Webpage tampering protection method and device, and storage medium

Abstract

The embodiment of the application discloses a webpage tampering protection method and related equipment, when a webpage is subjected to tampering attack, the same type of server is protected in advance, the attack is prevented from spreading in a large range, and adaptability and initiative of the tampering protection method are realized. The method comprises the following steps: a webpage tampering protection server receives tampering attack detailed information corresponding to a target operation; the webpage tampering protection server determines N high-risk indexes corresponding to the target operation according to the tampering attack detailed information, wherein the N is an integer greater than or equal to; the webpage tampering protection server issues a protection strategy corresponding to the N high-risk indexes to a server managed by the webpage tampering protection server, so as to perform tampering protection.

Description

Technical Field

[0001] This application relates to the field of web page protection, and more particularly to a method, apparatus and storage medium for preventing web page tampering. Background Technology

[0002] Website attacks have become increasingly prevalent in recent years, with not only a rise in the number of attacks but also a dramatic increase in their types and scope. Statistics show that over 95% of websites have been targeted by hackers. Once a website is attacked, its pages are easily defaced through various malicious acts, including phishing attacks, link alterations, the distribution of illegal content, hidden links, and malware injection. The resulting losses are incalculable. If a company's homepage, representing its image, is altered, its authority will be undermined, ultimately significantly impacting its social credibility. Furthermore, it poses risks to users, such as the leakage of sensitive information and being deceived, jeopardizing data security and user financial security.

[0003] Existing methods for protecting against website tampering threats generally fall into two categories: post-incident recovery and proactive blocking. Post-incident recovery methods include common techniques such as timed cyclic scanning, digital watermarking, and event-triggered techniques. These methods primarily work by using polling of web pages, file integrity checks, and monitoring of protected directories to promptly identify malicious tampering and restore the modified web page files using previously backed-up backups. Proactive blocking methods employ operating system-level file filtering to intercept and analyze input / output request packets (I / O request packets, IRPs), preemptively truncating write operations to all protected website directories to achieve a "preemptive strike."

[0004] However, due to the limitations of the filtering rules, it can only identify and block the webpage tampering risks preset by the system. In the face of the ever-evolving threats and attack methods, it lacks the autonomy and adaptability of security protection and can only rely on manual updates of filtering rules at regular intervals, which consumes a lot of human resources and cannot identify and defend against the latest tampering threats in a timely manner. Summary of the Invention

[0005] This application provides a webpage tampering protection method, device, and storage medium. When a webpage is subjected to a tampering attack, it provides advance protection for servers of the same type, preventing the attack from spreading widely and achieving adaptability and proactivity in the tampering protection method.

[0006] The first aspect of this application provides a method for preventing website tampering, which may include:

[0007] The webpage tampering protection server receives detailed tampering attack information corresponding to the target operation. The detailed tampering attack information is collected when the webpage server blocks the target operation. The target operation is at least one operation on the target webpage that does not match the initial protection policy corresponding to the target webpage.

[0008] The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the tampering attack details, where N is an integer greater than or equal to.

[0009] The webpage tampering protection server distributes the protection policies corresponding to the N high-risk indicators to the servers managed by the webpage tampering protection server to perform tampering protection.

[0010] In one possible design, the webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the tampering attack details, including:

[0011] The webpage tampering protection server decomposes the tampering attack details into M risk measurement indicators, where M is an integer greater than or equal to 2;

[0012] The webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on the M risk evaluation indicators;

[0013] The webpage tampering protection server determines the N high-risk indicators based on the group evaluation value.

[0014] In one possible design, the webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on the M risk assessment indicators, including:

[0015] The webpage tampering protection server determines the risk assessment value corresponding to the target decision group based on the M risk measurement indicators, wherein the target decision group is the decision group corresponding to the target webpage;

[0016] The webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value.

[0017] In one possible design, the webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value, including:

[0018] The group evaluation value corresponding to the target decision group is determined by the following formula:

[0019]

[0020] Among them, Fj The group evaluation value of the target decision-making group is m, where m is the number of the M risk measurement indicators. for The element in the i-th position after being sorted according to preset rules. This is a vector of risk assessment values ​​corresponding to the target decision group.

[0021] In one possible design, the webpage tampering protection server determines the N high-risk indicators based on the group evaluation values, including:

[0022] The webpage tampering protection server determines the group evaluation value as prior information of the Bayesian network;

[0023] The webpage tampering protection server determines the probability distribution conditions of the M risk measurement indicators based on the prior information of the Bayesian network.

