Web page monitoring method and device, baseline data construction method and device

Abstract

The present application provides a web page monitoring method and device, and a baseline data construction method and device, wherein the web page monitoring method includes: when a web page operation log for a target website is obtained, judging whether the web page operation log meets the alarm condition based on the constructed baseline data set; if it is determined that the alarm condition is met, generating alarm information for the target website; the present application realizes the monitoring of the web page of the target website without paying attention to changes in the content of the web page, thereby reducing the business visits to the web page.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to a web page monitoring method and device, and a baseline data construction method and device. Background Art

[0002] With the popularization and development of the Internet and network applications, a large number of hacker attacks have followed, especially attacks against websites. Among them, tampering with web page content is a common method of hacker attacks.

[0003] Therefore, how to monitor whether a website's webpages have been tampered with has become a technical problem that needs to be solved urgently by technical personnel. In related technologies, the purpose of detection is achieved by detecting changes in the website's webpage content. When detecting changes in webpage content, it is necessary to periodically initiate requests to the website to obtain the webpage content, which increases the business traffic of the webpage. Summary of the Invention

[0004] In order to overcome the problems existing in the related art, the present application provides a web page monitoring method and device, and a baseline data construction method and device, so as to realize the monitoring of web pages without increasing the business visits to the web pages.

[0005] The first aspect of the present application provides a webpage monitoring method, comprising:

[0006] When a webpage operation log for a target website is obtained, determining whether the webpage operation log meets an alarm condition based on the constructed baseline data set; wherein the baseline data set is constructed based on the webpage operation log;

[0007] When it is determined that the alarm condition is met, alarm information for the target website is generated.

[0008] Optionally, it also includes:

[0009] Determining whether the webpage operation log belongs to baseline data, and if so, writing the webpage operation log into the baseline data set according to a preset writing method;

[0010] If not, execute the step of determining whether the webpage operation log meets the alarm condition based on the constructed baseline data set and all subsequent steps.

[0011] Optionally, determining whether the webpage operation log belongs to baseline data includes:

[0012] determining whether the webpage operation log contains index data in the baseline data set, and if not, determining that the webpage operation log belongs to the baseline data;

[0013] If so, determine that the index data contained in the web page operation log in the baseline data set is the target index data, and judge whether the operation time in the web page operation log is within the baseline time range corresponding to the target index data. If it is within the baseline time range, determine that the web page operation log belongs to the baseline data; if it is not within the baseline time range, determine that the web page operation log does not belong to the baseline data.

[0014] Optionally, the determining whether the webpage operation log meets an alarm condition based on the baseline data set includes:

[0015] Determining whether the characteristic data in the webpage operation log is consistent with the target characteristic data corresponding to the target index data in the baseline data set, and if they are inconsistent, determining that an alarm condition is met;

[0016] If they are consistent, determining whether the characteristic data of the webpage operation log is periodic data in the baseline data set, wherein the periodic data refers to the periodic repetition of the target characteristic data within the operation time range corresponding to the target index data;

[0017] If it does not belong to the periodic data, it is determined that the alarm condition is met.

[0018] Optionally, writing the webpage operation log into the baseline data set according to a preset writing method includes:

[0019] The webpage operation log is written into the baseline data set in a manner of establishing corresponding operation time and feature data using index data as an index.

[0020] The second aspect of the present application provides a baseline data construction method, comprising:

[0021] When a webpage operation log for a target website is obtained, determining whether the webpage operation log contains index data in the baseline data set, and if not, determining that the webpage operation log belongs to the baseline data;

[0022] If so, determining that the index data included in the webpage operation log in the baseline data set is the target index data, and judging whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data; if it is within the baseline time range, determining that the webpage operation log belongs to the baseline data; if not, determining that the webpage operation log does not belong to the baseline data;

[0023] The webpage operation log belonging to the baseline data is written into the baseline data set according to a preset writing method.

[0024] A third aspect of the present application provides a webpage monitoring device, comprising:

[0025] an alarm determination unit, which, upon obtaining a webpage operation log for a target website, determines whether the webpage operation log meets an alarm condition based on a constructed baseline data set; wherein the baseline data set is constructed based on the webpage operation log;

[0026] The first generating unit is configured to generate warning information for the target website when it is determined that the warning condition is met.

[0027] A fourth aspect of the present application provides a baseline data construction device, comprising:

[0028] a data determination unit configured to, upon obtaining a webpage operation log for a target website, determine whether the webpage operation log contains index data in the baseline data set;

[0029] a first determining unit, configured to determine that the webpage operation log belongs to the baseline data when the webpage operation log does not contain the index data in the baseline data set;

[0030] a second determining unit, configured to determine, when the webpage operation log includes index data in the baseline data set, that the index data included in the webpage operation log in the baseline data set is target index data;

[0031] A range determination unit, configured to determine whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data;

[0032] a third determining unit, configured to determine that the webpage operation log belongs to the baseline data if the operation time in the webpage operation log is within the baseline time range corresponding to the target index data;

[0033] a fourth determining unit, configured to determine that the webpage operation log does not belong to the baseline data if the operation time in the webpage operation log is not within the baseline time range corresponding to the target index data;

[0034] The data writing unit is used to write the webpage operation log belonging to the baseline data into the baseline data set according to a preset writing method.

[0035] A fifth aspect of the present application provides an electronic device, including:

[0036] processor; and

[0037] The memory stores executable codes thereon, and when the executable codes are executed by the processor, the processor is caused to execute the method described above.

[0038] A sixth aspect of the present application provides a non-transitory machine-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor is caused to execute the method described above.

[0039] Thus, the present application provides a webpage monitoring method. When a webpage operation log for a target website is obtained, the method determines whether the webpage operation log meets an alarm condition based on a constructed baseline data set. If the alarm condition is determined to be met, an alarm message for the target website is generated. Thus, the present application can monitor the webpages of the target website through the webpage operation log and the baseline data set, without having to pay attention to changes in the webpage content, thereby reducing the business visits to the webpage.

