A website loading visualization method and apparatus

Abstract

The application relates to a website loading visualization method and device, which comprises the following steps: accessing each webpage corresponding to a target website in a target running environment; obtaining access data generated in the process of accessing each webpage, and generating webpage information set corresponding to each webpage; determining the corresponding association information of each webpage according to the corresponding relationship information set of each webpage; and creating the first visualization view corresponding to the target website according to the webpage information set and the association information of each webpage. The application determines the corresponding relationship between each webpage of the target webpage, and displays the corresponding relationship in the form of a visualization view, so that the website manager can clearly understand all the explicit and implicit access chains and access paths of the target website, and thus can master the security situation of the target website.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for visualizing website loading. Background Technology

[0002] Currently, phishing, website defacement, and malware attacks are rampant. Some malicious organizations even use black-hat SEO techniques to embed redirect code into website source code. These attacks are often highly targeted and covert, and the cost is relatively low. Therefore, in-depth analysis of cyberattacks is of great significance for maintaining network security. Existing detection and analysis methods cannot intuitively and comprehensively display website structure and function calls, which is not conducive to understanding attackers' thinking and methods. Moreover, for network administrators lacking professional knowledge, discovering network security incidents and conducting source tracing analysis has a high barrier to entry, increasing the subsequent repair and maintenance costs. Summary of the Invention

[0003] In view of this, the present invention provides a website loading visualization method and apparatus, which accesses each webpage of a target website in a target operating environment, obtains access data generated during the access of each webpage, determines the correspondence between each webpage, and displays it in a visual view. This can help website administrators clearly understand all explicit and implicit access chains and access paths of the target website, thereby grasping the security status of the target website, and at least partially solving the problems existing in the prior art.

[0004] The specific content of the invention is as follows:

[0005] A website loading visualization method, comprising:

[0006] Access each webpage of the target website within the target operating environment.

[0007] The access data generated during the access to each webpage is obtained, and a webpage information set corresponding to each webpage is generated; the webpage information set includes a basic information set and a relationship information set.

[0008] Based on the relationship information set corresponding to each webpage, its corresponding association information is determined; the association information is used to represent each associated webpage and the correspondence between it and the associated webpage.

[0009] Based on the webpage information set and related information of each webpage, a first visual view corresponding to the target website is created.

[0010] Furthermore, the method further includes, prior to:

[0011] The target hardware environment is determined from several candidate hardware environments.

[0012] Determine the target operating system corresponding to the target hardware environment.

[0013] A virtual machine is created based on the target hardware environment and the target operating system to obtain an intermediate runtime environment.

[0014] The target runtime environment was obtained by installing a web access program and a web crawler within the intermediate runtime environment.

[0015] Furthermore, the access to each webpage corresponding to the target website in the target operating environment includes:

[0016] Determine the target website and its main domain name.

[0017] Access the target website using the target operating environment and monitor the access status.

[0018] When the access status meets the termination conditions, the access to the corresponding access path is terminated.

[0019] The conditions for terminating access include: when a webpage redirect occurs, the main domain of the redirected webpage does not match the main domain of the target website; and / or a loop of access is detected under the main domain of the target website.

[0020] Furthermore, the basic information set includes webpage elements and webpage attributes of the corresponding webpage; the relationship information set includes the association between at least one webpage element of the corresponding webpage and webpage elements of other webpages, as well as the association between at least some webpage elements of the corresponding webpage and the association type; the method further includes:

[0021] Based on the basic information set and relational information set included in the web page information set corresponding to each web page, a second visualization view corresponding to each web page is constructed.

[0022] Further, the step of acquiring access data generated during the access to each webpage and generating a webpage information set corresponding to each webpage includes:

[0023] The web page elements and attributes of each web page are obtained to obtain the basic information set corresponding to each web page; the web page elements include the web page's HTML elements, variables, strings, loops, references, conditional statements, and functions in the web page source code; the web page attributes include the web page's IP address, main domain name, DNS resolution path, and ICP filing status.

[0024] Obtain the source code and corresponding network traffic of each webpage. Based on the source code and network traffic, analyze the relationships between webpage elements of each webpage and the relationships between webpage elements of each webpage and webpage elements of other webpages to obtain the relationship information set corresponding to each webpage.

[0025] The basic information set and relational information set corresponding to each webpage are determined as the webpage information set corresponding to that webpage.

[0026] Further, the step of constructing a first visual view corresponding to the target website based on the webpage information set and related information of each webpage includes:

[0027] Based on the webpage information set and related information of each webpage, determine the associated webpages corresponding to each webpage and the correspondence between the associated webpages.

[0028] Get the second visual view corresponding to each webpage.