[0024] The webpage tampering protection server assesses the threat level of the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

[0025] The second aspect of this application provides a method for preventing website tampering, including:

[0026] The web server monitors at least one operation performed on the target webpage in real time.

[0027] The web server determines whether any of the at least one operations is a target operation that does not match the initial protection strategy corresponding to the target webpage;

[0028] If so, the web server blocks the target operation;

[0029] The web server collects detailed information on the tampering attack corresponding to the target operation;

[0030] The web server sends the tampering attack details to the web page tampering protection server, so that the web page tampering protection server determines N high-risk indicators corresponding to the target web page based on the tampering attack details, and returns the protection strategy corresponding to the N high-risk indicators, where N is an integer greater than or equal to 1 and M is an integer greater than or equal to 2.

[0031] The web server performs tamper protection on the target webpage based on the protection strategies corresponding to the N high-risk indicators and the initial protection strategy.

[0032] A third aspect of this application provides a webpage tampering protection server, comprising:

[0033] The receiving unit is used to receive tampering attack details corresponding to the target operation. The tampering attack details are collected when the web server blocks the target operation. The target operation is at least one operation against the target webpage that does not match the initial protection policy corresponding to the target webpage.

[0034] The determining unit is configured to determine N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, wherein N is an integer greater than or equal to the target operation.

[0035] The distribution unit is used to distribute the protection policies corresponding to the N high-risk indicators to the servers managed by the webpage tampering protection server for tampering protection.

[0036] In one possible design, the first determining module 5022 is specifically used for:

[0037] The webpage tampering protection server determines the risk assessment value corresponding to the target decision group based on the M risk measurement indicators, wherein the target decision group is the decision group corresponding to the target webpage;

[0038] The webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value.

[0039] In one possible design, the first determining module 5022 determines the group evaluation value corresponding to the target decision group based on the risk evaluation value, including:

[0040] The group evaluation value corresponding to the target decision group is determined by the following formula:

[0041]

[0042] Among them, F j The group evaluation value of the target decision-making group is m, where m is the number of the M risk measurement indicators. for The element in the i-th position after being sorted according to preset rules. This is a vector of risk assessment values ​​corresponding to the target decision group.

[0043] In one possible design, the second determining module 5023 is specifically used for:

[0044] The webpage tampering protection server determines the group evaluation value as prior information of the Bayesian network;

[0045] The webpage tampering protection server determines the probability distribution conditions of the M risk measurement indicators based on the prior information of the Bayesian network.

[0046] The webpage tampering protection server assesses the threat level of the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

[0047] A fourth aspect of this application provides a web server, comprising:

[0048] The detection unit is used to detect at least one operation targeting the target webpage in real time.

[0049] The judgment unit is used to determine whether there is a target operation in the at least one operation that does not match the initial protection strategy corresponding to the target webpage;

[0050] A blocking unit is configured to block the target operation if the target operation exists in at least one of the operations;

[0051] The collection unit is used to collect detailed information on the tampering attack corresponding to the target operation;

[0052] The sending unit is used to send the tampering attack details to the webpage tampering protection server, so that the webpage tampering protection server can determine N high-risk indicators corresponding to the target webpage based on the tampering attack details, and return the protection strategy corresponding to the N high-risk indicators, wherein N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2.

[0053] The protection unit is used to protect the target webpage from tampering based on the protection strategies corresponding to the N high-risk indicators and the initial protection strategy.

[0054] A fifth aspect of this application provides a computer-readable storage medium storing at least one executable instruction that, when executed on a computing device, causes the computing device to perform the webpage tampering protection method as described in any aspect of this application.

[0055] The sixth aspect of this application discloses a computer program product that, when run on a computer, causes the computer to execute the webpage tampering protection method described in any aspect of this application.