[0040] Furthermore, using web page operation logs to monitor web pages can ensure that tampering behavior is occurring or has occurred on the web pages, thereby improving the accuracy of determining tampering behavior.

[0041] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other objects, features and advantages of the present application will become more apparent through a more detailed description of exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0043] Figure 1 This is a flow chart of a webpage monitoring method shown in a method embodiment of the present application;

[0044] Figure 2 is a flow chart of a webpage monitoring method according to another embodiment of the present application;

[0045] Figure 3 This is a flowchart of a baseline data construction method shown in a method embodiment of the present application;

[0046] Figure 4 This is a structural diagram of a webpage monitoring device shown in an embodiment of the present application;

[0047] Figure 5 is a structural diagram of a webpage monitoring device shown in another device embodiment of the present application;

[0048] Figure 6 This is a schematic diagram of the structure of a baseline data construction device shown in an embodiment of the present application;

[0049] Figure 7It is a structural diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The preferred embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0051] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0052] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0053] A method embodiment of the present application provides a webpage monitoring method, which can be applied to a terminal communicating with a server of a target website or to a server of the target website. The target website is a website whose webpage needs to be monitored for tampering.

[0054] The method may include the following steps:

[0055] Step 101: When a webpage operation log for a target website is obtained, it is determined whether the webpage operation log meets the alarm condition based on the constructed baseline data set. If so, the process proceeds to step 102; if not, the monitoring of the current webpage operation log is terminated.

[0056] In this application, a web page operation log records an operation behavior of a host on a target website, including various data such as file path, file operation method, process path, operation time, host identification, etc.

[0057] The file path includes the file directory and file name, which are used to represent the file information of the operation.

[0058] The file operation mode is used to represent the operation mode performed on the file, such as deletion, creation, modification, renaming, etc.

[0059] A process path characterizes the process used by an operation.

[0060] Operation time is used to represent the time of operation.

[0061] The host identifier is used to identify the host ID and / or host IP address of the operation.

[0062] Optionally, the webpage operation log may further include a server identifier, which may be an identifier customized by a technician for the server and used to indicate the server source of the webpage operation log.

[0063] This application constructs a baseline data set, which is constructed based on web page operation logs and is configured with index data types and feature data types under the index data. This generates baseline data based on the web page operation logs and can be written into the baseline data set. Therefore, based on the constructed baseline data set, it can be determined whether the currently acquired web page operation log meets the alarm conditions. If not, monitoring of the current web page operation log is terminated. When a new web page operation log is acquired, the above method is executed again for the newly acquired web page operation log; if so, the process proceeds to step 102.

[0064] Step 102: Generate warning information for the target website.

[0065] The alarm information may be an alarm information for a host identifier in a webpage operation log, such as a host ID and / or a host address, so that the host where tampering occurs can be quickly located, thereby improving the response and handling speed after tampering occurs.

[0066] In an embodiment of the present application, when a webpage operation log for a target website is obtained, it is determined based on the constructed baseline data set whether the webpage operation log meets the alarm condition. If it is determined that the alarm condition is met, an alarm message for the target website is generated. It can be seen that the present application can monitor the webpages of the target website through the webpage operation log and the baseline data set, without having to pay attention to changes in the webpage content, thereby reducing the business visits to the webpage;

[0067] Furthermore, using web page operation logs to monitor web pages can ensure that tampering behavior is occurring or has occurred on the web pages, thereby improving the accuracy of determining tampering behavior.

[0068] Another method embodiment of the present application provides a webpage monitoring method, such as Figure 2 As shown, the method includes the following processes:

[0069] Step 201: When a webpage operation log for a target website is obtained, determine whether the webpage operation log belongs to baseline data. If so, proceed to step 202; if not, proceed to step 203;

[0070] In this application, a web page operation log records an operation behavior of a host on a target website, including various data such as file path, file operation method, process path, operation time, host identification, etc.

[0071] The file path includes the file directory and file name, which are used to represent the file information of the operation.

[0072] The file operation mode is used to represent the operation mode performed on the file, such as deletion, creation, modification, renaming, etc.

[0073] A process path characterizes the process used by an operation.

[0074] Operation time is used to represent the time of operation.

[0075] The host identifier is used to identify the host ID and / or host IP address of the operation.

[0076] Optionally, the webpage operation log may further include a server identifier, which may be an identifier customized by a technician for the server and used to indicate the server source of the webpage operation log.

[0077] In this application, determining whether the webpage operation log belongs to baseline data may include the following process:

[0078] (1.1) determining whether the webpage operation log contains index data in the baseline data set; if not, determining that the webpage operation log belongs to the baseline data;

[0079] The baseline data set in this application is generated based on the web page operation log. The type of index data and the type of feature data under the index data can be pre-set to generate baseline data based on the web page operation log and can be written into the baseline data set.

[0080] The baseline data set is also used to determine whether the web page operation log meets the alarm conditions. Therefore, when a web page operation log is obtained, it is necessary to first determine whether the web page operation log is used to generate baseline data or to determine whether the alarm conditions are met.

[0081] If the web page operation log does not contain the index data in the baseline data set, it is determined that the baseline data set does not record the index data about the web page operation log, so the web page operation log belongs to the baseline data. Referring to the subsequent steps of this embodiment, it is to write it into the baseline data set according to the preset writing method.

[0082] It is understandable that if no baseline data is recorded in the baseline data set, it means that the web page operation log needs to be written into the baseline data set first, that is, it is determined that the web page operation log belongs to the baseline data. Alternatively, if the baseline data set records the baseline data, but there is no data about the web page operation log in the index data, then the web page operation log also needs to be written into the baseline data set, that is, it can also be determined that the web page operation log belongs to the baseline data. For example, if the index data type is a host identifier, the host identifier in the baseline data set is host A, and the host identifier in the web page operation log is host B, then it is determined that the web page operation log does not contain the index data in the baseline data set, and it is determined that the web page operation log belongs to the baseline data.