[0029] Based on the correspondence between each webpage and its associated webpage, several first connection components are created to connect the second visualization view.

[0030] Each second visualization view and each first connection component are connected and combined according to their correspondence to obtain the first visualization view corresponding to the target website.

[0031] Further, the step of constructing a second visual view corresponding to each webpage based on the basic information set and relational information set included in the webpage information set corresponding to each webpage includes:

[0032] Based on the relationships and association types between web page elements included in the relationship information set corresponding to each web page, create corresponding node components for the web page elements with related relationships for each web page.

[0033] Based on the association type of the related web page elements of each web page, create several second connection components to connect the corresponding node components.

[0034] The node components and second connection components corresponding to each webpage are connected and combined according to their correspondence to obtain the relationship view corresponding to each webpage.

[0035] The basic information set corresponding to each webpage is sent to the visualization area of ​​its corresponding relationship view to obtain the second visualization view corresponding to each webpage.

[0036] Further, the step of connecting and combining each second visualization view and each first connection component according to their correspondence includes:

[0037] Based on the relationship between at least one webpage element in the relationship information set corresponding to each webpage and the webpage elements of other webpages, determine the correspondence between at least one node component in each second visualization view and the node components in other second visualization views.

[0038] Based on the correspondence between the determined node components, the corresponding node component in each of the second visualization views and each of the first connection components are connected and combined according to their correspondence.

[0039] Furthermore, the method also includes:

[0040] Obtain the main domain name of the target website.

[0041] Obtain the main domain name from the webpage attributes contained in the basic information set of each second visualization view, and determine whether it is the same as the main domain name of the target website. If they are not the same, determine that the webpage corresponding to the second visualization view is the target webpage.

[0042] Based on the first visualization view, an access path to the target webpage is determined; the access path includes the webpages and webpage elements that are passed through to reach the target webpage.

[0043] The access path is analyzed to determine the target event.

[0044] A website loading visualization device, comprising:

[0045] The website access module is used to access each webpage of the target website within the target runtime environment.

[0046] The data acquisition module is used to acquire access data generated during the access process of each webpage and generate a webpage information set corresponding to each webpage; the webpage information set includes a basic information set and a relationship information set.

[0047] The association analysis module is used to determine the corresponding association information based on the relationship information set corresponding to each webpage; the association information is used to represent each associated webpage and the correspondence between it and the associated webpage.

[0048] The visualization module is used to construct a first visualization view corresponding to the target website based on the web page information set and related information of each web page.

[0049] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned website loading visualization method.

[0050] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the aforementioned website loading visualization method.

[0051] The beneficial effects of this invention are reflected in:

[0052] This invention determines the correspondence between each webpage of a target website and displays it in a visual view. This helps website administrators clearly understand all explicit and implicit access chains and paths of the target website, thereby grasping the security status of the target website. The first visual view of this invention helps website administrators intuitively grasp the loading process of the target website, including the execution process of each function, the calling process, the judgment process, and the webpage redirection process. It clearly shows each step of the target website loading process, helps understand the internal webpage redirection process of the target website and the loading process of redirecting from the target website to other websites, helps identify the risks in these processes, effectively improves the detection efficiency of attacks such as webpage tampering, code injection, phishing, and spoofing, and provides intuitive visual support for the analysis and tracing of related attacks. Compared with extensive source code analysis of the target website loading process, this invention solves the problems of difficult and unclear website source code analysis, effectively reducing the complexity of the work and improving the work efficiency of website administrators. Attached Figure Description

[0053] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a flowchart of a website loading visualization method according to an embodiment of the present invention;

[0055] Figure 2 This is a flowchart of another website loading visualization method according to an embodiment of the present invention;

[0056] Figure 3 This is a structural diagram of a website loading visualization device according to an embodiment of the present invention. Detailed Implementation

[0057] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0058] It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0059] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0060] This invention provides an embodiment of a website loading visualization method, such as... Figure 1 As shown, it includes:

[0061] S11: Access each webpage of the target website in the target operating environment.

[0062] S12: Obtain access data generated during the access process of each webpage, and generate a webpage information set corresponding to each webpage; the webpage information set includes a basic information set and a relationship information set.

[0063] S13: Based on the relationship information set corresponding to each webpage, determine its corresponding association information; the association information is used to represent each associated webpage and the correspondence between it and the associated webpages; wherein, the associated webpage can be any of the several webpages corresponding to the target website except for the current webpage; the associated webpage is determined through the relationship information set of the current webpage. The correspondence between each webpage and its associated webpages includes login, redirection, and invocation, etc.

[0064] S14: Based on the webpage information set and related information of each webpage, create a first visual view corresponding to the target website.

