Chinese translation of the original English text of the target webpage.

[0068] If the proportion of English words is greater than the preset proportion, it means that English is more prevalent. In this case, the Chinese words in the word segmentation results can be translated into English to obtain the target webpage text. The target webpage text includes the original English text of the target webpage and the English translation of the Chinese words originally included in the target webpage.

[0069] If the proportion of the Chinese words and the proportion of the English words are both not greater than the preset proportion, language translation may not be performed and the initial webpage text may be directly used as the target webpage text.

[0070] Generally, webpage tampering can be categorized into two types: full modification and modification of the intermediate portion. To expedite obtaining the second tampering detection result while ensuring the accuracy of webpage text tampering detection, after obtaining the initial webpage text, the header, navigation, and footer text can be optionally removed based on the target webpage's tags to reduce interference. The target webpage text can then be determined based on the pre-determined percentage of the removed text.

[0071] Sub-step S132: inputting the target webpage text into the target named entity recognition model to obtain the second tampering detection result.

[0072] In the case where the labels used in training the target named entity recognition model include specific tampering types, correspondingly, in the case where the target webpage is tampered with, the second tampering detection result includes the detected specific tampering type.

[0073] Please refer to Figure 5 , Figure 5 for Figure 2 Schematic diagram of the flow of sub-steps included in step S140. In this embodiment, step S140 may include sub-steps S141 and S142.

[0074] Sub-step S141 , performing normalization processing on the initial image to obtain a target image with a preset size.

[0075] Sub-step S142: inputting the target image into the target image classification model to obtain the third tampering detection result.

[0076] In this embodiment, the initial image can be subjected to image normalization to obtain a target image of a preset size. Optionally, the normalization process is as follows: first, a container of a standard image size (i.e., a preset size) is set; second, the image is placed in the center of the container; then, with the center of the container as a reference point, a scaling ratio is calculated based on the length and width of the initial image and the length and width of the container. When, after scaling, one side of the container is fully filled and the other end is not, the image is filled using interpolation, ultimately forming a standard image format, thereby obtaining the target image.

[0077] Optionally, CSS (Cascading Style Sheets) can be used to center the initial image in the container and then perform adaptive processing, thereby preventing image distortion.

[0078] Once the target image is obtained, it can be input into the target image classification model to obtain a third tampering detection result. This unifies the image sizes, reducing the interference of a large number of images of different sizes on the webpage on the image classification results, thereby improving accuracy and model efficiency.

[0079] Similarly, if the labels used in training the target image classification model include specific tampering types, then correspondingly, if the target webpage has been tampered with, the third tampering detection result includes the specific tampering type detected. It will be understood that if there are multiple initial images, a third tampering detection result corresponding to each initial image can be obtained.

[0080] When the first tampering detection result, the second tampering detection result, and the third tampering detection result are obtained, if the tampering detection results of the three aspects all indicate that no tampering has been performed, it can be determined that the target detection result is no tampering.

[0081] If one of the tampering detection results in the above three aspects indicates that the target webpage has been tampered with, it can be determined that the target webpage has been tampered with, and the obtained target detection result is used to indicate that the target webpage has been tampered with.

[0082] In the case that the target text classification model, the target named entity recognition model and the target image classification model are all trained based on the tampered web page and the corresponding tampering type, when at least one of the first tampering detection result, the second tampering detection result and the third tampering result indicates tampering, the tampering type included in the first tampering detection result, the second tampering detection result and the third tampering result is used as the tampering type included in the target detection result.

[0083] If the tampering types output by the three models are inconsistent, the target detection result includes the tampering types output by the three models. In this way, the detection result can be more comprehensive.

[0084] In this embodiment, in the direction of web page tampering identification, named entity recognition technology is used to identify sensitive feature words, which can effectively reduce the interference of polysemous feature words, and a special pre-training set is constructed for the adaptability of Chinese and English web pages, which expands the breadth of applicability. In image processing, the image is standardized at the input layer and the image size is unified, which can reduce the interference of a large number of images of different sizes in the web page on the image classification results, and improve the accuracy and model efficiency. The embodiment of the present application detects the title, text, and image in the web page respectively. Such comprehensive detection can more comprehensively and accurately determine whether the web page has been tampered with and the type of tampering.

[0085] The following briefly describes how to train the target text classification model, target named entity recognition model, and target image classification model.

[0086] S1: Collect a large number of URLs of tampered web pages. The tampered web pages can be Chinese web pages, English web pages, or Chinese and English web pages (ie, the web pages include Chinese and English).

[0087] S2: Based on the URL, obtain the titles of all web pages, mark their corresponding tampering types, and build a training set and a validation set for the title data.

[0088] S3: The target text classification model is obtained by training based on the title data training set and the validation set.