[0083] (1.2) If the webpage operation log includes index data in the baseline data set, determining that the index data included in the webpage operation log in the baseline data set is target index data, and determining whether the operation time in the webpage operation log is within the operation time range corresponding to the target index data;

[0084] In a baseline data set, each index data item corresponds to a baseline time range. This baseline time range can be based on the operation time of the first index data item written, and can be extended by a specified time length. For example, if the index data is for host A and the operation time corresponding to the first write is 2022-11-15 20:00:00, the baseline time range is two weeks after this time, that is, the baseline time range is 2022-11-15 20:00:00 to 2022-11-29 20:00:00.

[0085] It is understandable that two weeks is only a specific example of the specified time length and does not constitute a limitation. The application can set the specified time length based on actual circumstances.

[0086] (1.3) If the operation time range is within the operation time range, it is determined that the webpage operation log belongs to the baseline data; if the operation time range is not within the operation time range, it is determined that the webpage operation log does not belong to the baseline data.

[0087] Step 202: writing the webpage operation log into the baseline data set according to a preset writing method;

[0088] The webpage operation log writing method is pre-set. In one method, the webpage operation log can be directly written into the baseline data set as baseline data. In another method, to facilitate management and data location, the webpage operation log is written into the baseline data set according to the pre-set writing method, which may include: writing the webpage operation log into the baseline data set by establishing corresponding operation time and feature data using index data as an index.

[0089] The types of index data and feature data can be pre-specified. For example, index data can include one or more of a host identifier, a server identifier, a file identifier, and a process path, while feature data can include one or more of a file path, a process path, and a file operation mode. The file path includes the file directory and file name.

[0090] It should be noted that index data and feature data are not repeated. For example, if the index data includes the process path, the corresponding feature data does not include the process path.

[0091] Each index data also corresponds to an operation time. When writing the webpage operation log into the baseline data set, it is also necessary to establish a corresponding relationship between the operation time of the webpage operation log and the index data and write it. Optionally, the baseline data set can have an index area and a data area. The index area is used to write the index data and the time information corresponding to the index data, which is the operation time. When the baseline time range of the index data is determined, the baseline time range can also be written accordingly to avoid the need to calculate the baseline time range when subsequently obtaining the webpage operation log.

[0092] The data area is used to write feature data corresponding to the index data. Therefore, when writing a webpage operation log, the webpage operation log can be written into the baseline data set in a manner such that the index data and the corresponding operation time are written in the index area, and the feature data corresponding to the index data is written in the feature area.

[0093] Step 203: Determine whether the webpage operation log meets the alarm condition based on the baseline data set. If so, proceed to step 204. If not, end monitoring of the current webpage operation log.

[0094] After the monitoring of the current webpage operation log is completed, when a new webpage operation log is obtained again, the above method is executed again for the newly obtained webpage operation log.

[0095] Optionally, determining whether the webpage operation log meets an alarm condition based on the baseline data set may include the following process:

[0096] (2.1) determining whether the characteristic data in the webpage operation log is consistent with the target characteristic data corresponding to the target index data in the baseline data set; if not, determining that an alarm condition is met;

[0097] In the baseline data set, the index data and the feature data have a corresponding relationship. After determining that the web page operation log has the target index data in the baseline data set, it can be determined whether the feature data in the web page operation log is consistent with the target feature data corresponding to the target index data. It can be understood that the target feature data needs to be compared with the same type when performing the comparison.

[0098] For example, the target feature data includes process path, file path and file operation method, then it is necessary to compare the process path in the web page operation log with the process path in the target feature data, compare the file path in the web page operation log with the file path in the target feature data, and compare the file operation method in the web page operation log with the file operation method in the target feature data. If any one of them is inconsistent, it is determined that the alarm condition is met.

[0099] (2.2) If they are consistent, determining whether the characteristic data of the webpage operation log is periodic data in the baseline data set;

[0100] The periodic data refers to the target feature data being periodically repeated within the operating time range corresponding to the target index data. The time and number of the periodic repetitions are not limited in this application, for example, it is repeated every 2 days.

[0101] Of course, in this embodiment, as another way, in the case of consistency, the judgment on the current webpage operation log can also be ended directly. And judging the periodic data of the webpage operation log can further improve the accuracy of webpage monitoring.

[0102] (2.3) If the data does not belong to the periodic data, it is determined that the alarm condition is met.

[0103] Step 204: Generate warning information for the target website.

[0104] The alarm information may specifically be an alarm information for a host identifier in a webpage operation log, such as a host ID and / or a host address, so that the host where tampering occurs can be quickly located, thereby improving the response and handling speed after tampering occurs.

[0105] In this embodiment, when a webpage operation log for a target website is obtained, it is determined whether the webpage operation log belongs to baseline data. If so, the webpage operation log is written into the baseline data set according to a preset writing method. If not, it is determined based on the baseline data set whether the webpage operation log meets the alarm condition. If it is determined that the alarm condition is met, an alarm message for the target website is generated. It can be seen that the present application can monitor the webpages of the target website through the webpage operation log and the baseline data set, without having to pay attention to changes in the webpage content, thereby reducing the business visits to the webpage.

[0106] Furthermore, using web page operation logs to monitor web pages can ensure that tampering is occurring or has occurred on the web pages, thereby improving the accuracy of determining tampering behavior;

[0107] In addition, the web operation log can quickly locate the host where tampering has occurred, improving the response and handling speed after tampering occurs.