[0065] Figure 1 The embodiments described above determine the correspondence between each webpage of the target website and display it in a visual view, which can help website administrators clearly understand all explicit and implicit access chains and access paths of the target website, thereby grasping the security status of the target website. Figure 1The first visualization view in this embodiment helps website administrators intuitively grasp the loading process of a target website, including the execution process of each function, the calling process, the judgment process, and the page redirection process. It clearly shows each step of the target website loading process, helps understand the internal page redirection process of the target website and the loading process of redirecting from the target website to other websites, helps identify the risks involved in these processes, effectively improves the efficiency of detecting attacks such as page tampering, code injection, phishing, and spoofing, and provides intuitive visualization support for the analysis and tracing of related attacks. Compared with extensive source code analysis of the target website loading process, Figure 1 The embodiments described above solve the problems of difficult and unclear website source code analysis, effectively reduce the complexity of the work, and improve the work efficiency of website administrators.

[0066] Preferably, the method further includes, prior to:

[0067] The target hardware environment is determined from several candidate hardware environments; each candidate hardware environment has several corresponding operating systems.

[0068] Determine the target operating system corresponding to the target hardware environment.

[0069] A virtual machine is created based on the target hardware environment and the target operating system to obtain an intermediate runtime environment.

[0070] The target runtime environment was obtained by installing a web access program and a web crawler within the intermediate runtime environment.

[0071] The above preferred solution provides a deployment method for the target operating environment. The candidate hardware environments include PC-based and mobile-based hardware environments, and the operating systems include Windows, Android, and Linux. To more realistically simulate user access to the target website and trigger higher-privilege access operations, thus helping to obtain more comprehensive explicit and implicit access chains and paths, corresponding hardware fingerprinting, browser fingerprinting, and other tools can be deployed in the target operating environment. Sometimes a network attack may only target PCs or only mobile devices; therefore, deploying multiple target operating environments ensures timely detection of network attacks and timely deployment of preventative measures, minimizing network security risks.

[0072] Preferably, accessing each webpage of the target website in the target operating environment includes:

[0073] Determine the target website and its main domain name.

[0074] Access the target website using the target operating environment and monitor the access status.

[0075] When the access status meets the termination conditions, the access to the corresponding access path is terminated.

[0076] The conditions for terminating access include: when a webpage redirect occurs, the main domain of the redirected webpage does not match the main domain of the target website; and / or a loop of access is detected under the main domain of the target website.

[0077] The above-mentioned preferred solution controls access to the target website within the target website's main domain, which helps to detect targeted network attacks on the target website without extending to other main domain websites. This maintains the security of the target operating environment and does not waste additional computing resources.

[0078] Preferably, the basic information set includes webpage elements and webpage attributes of the corresponding webpage, the relationship information set includes the association relationship between at least one webpage element of the corresponding webpage and webpage elements of other webpages, and the association relationship and association type between at least some webpage elements of the corresponding webpage, and the method further includes:

[0079] Based on the basic information set and relational information set included in the webpage information set corresponding to each webpage, a second visualization view is constructed for each webpage. The association types between webpage elements include references, calls, and judgments. The second visualization view can help website administrators intuitively grasp the loading status of each webpage, clearly understand every detail of the target website's loading process, and facilitate further detailed analysis of the explicit and implicit access chains and access paths contained in the target website, enabling timely detection of suspicious loading processes.

[0080] Preferably, the step of acquiring access data generated during the access to each webpage and generating a webpage information set corresponding to each webpage includes:

[0081] The web page elements and attributes of each web page are obtained to obtain the basic information set corresponding to each web page; the web page elements include the web page's HTML elements, variables, strings, loops, references, conditional statements, and functions in the web page source code; the web page attributes include the web page's IP address, main domain name, DNS resolution path, and ICP filing status.

[0082] Obtain the source code and corresponding network traffic of each webpage. Based on the source code and network traffic, analyze the relationships between webpage elements of each webpage and the relationships between webpage elements of each webpage and webpage elements of other webpages to obtain the relationship information set corresponding to each webpage.

[0083] The basic information set and relational information set corresponding to each webpage are determined as the webpage information set corresponding to that webpage.

[0084] The aforementioned preferred solution analyzes the loading process of the target website based on the source code and network traffic of each webpage, obtaining the relationships between webpage elements and their relationships with elements of other webpages. This process involves sorting out the entire loading process of the target website. By using the relationship information set of each webpage, the explicit and implicit access chains and paths contained in the target website, as well as the start and end points of access, can be determined. The visualization view created based on this information can help website administrators intuitively analyze the components and security of the target website and its corresponding webpages, and determine whether there are security risks such as webpage tampering or code injection, greatly reducing manual sorting time and simplifying the workflow. Compared with analyzing the loading process of the target website through extensive source code analysis, this solution solves the problems of difficult and unclear website source code analysis, effectively reducing work complexity and improving the work efficiency of website administrators.