[0089] S4: Obtain the webpage text of the tampered webpage based on the URL, and then remove the header, navigation and footer text according to the webpage tags to reduce interference.

[0090] S5: According to the type of web page tampering (for example, pornography, gambling, novels, etc.), the named entities in the processed text are annotated using the BIOES annotation method combined with the tampering type (such as B-pornography, I-pornography, 0-untampered). For example, Chinese is annotated using the character length and arrangement in the named entity, for example: "Yabo Sports, focusing on gambling", Ya: B-gambling, Bo: I-gambling, Ti: I-gambling, Yu: E-gambling, focusing: O-untampered, Gambling: S-gambling. English is annotated using the structure of the named entity vocabulary, for example: Yabo Sports, focusing on betting, Yabo: B-gambling, Sports: E-gambling, focusing: O-untampered, on: O-untampered, betting: S-gambling). Pure Chinese text training and verification sets, pure English text training and verification sets, and Chinese and English text training and verification sets including Chinese and English texts can be constructed respectively. Optionally, Bi-LSTM and CRF models can be used for named entity recognition.

[0091] S6: The target named entity recognition model is obtained by training based on three text training sets and validation sets.

[0092] S7: Obtain all images included in the web page based on the URL.

[0093] S8: Filter out images with tampered content and images without any tampering features from all images on the tampered web page, and mark them according to whether they have been tampered with and the type of tampering (such as non-tampered, pornography, gambling, novels, etc.).

[0094] S9: Unify the image size and build the image data training set and validation set.

[0095] S10: The target image classification model is obtained by training based on the image data training set and the validation set. Optionally, the target image classification model can be obtained based on the Xception model, the image data training set, and the validation set. The Xception model is a convolutional neural network model developed by Google.

[0096] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing a webpage tampering detection device 200 is given below. Optionally, the webpage tampering detection device 200 can adopt the above Figure 1 The device structure of the electronic device 100 is shown in FIG. Figure 6 , Figure 6This is a block diagram of a webpage tampering detection device 200 provided in an embodiment of the present application. It should be noted that the basic principles and technical effects of the webpage tampering detection device 200 provided in this embodiment are the same as those of the above-mentioned embodiments. For the sake of brevity, any details not mentioned in this embodiment can be referred to the corresponding contents of the above-mentioned embodiments. The webpage tampering detection device 200 may include: an information acquisition module 210, a detection module 220, and a processing module 230.

[0097] The information acquisition module 210 is used to obtain the target title, initial webpage text and initial image included in the target webpage.

[0098] The detection module 220 is configured to obtain a first tampering detection result based on the target title and the target text classification model, wherein the target text classification model is trained based on the title of the tampered web page.

[0099] The detection module 220 is further configured to obtain a second tampering detection result based on the initial webpage text and a target named entity recognition model, wherein the target named entity recognition model is trained based on the webpage text of the tampered webpage.

[0100] The detection module 220 is further configured to obtain a third tampering detection result based on the initial image and the target image classification model, wherein the target image classification model is trained based on images containing tampered content in the tampered webpage.

[0101] The processing module 230 is configured to obtain a target detection result of the target webpage based on the first tampering detection result, the second tampering detection result, and the third tampering result, wherein the target detection result is used to indicate whether the target webpage has been tampered with.

[0102] Optionally, in this embodiment, when the text classification model is trained based on the title of the tampered web page and the corresponding tampering type, before the detection module 220 obtains the first tampering detection result according to the target title and the target text classification model, the detection module 220 is also used to: obtain the registered title of the target web page; calculate the similarity between the registered title and the target title; when the similarity is greater than a preset similarity, determine that the first tampering detection result is not tampered with; when the similarity is not greater than the preset similarity, execute the step of obtaining the first tampering detection result according to the target title and the target text classification model.

[0103] Optionally, the above modules can be stored in the form of software or firmware. Figure 1The memory 110 shown in FIG. 110 or the operating system (OS) of the electronic device 100 may be fixed and may be used by Figure 1 Meanwhile, the data, program codes, etc. required to execute the above modules may be stored in the memory 110.

[0104] An embodiment of the present application further provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the web page tampering detection method is implemented.