[0108] Another method embodiment of the present application provides a webpage monitoring method. In this embodiment, before obtaining a webpage operation log for a target website, the method further includes: collecting the log for the target website, and if a process path in the log matches a specified process path and an operation file in the log has a specified attribute, determining the log as a webpage operation log;

[0109] The log may be a file process operation log or a web application log.

[0110] Specifically, API HOOK technology can be used to collect file process operation logs about processes, files, and network behaviors.

[0111] To facilitate identification of the webpage operation log, optionally, determining the log as the webpage operation log may include: converting the log into a standard log according to a preset format, and determining the standard log as the webpage operation log.

[0112] The designated process path is used to represent the process of starting the webpage service, and may include a process path used to represent one or more processes of Java, wpw3, httpd, nginx, php-cgi, Tomcat, etc.

[0113] The specified attribute is used to characterize a webpage resource file, such as one or more attributes of an image resource, a static HTML resource, a web script resource, etc. Whether the operation file has the specified attribute can be determined based on the suffix of the operation file's file name. For example, if the suffix is jpg, it is determined to have the attribute of an image resource.

[0114] Optionally, in this embodiment, before collecting logs for the target website, the following steps may also be included:

[0115] Set to collect the file process operation log of the target website, and correspondingly, the type of index data in the baseline data set can be set to include host identification and server identification;

[0116] Alternatively, it is set to collect the file process operation log of the target website, and correspondingly, the index data in the baseline data set can be set to include the host identifier and the file path;

[0117] Alternatively, it is set to collect web application logs of the target website, and correspondingly, the index data in the baseline data set can be set to include a host identifier and a process path.

[0118] When the type of the index data is set to include a host identifier and a server identifier, the characteristic data corresponding to the index data may include: a file path, a process path, and a file operation mode.

[0119] When the type of the index data is set to include a host identifier and a file path, the characteristic data of the corresponding index data may include: a process path;

[0120] When the type of the index data is set to include a host identifier and a process path, the characteristic data corresponding to the index data may include: a file path and a file operation mode.

[0121] Optionally, the baseline data set may include an index area and a data area. The index data under the index data type is written into the index area, and the feature data under the feature data is written into the data area and corresponds to the index data. The index area is also used to write time information corresponding to the index data. Once the baseline time range of the index data is determined, the baseline time range can also be written accordingly.

[0122] The baseline time range can be determined when the first index data is written based on the operation time corresponding to the index data and the specified time length; of course, it can also be determined and written when the baseline time range is needed when the web page operation log is determined later. This is all achievable.

[0123] Another method embodiment of the present application uses web application logs as an example to provide a webpage monitoring method. It should be noted that this embodiment only provides a specific example for web application logs and does not constitute a limitation on other implementation methods. The specific process is as follows:

[0124] (3.1) Set the web application log of the target website to be collected, and set the baseline data set including the index area and the data area. The index area is used to write index data and time information corresponding to the index data. The index data includes the host ID and process path. The data area is used to write feature data corresponding to the index data, including the file path and file operation method.

[0125] Since the web application logs all record operations on the target website using the same process, the baseline data set of this embodiment records operations on the target website using the same process on different hosts.

[0126] (3.2) collecting web application logs for the target website, and if a process path in the web application logs matches a specified process path and an operation file in the web application logs has specified attributes, determining the logs as web operation logs;

[0127] (3.3) The web page operation log obtained for the first time is used as the baseline data and the index area and data area set according to the baseline data set are written into the index area. The host ID and process path as the index data and the operation time as the time information are written into the index area. The file path and file operation method as the feature data are written into the data area corresponding to the index data.

[0128] (3.4) When the webpage operation log is obtained again, it is determined whether the webpage operation log contains the host identifier and process path in the baseline data set. If not, the webpage operation log is written to the baseline data set in the same manner as described in step (3.3). If it does, the operation time corresponding to the host identifier and process path in the webpage operation log in the baseline data set is determined. Based on the operation time and the specified time length, a baseline time range is determined. The baseline time range can also be written to the index area.

[0129] (3.5) Determine whether the operation time in the web page operation log is within the baseline time range. If so, write the web page operation log into the baseline data set in the same manner as in step (3.3). If not, determine whether the file path in the web page operation log is consistent with the corresponding file path in the baseline data set, and whether the file operation method is consistent. If one of them is inconsistent, the alarm condition is met and the alarm information is directly output. If they are consistent, determine whether the characteristic data of the web page operation log is periodic data in the baseline data set. If it is not periodic data, determine that the alarm condition is met and the alarm information is directly output. If it is periodic data, end the judgment on the current web page operation log.

[0130] In a specific application scenario, for example, host A uses process B to operate file C, and the data corresponding to the operation is written into the baseline data set; and subsequently host A uses process B to operate file D. Based on the above method, it can be determined that the operated file has changed, then it is determined that the web page has been tampered with. Therefore, an alarm message can be output to prompt the user that the web page has been tampered with. It can be seen that this embodiment can monitor the web page by monitoring the changes in the operation file.

[0131] Another method embodiment of the present application implements monitoring of web pages by monitoring abnormal processes. It should be noted that this embodiment only provides a specific example of monitoring abnormal processes and does not constitute a limitation on other implementation methods. The specific process is as follows:

[0132] (4.1) Set the collection of file process operation logs of the target website, and set the baseline data set to include an index area and a data area. The index area is used to write index data and time information corresponding to the index data. The index data includes a host identifier and a file path. The data area is used to write feature data corresponding to the index data, including a process path.

[0133] (4.2) collecting file process operation logs for the target website, and if the process path in the file process operation logs matches a specified process path, and the operation files in the web application logs have specified attributes, determining the operation logs as web application operation logs;

[0134] (4.3) The web page operation log obtained for the first time is used as the baseline data and the index area and data area set according to the baseline data set are written into the index area. The host ID and file path as the index data and the operation time as the time information are written into the index area, and the process path as the feature data is written into the data area corresponding to the index data.