[0085] Preferably, constructing the first visual view corresponding to the target website based on the webpage information set and related information of each webpage includes:

[0086] Based on the webpage information set and related information of each webpage, determine the associated webpages corresponding to each webpage and the correspondence between the associated webpages.

[0087] Get the second visual view corresponding to each webpage.

[0088] Based on the correspondence between each webpage and its associated webpage, several first connection components are created to connect the second visualization view.

[0089] Each second visualization view and each first connection component are connected and combined according to their correspondence to obtain the first visualization view corresponding to the target website.

[0090] Preferably, constructing a second visual view corresponding to each webpage based on the basic information set and relational information set included in the webpage information set corresponding to each webpage includes:

[0091] Based on the relationships and association types between web page elements included in the relationship information set corresponding to each web page, create corresponding node components for the web page elements with related relationships for each web page.

[0092] Based on the association type of the related web page elements of each web page, create several second connection components to connect the corresponding node components.

[0093] The node components and second connection components corresponding to each webpage are connected and combined according to their correspondence to obtain the relationship view corresponding to each webpage.

[0094] The basic information set corresponding to each webpage is sent to the visualization area of ​​its corresponding relationship view to obtain the second visualization view corresponding to each webpage.

[0095] Preferably, the step of connecting and combining each second visual view and each first connecting component according to their correspondence includes:

[0096] Based on the relationship between at least one webpage element in the relationship information set corresponding to each webpage and the webpage elements of other webpages, determine the correspondence between at least one node component in each second visualization view and the node components in other second visualization views.

[0097] Based on the correspondence between the determined node components, the corresponding node component in each of the second visualization views and each of the first connection components are connected and combined according to their correspondence.

[0098] Preferably, the method further includes:

[0099] Obtain the main domain name of the target website.

[0100] Obtain the main domain name from the webpage attributes contained in the basic information set of each second visualization view, and determine whether it is the same as the main domain name of the target website. If they are not the same, determine that the webpage corresponding to the second visualization view is the target webpage.

[0101] Based on the first visualization view, an access path to the target webpage is determined; the access path includes the webpages and webpage elements that are passed through to reach the target webpage.

[0102] The access path is analyzed to determine the target event.

[0103] Based on the aforementioned preferred solutions, for Figure 1 The application of the above embodiments is illustrated in the following examples:

[0104] The visual view of the target website's H1 webpage, specifically the second visual view corresponding to H1, shows that this webpage has a function to determine the accessing device. Access from a PC and the corresponding first and second visual views of the relevant webpages display normally. However, access from a mobile device and the corresponding first and second visual views of H1 show an access path involving login redirection, redirecting to H2 webpage. The main domain of H2 webpage is different from H1. The second visual view of H2 webpage reveals that the entered login information is sent via H2 webpage to an email address located overseas. This indicates that the target website has been compromised and a phishing webpage targeting mobile devices has been added.

[0105] The second visualization view of the target website's H3 page shows that the page contains statements that determine if the access comes from search engine crawlers. It indicates that if the access comes from search engine crawlers such as Baidu and Google, it will redirect to the H4 page; otherwise, it will redirect to the target website's homepage. The visualization view of the H4 page shows that it is an advertising page, and its IP address is located overseas, and its DNS resolution path also points to a location overseas. Therefore, it can be determined that the target website has been compromised and redirection code has been injected.

[0106] At this point, based on the first visual view of the target website, several access paths leading to the H2 and H4 web pages can be determined. By conducting in-depth analysis of the access paths, the target event can be identified, and information such as the attack type, attack method, attack source, and attack target of the target event can be obtained.

[0107] As can be seen from the examples above. Figure 1 The embodiments described herein can help website administrators analyze the security of target websites. When a target website is compromised, it can provide support for the source analysis of attack events and help analyze attack strategies and paths, providing intelligence support for network security technology optimization research and maintaining network security.

[0108] To further illustrate the present invention, another embodiment of a website loading visualization method is provided in conjunction with the foregoing preferred embodiments, such as... Figure 2 As shown, it includes:

[0109] S21: Determine the target website and the main domain name of the target website.