[0105] In summary, the embodiments of the present application provide a web page tampering detection method, device, electronic device and readable storage medium. First, the target title, initial web page text and initial image included in the target web page are obtained. Then, the target title, initial web page text and initial image are respectively detected using a model to obtain tampering detection results in three aspects. Finally, the target detection result of the target web page is obtained based on the above tampering detection results. Among them, the model used in tampering detection is trained based on the tampered web page, and the target detection result is used to indicate whether the target web page has been tampered with. The embodiments of the present application perform web page tampering detection from three aspects: title, web page text and image, which can broaden the scope of application of tampering detection and improve the accuracy of detection results.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0107] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0108] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0109] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A webpage tampering detection method, characterized in that: The method comprises: Obtaining a target title, initial webpage text, and initial image included in the target webpage; Obtaining a first tampering detection result according to the target title and the target text classification model, wherein the target text classification model is trained based on the title of the tampered webpage; Obtaining a second tampering detection result based on the initial webpage text and a target named entity recognition model, wherein the target named entity recognition model is trained based on the webpage text of the tampered webpage; Obtaining a third tampering detection result based on the initial image and the target image classification model, wherein the target image classification model is trained based on images containing tampered content in the tampered webpage; Obtaining a target detection result of the target webpage according to the first tampering detection result, the second tampering detection result, and the third tampering detection result, wherein the target detection result is used to indicate whether the target webpage has been tampered with; The three models are all trained based on the tampered web page and the corresponding tampering type, at least one of the first tampering detection result, the second tampering detection result, and the third tampering result includes the detected tampering type, the target detection result includes the tampering type included in the first tampering detection result, the second tampering detection result, and the third tampering result, and the target detection result of the target web page is obtained based on the first tampering detection result, the second tampering detection result, and the third tampering result, including: When the first tampering detection result, the second tampering detection result, and the third tampering detection result all indicate no tampering, determining that the target detection result is no tampering; When at least one of the first tampering detection result, the second tampering detection result and the third tampering detection result indicates tampering, the tampering type included in the first tampering detection result, the second tampering detection result and the third tampering detection result is used as the tampering type included in the target detection result.

2. The method according to claim 1, characterized in that In a case where the text classification model is trained based on the titles of tampered web pages and the corresponding tampering types, before obtaining the first tampering detection result based on the target title and target text classification model, the method further includes: Obtaining the record title of the target webpage; Calculating the similarity between the filed title and the target title; When the similarity is greater than a preset similarity, determining the first tampering detection result as no tampering; When the similarity is not greater than the preset similarity, a step of obtaining a first tampering detection result according to the target title and target text classification model is performed.

3. The method according to any one of claims 1 to 2, characterized in that The sample set used by the target named entity recognition model includes a Chinese text sample set, an English text sample set, and a Chinese and English text sample set. The second tampering detection result is obtained according to the initial webpage text and the target named entity recognition model, including: Determining a target webpage text based on the initial webpage text; The target webpage text is input into the target named entity recognition model to obtain the second tampering detection result.

4. The method according to claim 3, characterized in that Determining the target webpage text based on the initial webpage text includes: Segmenting the initial webpage text to obtain the percentage of Chinese words and the percentage of English words; When the proportion of the Chinese words is greater than a preset proportion, translating the English words in the obtained word segmentation results into Chinese to obtain the target webpage text, wherein the preset proportion is greater than 0.5; When the proportion of the English words is greater than the preset proportion, translating the Chinese words in the word segmentation results into English to obtain the target webpage text; When the proportion of the Chinese words and the proportion of the English words are both not greater than the preset proportion, the initial webpage text is used as the target webpage text.

5. The method according to any one of claims 1 to 2, characterized in that Obtaining a third tampering detection result according to the initial image and the target image classification model includes: Performing standardization on the initial image to obtain a target image with a preset size; The target image is input into the target image classification model to obtain the third tampering detection result.

6. A webpage tampering detection device, characterized in that: The device comprises: An information acquisition module is used to obtain a target title, an initial webpage text and an initial image included in a target webpage; a detection module, configured to obtain a first tampering detection result based on the target title and a target text classification model, wherein the target text classification model is trained based on the title of the tampered web page; The detection module is further configured to obtain a second tampering detection result based on the initial webpage text and a target named entity recognition model, wherein the target named entity recognition model is trained based on the webpage text of the tampered webpage; The detection module is further configured to obtain a third tampering detection result based on the initial image and a target image classification model, wherein the target image classification model is trained based on images containing tampered content in the tampered webpage; a processing module, configured to obtain a target detection result of the target webpage according to the first tampering detection result, the second tampering detection result, and the third tampering detection result, wherein the target detection result is used to indicate whether the target webpage has been tampered with; The three models are all trained based on the tampered web page and the corresponding tampering type, at least one of the first tampering detection result, the second tampering detection result, and the third tampering result includes the detected tampering type, the target detection result includes the tampering type included in the first tampering detection result, the second tampering detection result, and the third tampering result, and the processing module is specifically used to: When the first tampering detection result, the second tampering detection result, and the third tampering detection result all indicate no tampering, determining that the target detection result is no tampering; When at least one of the first tampering detection result, the second tampering detection result and the third tampering detection result indicates tampering, the tampering type included in the first tampering detection result, the second tampering detection result and the third tampering detection result is used as the tampering type included in the target detection result.

7. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the web page tampering detection method according to any one of claims 1 to 5.

8. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the web page tampering detection method according to any one of claims 1 to 5 is implemented.

Images