[0135] (4.4) When the webpage operation log is obtained again, it is determined whether the webpage operation log contains the host identifier and file path in the baseline data set. If not, the webpage operation log is written to the baseline data set in the same manner as described in step (4.3). If it does, the operation time corresponding to the host identifier and file path in the webpage operation log in the baseline data set is determined. Based on the operation time and the specified time length, a baseline time range is determined. The baseline time range can also be written to the index area.

[0136] (4.5) Determine whether the operation time in the webpage operation log is within the baseline time range. If so, write the webpage operation log into the baseline data set in the same manner as in step (4.3). If not, determine whether the process path in the webpage operation log is consistent with the corresponding process path in the baseline data set. If not, then the alarm condition is met and the alarm information is directly output. If they are consistent, then determine whether the characteristic data of the webpage operation log is periodic data in the baseline data set. If not, then determine whether the alarm condition is met and the alarm information is directly output. If it is periodic data, then terminate the operation on the current webpage operation log.

[0137] In a specific application scenario, for example, host A uses process C when operating file B, and the data corresponding to the operation is written into the baseline data set; and subsequently host A uses process D when operating file B. Based on the above method, it can be determined that the process has changed, then it is determined that the web page has been tampered with. Therefore, an alarm message can be output to prompt the user that the web page has been tampered with. It can be seen that this embodiment can monitor the web page by monitoring the changes in the operation process.

[0138] A method embodiment of the present application provides a method for constructing baseline data, such as Figure 3 As shown, the method may include the following steps:

[0139] Step 301: When a webpage operation log for a target website is obtained, determine whether the webpage operation log contains index data in the baseline data set. If not, proceed to step 304. If so, proceed to step 302.

[0140] In this application, a web page operation log records an operation behavior of a host on a target website, including various data such as file path, file operation method, process path, operation time, host identification, etc.

[0141] The file path includes the file directory and file name, which are used to represent the file information of the operation.

[0142] The file operation mode is used to represent the operation mode performed on the file, such as deletion, creation, modification, renaming, etc.

[0143] A process path characterizes the process used by an operation.

[0144] Operation time is used to represent the time of operation.

[0145] The host identifier is used to identify the host ID and / or host IP address of the operation.

[0146] Optionally, the webpage operation log may further include a server identifier, which may be an identifier customized by a technician for the server and used to indicate the server source of the webpage operation log.

[0147] The baseline data set in this application is generated based on the web page operation log. The type of index data and the type of feature data under the index data can be pre-set to generate baseline data based on the web page operation log and can be written into the baseline data set.

[0148] If the web page operation log does not contain the index data in the baseline data set, it is determined that the baseline data set does not record the index data about the web page operation log, so the web page operation log belongs to the baseline data. Referring to the subsequent steps of this embodiment, it is to write it into the baseline data set according to the preset writing method.

[0149] It is understandable that if no baseline data is recorded in the baseline data set, it means that the web page operation log needs to be written into the baseline data set first, that is, it is determined that the web page operation log belongs to the baseline data. Alternatively, if the baseline data set records the baseline data, but there is no data about the web page operation log in the index data, then the web page operation log also needs to be written into the baseline data set, that is, it can also be determined that the web page operation log belongs to the baseline data. For example, if the index data type is a host identifier, the host identifier in the baseline data set is host A, and the host identifier in the web page operation log is host B, then it is determined that the web page operation log does not contain the index data in the baseline data set, and it is determined that the web page operation log belongs to the baseline data.

[0150] Step 302: determining index data included in the webpage operation log in the baseline data set as target index data;

[0151] Step 303: Determine whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data. If so, proceed to step 304; if not, proceed to step 305.

[0152] In a baseline data set, each index data item corresponds to a baseline time range. This baseline time range can be based on the operation time of the first index data item written, and can be extended by a specified time length. For example, if the index data is for host A and the operation time corresponding to the first write is 2022-11-15 20:00:00, the baseline time range is two weeks after this time, that is, the baseline time range is 2022-11-15 20:00:00 to 2022-11-29 20:00:00.

[0153] It is understandable that two weeks is only a specific example of the specified time length and does not constitute a limitation. The application can set the specified time length based on actual circumstances.

[0154] Step 304: Determine that the webpage operation log belongs to baseline data, and write the webpage operation log belonging to the baseline data into the baseline data set according to a preset writing method;

[0155] The webpage operation log writing method is pre-set. In one method, the webpage operation log can be directly written into the baseline data set as baseline data. In another method, to facilitate management and data location, the webpage operation log is written into the baseline data set according to the pre-set writing method, which may include: writing the webpage operation log into the baseline data set by establishing corresponding operation time and feature data using index data as an index.

[0156] The types of index data and feature data can be pre-specified. For example, index data can include one or more of a host identifier, a server identifier, a file identifier, and a process path, while feature data can include one or more of a file path, a process path, and a file operation mode. The file path includes the file directory and file name.

[0157] It should be noted that index data and feature data are not repeated. For example, if the index data includes the process path, the corresponding feature data does not include the process path.

[0158] Each index data also corresponds to an operation time. When writing the webpage operation log into the baseline data set, it is also necessary to establish a corresponding relationship between the operation time of the webpage operation log and the index data and write it. Optionally, the baseline data set can have an index area and a data area. The index area is used to write the index data and the time information corresponding to the index data, which is the operation time. When the baseline time range of the index data is determined, the baseline time range can also be written accordingly to avoid the need to calculate the baseline time range when subsequently obtaining the webpage operation log.

[0159] The data area is used to write feature data corresponding to the index data. Therefore, when writing a webpage operation log, the webpage operation log can be written into the baseline data set in a manner such that the index data and the corresponding operation time are written in the index area, and the feature data corresponding to the index data is written in the feature area.

[0160] Step 305: Determine that the webpage operation log does not belong to baseline data.