[0110] S22: Access each webpage of the target website using the target runtime environment and monitor the access status. The target runtime environment is deployed before implementing the method described in this embodiment, including: determining the target hardware environment from several candidate hardware environments; each candidate hardware environment has several corresponding operating systems; determining the target operating system corresponding to the target hardware environment; establishing a virtual machine based on the target hardware environment and the target operating system to obtain an intermediate runtime environment; installing a webpage access program and a crawler in the intermediate runtime environment to obtain the target runtime environment. Deploying multiple target runtime environments can ensure timely detection of network attacks and timely deployment of preventive measures, minimizing network security risks. Monitoring the access status includes: ending access to the corresponding access path when the access status meets the termination conditions; the termination conditions include: when a webpage redirect occurs, the main domain of the redirected webpage does not match the main domain of the target website; and / or detecting loop access under the main domain of the target website.

[0111] S23: Obtain the web page elements and web page attributes of each web page to obtain the basic information set corresponding to each web page; the web page elements include the HTML elements of the web page, variables, strings, loops, references, judgments, and functions in the web page source code; the web page attributes include the web page IP address, main domain name, DNS resolution path, and filing status.

[0112] S24: Obtain the webpage source code and corresponding network traffic of each webpage, and analyze the relationship between webpage elements of each webpage and the relationship between webpage elements of each webpage and webpage elements of other webpages based on the webpage source code and network traffic to obtain the relationship information set corresponding to each webpage.

[0113] S25: Determine the basic information set and relational information set corresponding to each webpage as the webpage information set corresponding to the webpage.

[0114] S26: Based on the relationships and association types between web page elements included in the relationship information set corresponding to each web page, create corresponding node components for the web page elements with related relationships for each web page.

[0115] S27: Connect and combine the node components and the second connection component corresponding to each webpage according to their correspondence to obtain the relationship view corresponding to each webpage.

[0116] S28: Send the basic information set corresponding to each webpage to the visualization area of ​​its corresponding relation view to obtain the second visualization view corresponding to each webpage.

[0117] S29: Determine the corresponding association information based on the relationship information set corresponding to each webpage; the association information is used to represent each associated webpage and the correspondence between it and the associated webpage; the associated webpage is any one of the several webpages corresponding to the target website except for the current webpage; the associated webpage is determined through the relationship information set of the current webpage.

[0118] S210: Based on the webpage information set and related information of each webpage, determine the associated webpages corresponding to each webpage and the correspondence between them.

[0119] S211: Obtain the second visual view corresponding to each webpage, and create a number of first connection components for connecting the second visual view according to the correspondence between each webpage and its associated webpage.

[0120] S212: Based on the relationship between at least one webpage element included in the relationship information set corresponding to each webpage and the webpage elements of other webpages, determine the correspondence between at least one node component in each of the second visualization views and the node components in other of the second visualization views.

[0121] S213: Based on the correspondence between the determined node components, connect and combine the corresponding node components in each of the second visualization views and each of the first connection components according to their correspondence to obtain the first visualization view corresponding to the target website.

[0122] S214: Obtain the main domain name in the webpage attributes contained in the basic information set of each second visualization view, and determine whether it is the same as the main domain name of the target website. If they are not the same, proceed to S215; otherwise, determine that the webpage corresponding to the second visualization view is a safe webpage.

[0123] S215: Determine the webpage corresponding to the second visualization view as the target webpage.

[0124] S216: Based on the first visualization view, determine several access paths to the target webpage, analyze the access paths, and determine the target event.

[0125] Figure 2 The embodiment describes the correspondence between each webpage of the target website and displays it through a first visualization view. This helps website administrators clearly understand all explicit and implicit access chains and paths of the target website, intuitively grasp the loading process of the target website, including the execution process of each function, the calling process, the judgment process, and the webpage redirection process. It clarifies each step of the target website loading process, helps understand the internal webpage redirection process of the target website and the loading process of redirecting from the target website to other websites, and helps identify risks in these processes. This allows for an understanding of the security status of the target website, determining whether there are security vulnerabilities such as webpage tampering or code injection. It significantly reduces manual review time, simplifies workflow, and compared to extensive source code analysis of the target website loading process, solves the problems of difficult and unclear website source code analysis, effectively reducing work complexity and improving the work efficiency of website administrators. By monitoring access status, access to the target website can be controlled within the target website's main domain, helping to detect targeted network attacks within the target website without extending to other main domains, thus maintaining the security of the target operating environment without wasting additional computing resources. The second visualization view helps website administrators intuitively grasp the loading status of each webpage, clearly understand every detail of the target website's loading process, and facilitates further detailed analysis of the explicit and implicit access chains and paths contained within the target website, enabling timely detection of suspicious loading processes. When a target website is compromised, it can support the tracing and analysis of attack events, and help analyze attack strategies and paths, providing intelligence support for network security technology optimization research and maintaining network security.

[0126] Figure 2 The embodiment is based on Figure 1 The preferred embodiment is obtained, therefore, for Figure 2 The description of the embodiments is relatively simple; please refer to relevant details. Figure 1 The embodiment described above.