[0161] Web page operation logs that do not belong to baseline data will not be written into the baseline data set. Optionally, web page operation logs that do not belong to baseline data can be monitored based on the baseline data set, such as judging whether they meet alarm conditions based on the baseline data set.

[0162] In this embodiment, when a web page operation log for a target website is obtained, it is determined whether the web page operation log contains index data in a baseline data set. If not, it is determined that the web page operation log belongs to baseline data. If so, it is determined that the index data contained in the web page operation log in the baseline data set is target index data. It is determined whether the operation time in the web page operation log is within the baseline time range corresponding to the target index data. If it is within the baseline time range, it is determined that the web page operation log belongs to baseline data. If it is not within the baseline time range, it is determined that the web page operation log does not belong to baseline data. The web page operation log belonging to the baseline data is written into the baseline data set according to a preset writing method. It can be seen that the present application can realize the construction of a baseline data set through the web page operation log, which can be used for subsequent web page monitoring.

[0163] Corresponding to the aforementioned application function implementation method embodiment, the present application also provides a web page monitoring device, a baseline data construction device, an electronic device and corresponding embodiments.

[0164] Figure 4 It is a structural diagram of a web page monitoring device shown in an embodiment of the present application.

[0165] See also Figure 4 , the apparatus may include: an alarm determination unit 110 and a first generation unit 120;

[0166] The alarm determination unit 110, when obtaining a webpage operation log for a target website, determines whether the webpage operation log meets the alarm condition based on the constructed baseline data set; wherein the baseline data set is constructed based on the webpage operation log;

[0167] The first generating unit 120 is configured to generate warning information for the target website when it is determined that the warning condition is met.

[0168] Another embodiment of the present application provides a webpage monitoring device, such as Figure 5 As shown, the device includes: a first judgment unit 130, a first writing unit 140, an alarm judgment unit 110 and a first generation unit 120; wherein:

[0169] The first judgment unit 130, when obtaining a webpage operation log for the target website, judges whether the webpage operation log belongs to baseline data;

[0170] The first writing unit 140 is configured to write the webpage operation log into the baseline data set according to a preset writing method when determining that the webpage operation log belongs to the baseline data;

[0171] An alarm determination unit 110 is configured to determine whether the webpage operation log meets an alarm condition based on the baseline data set when it is determined that the webpage operation log does not belong to the baseline data;

[0172] The first generating unit 120 is configured to generate warning information for the target website when it is determined that the warning condition is met.

[0173] The alarm information may specifically be an alarm information for a host identifier in a webpage operation log, such as a host ID and / or a host address, so that the host where tampering occurs can be quickly located, thereby improving the response and handling speed after tampering occurs.

[0174] The first judgment unit 130 includes: a first judgment module, a first determination module, a second determination module, a second judgment module, a third determination module, and a fourth determination module; specifically:

[0175] A first judgment module is configured to, when a webpage operation log for a target website is obtained, determine whether the webpage operation log contains index data in the baseline data set;

[0176] a first determining module, configured to determine that the webpage operation log belongs to the baseline data when it is determined that the webpage operation log does not contain the index data in the baseline data set;

[0177] a second determining module, configured to, when determining that the webpage operation log includes the index data in the baseline data set, determine the index data included in the webpage operation log in the baseline data set as target index data;

[0178] A second judgment module is used to judge whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data;

[0179] a third determining module, configured to determine whether the webpage operation log belongs to baseline data within the baseline time range;

[0180] The fourth determining module is configured to determine that the webpage operation log is not within the baseline time range and does not belong to the baseline data.

[0181] The alarm judgment unit 110 may include: a third judgment module, a fifth determination module, a fourth judgment module, and a sixth determination module; specifically:

[0182] a third judgment module, configured to, upon determining that the webpage operation log does not belong to the baseline data, judge whether the feature data in the webpage operation log is consistent with the target feature data corresponding to the target index data in the baseline data set;

[0183] A fifth determination module, configured to determine whether an alarm condition is satisfied in the event of inconsistency;

[0184] A fourth determination module is configured to determine, in the event of consistency, whether the characteristic data of the webpage operation log is periodic data in the baseline data set, wherein the periodic data refers to the periodic repetition of the target characteristic data within the operation time range corresponding to the target index data;

[0185] The sixth determining module is used to determine that the alarm condition is satisfied when the data does not belong to the periodic data.

[0186] Optionally, the first writing unit 140 is specifically configured to write the webpage operation log into the baseline data set by establishing corresponding operation time and feature data using index data as an index when determining that the webpage operation log belongs to the baseline data.

[0187] As another implementation manner, the first writing unit 140 may be specifically configured to directly write the webpage operation log as the baseline data into the baseline data set.

[0188] This embodiment can monitor the target website's web pages through web page operation logs and baseline data sets, without having to pay attention to changes in web page content, thus reducing the business visits to the web pages.

[0189] Furthermore, using web page operation logs to monitor web pages can ensure that tampering is occurring or has occurred on the web pages, thereby improving the accuracy of determining tampering behavior;

[0190] In addition, the web operation log can quickly locate the host where tampering has occurred, improving the response and handling speed after tampering occurs.

[0191] Another device embodiment of the present application provides a webpage monitoring device. In this embodiment, the device may include: a collection and determination unit; wherein:

[0192] a collection and determination unit, configured to collect logs for the target website, and determine the logs as webpage operation logs if a process path in the logs matches a specified process path and an operation file in the logs has a specified attribute;

[0193] The log is a file process operation log or a web application log.

[0194] To facilitate identification of the webpage operation log, optionally, the collection and determination unit determines the log as the webpage operation log, specifically by converting the log into a standard log according to a preset format, and determining the standard log as the webpage operation log.