[0127] The present invention also provides an embodiment of a website loading visualization device, such as... Figure 3 As shown, it includes:

[0128] The website access module 31 is used to access each webpage of the target website in the target operating environment.

[0129] The data acquisition module 32 is used to acquire access data generated during the access process of each webpage and generate a webpage information set corresponding to each webpage; the webpage information set includes a basic information set and a relationship information set.

[0130] The association analysis module 33 is used to determine the corresponding association information based on the relationship information set corresponding to each webpage; the association information is used to represent each associated webpage and the correspondence between it and the associated webpage; the associated webpage is any one of the several webpages corresponding to the target website except for the current webpage; the associated webpage is determined through the relationship information set of the current webpage.

[0131] The visualization module 34 is used to construct a first visualization view corresponding to the target website based on the web page information set and related information of each web page.

[0132] Figure 3 The embodiments described above determine the correspondence between each webpage of the target website and display it in a visual view, which can help website administrators clearly understand all explicit and implicit access chains and access paths of the target website, thereby grasping the security status of the target website. Figure 3 The first visualization view in this embodiment helps website administrators intuitively grasp the loading process of a target website, including the execution process of each function, the calling process, the judgment process, and the page redirection process. It clearly shows each step of the target website loading process, helps understand the internal page redirection process of the target website and the loading process of redirecting from the target website to other websites, helps identify the risks involved in these processes, effectively improves the efficiency of detecting attacks such as page tampering, code injection, phishing, and spoofing, and provides intuitive visualization support for the analysis and tracing of related attacks. Compared with extensive source code analysis of the target website loading process, Figure 3 The embodiments described above solve the problems of difficult and unclear website source code analysis, effectively reduce the complexity of the work, and improve the work efficiency of website administrators.

[0133] Preferably, it also includes a runtime environment deployment module, which is executed before the website access module 31, and is used for:

[0134] The target hardware environment is determined from several candidate hardware environments; each candidate hardware environment has several corresponding operating systems.

[0135] Determine the target operating system corresponding to the target hardware environment.

[0136] A virtual machine is created based on the target hardware environment and the target operating system to obtain an intermediate runtime environment.

[0137] The target runtime environment was obtained by installing a web access program and a web crawler within the intermediate runtime environment.

[0138] Preferably, accessing each webpage of the target website in the target operating environment includes:

[0139] Determine the target website and its main domain name.

[0140] Access the target website using the target operating environment and monitor the access status.

[0141] When the access status meets the termination conditions, the access to the corresponding access path is terminated.

[0142] The conditions for terminating access include: when a webpage redirect occurs, the main domain of the redirected webpage does not match the main domain of the target website; and / or a loop of access is detected under the main domain of the target website.

[0143] Preferably, the basic information set includes webpage elements and webpage attributes of the corresponding webpage, the relationship information set includes the association between at least one webpage element of the corresponding webpage and webpage elements of other webpages, and the association between at least some webpage elements of the corresponding webpage and the association type, and the visualization module 34 is further used for:

[0144] Based on the basic information set and relational information set included in the web page information set corresponding to each web page, a second visualization view corresponding to each web page is constructed.

[0145] Preferably, the step of acquiring access data generated during the access to each webpage and generating a webpage information set corresponding to each webpage includes:

[0146] The web page elements and attributes of each web page are obtained to obtain the basic information set corresponding to each web page; the web page elements include the web page's HTML elements, variables, strings, loops, references, conditional statements, and functions in the web page source code; the web page attributes include the web page's IP address, main domain name, DNS resolution path, and ICP filing status.

[0147] Obtain the source code and corresponding network traffic of each webpage. Based on the source code and network traffic, analyze the relationships between webpage elements of each webpage and the relationships between webpage elements of each webpage and webpage elements of other webpages to obtain the relationship information set corresponding to each webpage.

[0148] The basic information set and relational information set corresponding to each webpage are determined as the webpage information set corresponding to that webpage.

[0149] Preferably, constructing the first visual view corresponding to the target website based on the webpage information set and related information of each webpage includes:

[0150] Based on the webpage information set and related information of each webpage, determine the associated webpages corresponding to each webpage and the correspondence between the associated webpages.

[0151] Get the second visual view corresponding to each webpage.

[0152] Based on the correspondence between each webpage and its associated webpage, several first connection components are created to connect the second visualization view.

[0153] Each second visualization view and each first connection component are connected and combined according to their correspondence to obtain the first visualization view corresponding to the target website.

[0154] Preferably, constructing a second visual view corresponding to each webpage based on the basic information set and relational information set included in the webpage information set corresponding to each webpage includes:

[0155] Based on the relationships and association types between web page elements included in the relationship information set corresponding to each web page, create corresponding node components for the web page elements with related relationships for each web page.

[0156] Based on the association type of the related web page elements of each web page, create several second connection components to connect the corresponding node components.

[0157] The node components and second connection components corresponding to each webpage are connected and combined according to their correspondence to obtain the relationship view corresponding to each webpage.

[0158] The basic information set corresponding to each webpage is sent to the visualization area of ​​its corresponding relationship view to obtain the second visualization view corresponding to each webpage.

[0159] Preferably, the step of connecting and combining each second visual view and each first connecting component according to their correspondence includes:

[0160] Based on the relationship between at least one webpage element in the relationship information set corresponding to each webpage and the webpage elements of other webpages, determine the correspondence between at least one node component in each second visualization view and the node components in other second visualization views.

[0161] Based on the correspondence between the determined node components, the corresponding node component in each of the second visualization views and each of the first connection components are connected and combined according to their correspondence.

[0162] Preferably, it also includes an event analysis module, used for:

[0163] Obtain the main domain name of the target website.

[0164] Obtain the main domain name from the webpage attributes contained in the basic information set of each second visualization view, and determine whether it is the same as the main domain name of the target website. If they are not the same, determine that the webpage corresponding to the second visualization view is the target webpage.

[0165] Based on the first visualization view, an access path to the target webpage is determined; the access path includes the webpages and webpage elements that are passed through to reach the target webpage.

[0166] The access path is analyzed to determine the target event.

[0167] Figure 3 The embodiment is as follows: Figure 1 , Figure 2 The apparatus embodiments corresponding to the method embodiments are described above. Figure 3 Partial implementation process of the embodiments and Figure 1 , Figure 2 The embodiments described are similar, therefore, for Figure 3 The description of the embodiments is relatively simple; please refer to relevant details. Figure 1 , Figure 2 The embodiment described above.

[0168] The present invention also provides an embodiment of a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method described in the foregoing embodiments, the method of which can be found in [reference needed]. Figure 1 , Figure 2The description of the embodiments will not be repeated here.

[0169] This invention also provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the methods described in the foregoing embodiments.

[0170] This invention determines the correspondence between each webpage of a target website and displays it in a visual view. This helps website administrators clearly understand all explicit and implicit access chains and paths of the target website, thereby grasping the security status of the target website. The first visual view of this invention helps website administrators intuitively grasp the loading process of the target website, including the execution process of each function, the calling process, the judgment process, and the webpage redirection process. It clearly shows each step of the target website loading process, helps understand the internal webpage redirection process of the target website and the loading process of redirecting from the target website to other websites, helps identify the risks in these processes, effectively improves the detection efficiency of attacks such as webpage tampering, code injection, phishing, and spoofing, and provides intuitive visual support for the analysis and tracing of related attacks. Compared with extensive source code analysis of the target website loading process, this invention solves the problems of difficult and unclear website source code analysis, effectively reducing the complexity of the work and improving the work efficiency of website administrators.

[0171] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for visualizing website loading, characterized in that, include: Access each webpage of the target website within the target operating environment; Obtain access data generated during the access process of each webpage, and generate a webpage information set corresponding to each webpage; The webpage information set includes a basic information set and a relational information set; The basic information set includes the web page elements and web page attributes of the corresponding web page, and the relationship information set includes the association relationship between at least one web page element of the corresponding web page and the web page elements of other web pages, as well as the association relationship and association type between at least some web page elements of the corresponding web page. The relationships between web page elements include: referencing, calling, and judgment; Based on the relationship information set corresponding to each webpage, determine its corresponding association information; the association information is used to represent each associated webpage and the correspondence between it and the associated webpage; based on the webpage information set and association information of each webpage, create a first visualization view corresponding to the target website; based on the basic information set and relationship information set included in the webpage information set corresponding to each webpage, construct a second visualization view corresponding to each webpage. The target operating environment is obtained through the following methods: A target hardware environment is determined from several candidate hardware environments; the target operating system corresponding to the target hardware environment is determined; the candidate hardware environments include PC hardware environments and mobile hardware environments; A virtual machine is created based on the target hardware environment and the target operating system to obtain an intermediate runtime environment; The target runtime environment is obtained by installing a web access program and a web crawler within the intermediate runtime environment. The relational information set is obtained through the following methods: Obtain the source code and corresponding network traffic of each webpage. Based on the source code and network traffic, analyze the relationships between webpage elements of each webpage and the relationships between webpage elements of each webpage and webpage elements of other webpages to obtain the relationship information set corresponding to each webpage.