[0195] Optionally, the device may further include:

[0196] A first setting unit is used to pre-set the collection of file process operation logs of the target website, and can also be used to set index data in the baseline data set including host identifiers and server identifiers;

[0197] Alternatively, the second setting unit is used to pre-set the collection of file process operation logs of the target website, and can also be used to set the index data in the baseline data set to include the host identifier and the file path;

[0198] Alternatively, the third setting unit is configured to pre-set the collection of web application logs of the target website, and may also set the index data in the baseline data set to include a host identifier and a process path.

[0199] When the index data is set to include a host identifier and a server identifier, the characteristic data corresponding to the index data may include: a file path, a process path, and a file operation mode.

[0200] When the index data is set to include a host identifier and a file path, the characteristic data corresponding to the index data may include: a process path;

[0201] When the index data is set to include a host identifier and a process path, the characteristic data corresponding to the index data may include: a file path and a file operation mode.

[0202] It can be seen that in this embodiment, file process operation logs or web page operation logs can be used, and web page operation logs can be filtered out from them. Since the logs used are underlying data, the monitoring method of this application for web pages is more versatile; and through screening, the amount of information for subsequent data processing can be reduced, further improving monitoring efficiency.

[0203] An embodiment of the present application also provides a baseline data construction device, such as Figure 6 As shown, the device includes: a data judgment unit 210, a first determination unit 220, a second determination unit 230, a range judgment unit 240, a third determination unit 250, a fourth determination unit 260 and a data writing unit 270; wherein:

[0204] The data determination unit 210 is configured to determine whether a webpage operation log for a target website contains index data in the baseline data set when the webpage operation log is obtained;

[0205] A first determining unit 220 is configured to determine that the webpage operation log belongs to the baseline data when the webpage operation log does not contain index data in the baseline data set;

[0206] A second determining unit 230 is configured to determine, when the webpage operation log includes index data in the baseline data set, that the index data included in the webpage operation log in the baseline data set is target index data;

[0207] A range determination unit 240 is configured to determine whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data;

[0208] A third determining unit 250 is configured to determine that the webpage operation log belongs to baseline data if the operation time in the webpage operation log is within the baseline time range corresponding to the target index data;

[0209] A fourth determining unit 260 is configured to determine that the webpage operation log does not belong to baseline data if the operation time in the webpage operation log is not within the baseline time range corresponding to the target index data;

[0210] The data writing unit 270 is configured to write the webpage operation log belonging to the baseline data into the baseline data set according to a preset writing method.

[0211] Optionally, the data writing unit 270 is specifically configured to write the webpage operation log belonging to the baseline data into the baseline data set in a manner of establishing corresponding operation time and feature data using index data as an index.

[0212] As another implementation, the data writing unit 270 may be configured to directly write the webpage operation log as the baseline data into the baseline data set.

[0213] In this embodiment, when a web page operation log for a target website is obtained, it is determined whether the web page operation log contains index data in a baseline data set. If not, it is determined that the web page operation log belongs to baseline data. If so, it is determined that the index data contained in the web page operation log in the baseline data set is target index data. It is determined whether the operation time in the web page operation log is within the baseline time range corresponding to the target index data. If it is within the baseline time range, it is determined that the web page operation log belongs to baseline data. If it is not within the baseline time range, it is determined that the web page operation log does not belong to baseline data. The web page operation log belonging to the baseline data is written into the baseline data set according to a preset writing method. It can be seen that the present application can realize the construction of a baseline data set through the web page operation log, which can be used for subsequent web page monitoring.

[0214] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated again here.

[0215] Figure 7 It is a structural diagram of an electronic device shown in an embodiment of the present application.

[0216] See also Figure 7 , the electronic device 1000 includes a memory 1010 and a processor 1020.

[0217] The processor 1020 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0218] The memory 1010 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by the processor 1020 or other modules of the computer. The permanent storage device may be a readable and writable storage device. The permanent storage device may be a non-volatile storage device that retains stored instructions and data even when the computer is powered off. In some embodiments, the permanent storage device uses a large-capacity storage device (such as a magnetic or optical disk, flash memory) as the permanent storage device. In other embodiments, the permanent storage device may be a removable storage device (such as a floppy disk, optical drive). The system memory may be a readable and writable storage device or a volatile readable and writable storage device, such as dynamic random access memory. The system memory may store some or all instructions and data required by the processor during operation. In addition, the memory 1010 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and magnetic disks and / or optical disks may also be used. In some embodiments, the memory 1010 may include a readable and / or writable removable storage device, such as a compact disc (CD), a read-only digital versatile disc (e.g., DVD-ROM, double-layer DVD-ROM), a read-only Blu-ray disc, an ultra-high-density optical disc, a flash memory card (e.g., SD card, mini-SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not include carrier waves and transient electronic signals transmitted wirelessly or by wire.

[0219] The memory 1010 stores executable codes. When the executable codes are processed by the processor 1020 , the processor 1020 may execute part or all of the above-mentioned methods.

[0220] The scheme of the present application has been described in detail above with reference to the accompanying drawings. In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. Those skilled in the art should also be aware that the actions and modules involved in the description are not necessarily required for this application. In addition, it is understood that the steps in the method of the embodiment of the present application can be adjusted in sequence, merged and deleted according to actual needs, and the modules in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

[0221] In addition, the method according to the present application may also be implemented as a computer program or a computer program product, which includes computer program code instructions for executing some or all of the steps in the above method of the present application.

[0222] Alternatively, the present application can also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) on which executable code (or computer program, or computer instruction code) is stored. When the executable code (or computer program, or computer instruction code) is executed by a processor of an electronic device (or electronic device, server, etc.), the processor executes part or all of the steps of the above-mentioned method according to the present application.

[0223] Those skilled in the art will further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the application herein may be implemented as electronic hardware, computer software, or combinations of both.

[0224] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems and methods according to multiple embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a part of a module, program segment or code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0225] The embodiments of the present application have been described above. The above description is illustrative and not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A webpage monitoring method, characterized in that: include: When a webpage operation log for a target website is obtained, determining whether the feature data in the webpage operation log is consistent with the target feature data corresponding to the target index data in the baseline data set; If there is any inconsistency, determining that an alarm condition is satisfied; wherein the target index data is index data in the baseline data set included in the webpage operation log, and the feature data and the target feature data both include at least one of a file path, a process path, and a file operation mode; and the baseline data set is constructed based on the webpage operation log; If they are consistent, determining whether the characteristic data of the webpage operation log is periodic data in the baseline data set; wherein the periodic data refers to the periodic repetition of the target characteristic data within the operation time range corresponding to the target index data; if it is not periodic data, determining that the alarm condition is met; When it is determined that the alarm condition is met, alarm information for the target website is generated.

2. The method according to claim 1, characterized in that Also includes: Determining whether the webpage operation log belongs to baseline data, and if so, writing the webpage operation log into the baseline data set according to a preset writing method; If not, the step of determining whether the webpage operation log meets the alarm condition based on the constructed baseline data set and all subsequent steps are executed.

3. The method according to claim 2, characterized in that Determining whether the webpage operation log belongs to baseline data includes: determining whether the webpage operation log contains index data in the baseline data set, and if not, determining that the webpage operation log belongs to the baseline data; If so, determine that the index data contained in the web page operation log in the baseline data set is the target index data, and judge whether the operation time in the web page operation log is within the baseline time range corresponding to the target index data. If it is within the baseline time range, determine that the web page operation log belongs to the baseline data; if it is not within the baseline time range, determine that the web page operation log does not belong to the baseline data.

4. The method according to claim 3, characterized in that Writing the webpage operation log into the baseline data set according to a preset writing method includes: The webpage operation log is written into the baseline data set in a manner of establishing corresponding operation time and feature data using index data as an index.

5. A baseline data construction method, characterized in that: include: When a webpage operation log for a target website is obtained, determining whether the webpage operation log contains index data in the baseline data set, and if not, determining that the webpage operation log belongs to the baseline data; If so, determining that the index data included in the webpage operation log in the baseline data set is the target index data, and judging whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data; if it is within the baseline time range, determining that the webpage operation log belongs to the baseline data; if not, determining that the webpage operation log does not belong to the baseline data; Writing the webpage operation log belonging to the baseline data into the baseline data set according to a preset writing method; The method also includes: when it is determined that the web page operation log does not belong to the baseline data, judging whether the characteristic data in the web page operation log is consistent with the target characteristic data corresponding to the target index data in the baseline data set; if they are inconsistent, determining that the alarm condition is met; wherein, the characteristic data and the target characteristic data both include at least one of a file path, a process path and a file operation mode; if they are consistent, judging whether the characteristic data of the web page operation log belongs to periodic data in the baseline data set; wherein, the periodic data refers to the target characteristic data being periodically repeated within the operation time range corresponding to the target index data; if it does not belong to the periodic data, determining that the alarm condition is met.

6. A webpage monitoring device, characterized in that: include: The alarm judgment unit, when obtaining a web page operation log for a target website, judges whether the characteristic data in the web page operation log is consistent with the target characteristic data corresponding to the target index data in the baseline data set; if not, determines that the alarm condition is met; wherein, the target index data is the index data in the baseline data set included in the web page operation log, and the characteristic data and the target characteristic data both include at least one of a file path, a process path and a file operation mode; the baseline data set is constructed based on the web page operation log; if consistent, judges whether the characteristic data of the web page operation log belongs to periodic data in the baseline data set; wherein, the periodic data refers to the periodic repetition of the target characteristic data within the operation time range corresponding to the target index data; if not, determines that the alarm condition is met; The first generating unit is configured to generate warning information for the target website when it is determined that the warning condition is met.

7. A baseline data construction device, characterized in that: include: a data determination unit configured to, upon obtaining a webpage operation log for a target website, determine whether the webpage operation log contains index data in the baseline data set; a first determining unit, configured to determine that the webpage operation log belongs to the baseline data when the webpage operation log does not contain the index data in the baseline data set; a second determining unit, configured to determine, when the webpage operation log includes index data in the baseline data set, that the index data included in the webpage operation log in the baseline data set is target index data; A range determination unit, configured to determine whether the operation time in the webpage operation log is within the baseline time range corresponding to the target index data; a third determining unit, configured to determine that the webpage operation log belongs to the baseline data if the operation time in the webpage operation log is within the baseline time range corresponding to the target index data; a fourth determining unit, configured to determine that the webpage operation log does not belong to the baseline data if the operation time in the webpage operation log is not within the baseline time range corresponding to the target index data; A data writing unit, configured to write the webpage operation log belonging to the baseline data into the baseline data set according to a preset writing method; The device further comprises: a third judgment module, configured to, upon determining that the webpage operation log does not belong to the baseline data, judge whether the feature data in the webpage operation log is consistent with the target feature data corresponding to the target index data in the baseline data set; A fifth determination module, configured to determine that an alarm condition is satisfied in the event of inconsistency; wherein both the characteristic data and the target characteristic data include at least one of a file path, a process path, and a file operation mode; A fourth determination module is configured to determine, in the event of consistency, whether the characteristic data of the webpage operation log is periodic data in the baseline data set, wherein the periodic data refers to the periodic repetition of the target characteristic data within the operation time range corresponding to the target index data; The sixth determining module is used to determine that the alarm condition is satisfied when the data does not belong to the periodic data.

8. An electronic device, characterized in that: include: processor; as well as A memory having executable codes stored thereon, which, when executed by the processor, causes the processor to execute the method according to any one of claims 1 to 5.

9. A non-transitory machine-readable storage medium having executable code stored thereon, wherein when the executable code is executed by a processor of an electronic device, the processor is caused to execute the method according to any one of claims 1 to 5.

Images