2. The method according to claim 1, characterized in that, The access to each webpage of the target website in the target operating environment includes: Identify the target website and its main domain name; Access the target website using the target operating environment and monitor the access status; When the access status meets the termination conditions, the access to the corresponding access path ends. The conditions for terminating access include: when a webpage redirect occurs, the main domain of the redirected webpage does not match the main domain of the target website; and / or a loop of access is detected under the main domain of the target website.

3. The method according to claim 2, characterized in that, The step of acquiring access data generated during the access to each webpage and generating a webpage information set corresponding to each webpage includes: The web page elements and attributes of each web page are obtained to obtain the basic information set corresponding to each web page; the web page elements include the HTML elements of the web page, variables, strings, loops, references, conditional statements, and functions in the web page source code; the web page attributes include the web page IP address, main domain name, DNS resolution path, and filing status. The basic information set and relational information set corresponding to each webpage are determined as the webpage information set corresponding to that webpage.

4. The method according to claim 3, characterized in that, The step of constructing a first visual view corresponding to the target website based on the webpage information set and related information of each webpage includes: Based on the web page information set and related information of each web page, determine the associated web pages corresponding to each web page and the correspondence between the associated web pages; Obtain the second visual view corresponding to each webpage; Based on the correspondence between each webpage and its associated webpage, create several first connection components for connecting the second visualization view; Each second visualization view and each first connection component are connected and combined according to their correspondence to obtain the first visualization view corresponding to the target website.

5. The method according to claim 4, characterized in that, The step of constructing a second visual view corresponding to each webpage based on the basic information set and relational information set included in the webpage information set corresponding to each webpage includes: Based on the relationships and types between web page elements included in the relationship information set corresponding to each web page, create corresponding node components for the web page elements with relationships for each web page. Based on the association type of the related web page elements of each web page, create several second connection components to connect the corresponding node components. The node components and second connection components corresponding to each webpage are connected and combined according to their correspondence to obtain the relationship view corresponding to each webpage. The basic information set corresponding to each webpage is sent to the visualization area of ​​its corresponding relationship view to obtain the second visualization view corresponding to each webpage.

6. The method according to claim 5, characterized in that, The step of connecting and combining each second visualization view and each first connection component according to their correspondence includes: Based on the relationship between at least one webpage element in the relationship information set corresponding to each webpage and the webpage elements of other webpages, determine the correspondence between at least one node component in each second visualization view and the node components in other second visualization views. Based on the correspondence between the determined node components, the corresponding node component in each of the second visualization views and each of the first connection components are connected and combined according to their correspondence.

7. The method according to claim 3, characterized in that, The method further includes: Obtain the main domain name of the target website; Obtain the main domain name in the webpage attributes contained in the basic information set of each second visualization view, and determine whether it is the same as the main domain name of the target website. If they are not the same, determine that the webpage corresponding to the second visualization view is the target webpage. Based on the first visualization view, an access path to the target webpage is determined; the access path includes the webpages and webpage elements that are passed through to reach the target webpage. The access path is analyzed to determine the target event.

8. A website loading visualization device, characterized in that, include: The website access module is used to access each webpage of the target website within the target runtime environment. The data acquisition module is used to acquire access data generated during the access process of each webpage and generate a webpage information set corresponding to each webpage. The webpage information set includes a basic information set and a relational information set; The basic information set includes the web page elements and web page attributes of the corresponding web page, and the relationship information set includes the association relationship between at least one web page element of the corresponding web page and the web page elements of other web pages, as well as the association relationship and association type between at least some web page elements of the corresponding web page. The relationships between web page elements include: referencing, calling, and judgment; The association analysis module is used to determine the corresponding association information based on the relationship information set corresponding to each webpage; the association information is used to represent each associated webpage and the corresponding relationship between it and the associated webpage. The visualization module is used to construct a first visualization view corresponding to the target website based on the webpage information set and association information of each webpage; and to construct a second visualization view corresponding to each webpage based on the basic information set and relationship information set included in the webpage information set corresponding to each webpage. The target operating environment is obtained through the following methods: A target hardware environment is determined from several candidate hardware environments; the target operating system corresponding to the target hardware environment is determined; the candidate hardware environments include PC hardware environments and mobile hardware environments; A virtual machine is created based on the target hardware environment and the target operating system to obtain an intermediate runtime environment; The target runtime environment is obtained by installing a web access program and a web crawler within the intermediate runtime environment. The relational information set is obtained through the following methods: Obtain the source code and corresponding network traffic of each webpage. Based on the source code and network traffic, analyze the relationships between webpage elements of each webpage and the relationships between webpage elements of each webpage and webpage elements of other webpages to obtain the relationship information set corresponding to each webpage.

Images