[0056] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0057] A data collection module is added to the Agent side corresponding to the web server to collect the status information of the web server in real time. Detailed information on tampering attacks corresponding to illegal operations is sent to the web tampering protection server. The web tampering protection server can determine the corresponding high-risk indicators based on the tampering attack details sent by the web server where the illegal operation occurred, and distribute the protection policies corresponding to the high-risk indicators to other servers of the same type. This allows other servers to proactively defend against the latest tampering attacks, prevent the attacks from spreading widely, and achieve adaptability and proactivity in tampering protection methods. Attached Figure Description

[0058] The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0059] Figure 1 Network architecture diagram of the webpage tampering protection system provided in this application embodiment;

[0060] Figure 2 A schematic flowchart of the webpage tampering protection method provided in this application embodiment;

[0061] Figure 3 Another flowchart illustrating the webpage tampering protection method provided in this application embodiment;

[0062] Figure 4 Another flowchart illustrating the webpage tampering protection method provided in this application embodiment;

[0063] Figure 5 A schematic diagram of the virtual structure of the webpage tampering protection server provided in this application embodiment;

[0064] Figure 6 This is a schematic diagram of the virtual structure of a web server provided in an embodiment of this application;

[0065] Figure 7 A schematic diagram of the hardware structure of the webpage tampering protection server provided in this application embodiment;

[0066] Figure 8 This is a schematic diagram of the hardware structure of a web server provided in an embodiment of this application. Detailed Implementation

[0067] To enable those skilled in the art to better understand the present application, the technical solutions of the embodiments of the present application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. All embodiments based on the present application should fall within the scope of protection of the present application.

[0068] This application proposes a website tampering threat protection method that is autonomous, adaptive, and predictive. It utilizes a widely distributed network of agents on a public cloud platform to continuously collect and monitor website traffic. When a tampering threat occurs, it automatically updates the anti-tampering rule base using data analysis and adaptive rules, and shares this information with other agents, enabling early identification and proactive defense against emerging threats. Furthermore, it allows for analysis of overall traffic patterns from a macro-network perspective. Traffic events targeting individual websites are easily overlooked. The distributed network of agents transcends geographical and user limitations, enabling the prediction of threats that have not yet occurred through data analysis. The simultaneous operation of thousands of agents in the cloud environment further enhances the accuracy of these predictions.

[0069] Please see Figure 1 , Figure 1 The network architecture diagram of the tamper protection system provided in this application is shown. The system consists of two parts: a webpage tamper protection server, primarily used to configure and distribute security policies, provide an interface for administrators to manage the Agent side, and collect system status data from the Agent side; and an Agent proxy, installed on the user's web server to monitor the site and promptly block tampering attacks. In a public cloud environment, Agents are widely distributed across resource pools in different regions. One webpage tamper protection server can manage thousands of Agent proxies simultaneously and maintain real-time communication. The Agent proxy adds a data collection module, primarily responsible for dynamically monitoring, analyzing, and controlling all inbound and outbound traffic to the website server, monitoring website server status information in real time, observing each file transfer, monitoring each user action, and recording each access request, forming a system status dataset of the website server which is sent to the webpage tamper protection server in real time. The webpage tamper protection server adds a data processing module, which collects and filters traffic data fed back by distributed Agents, considers the overall traffic situation from a macro perspective, promptly detects overlooked abnormal traffic events of individual websites, and reasonably predicts potential tampering risks. The predicted tampering risks are used to update the anti-tampering rule base in a timely manner, effectively addressing unknown risks. Simultaneously, when the threat handling module on the agent side blocks a tampering attack, it sends the tampering attack logs back to the tampering protection server, which then updates the anti-tampering rule base promptly.

[0070] This application maintains a dynamically updated anti-tampering rule base. It predicts unknown tampering risks through data analysis and obtains the latest tampering attack methods through tampering log analysis, achieving adaptability and predictability in the tampering protection method. Simultaneously, the website tampering protection server distributes protection policies to the Agent end in real time based on the dynamically updated rule base. Especially when a tampering attack occurs, it immediately distributes protection policies to similar agents, autonomously blocking the latest tampering attacks and preventing large-scale website server tampering attacks.

[0071] This application introduces a Bayesian model to predict tampering risks. It provides a method for calculating hypothetical probabilities based on prior probabilities. Combined with a group decision-making method based on the OWA operator, it estimates the probability of various threat vectors and discovers the probability that a specific activity pattern is a threat, thereby identifying potential risks.

[0072] The following describes the webpage tampering protection method provided in this application embodiment from the perspective of the webpage server.

[0073] Please see Figure 2 , Figure 2 A flowchart illustrating the webpage tampering protection method provided in this application embodiment:

[0074] 201. The web server detects at least one operation performed on the target webpage.

[0075] In this embodiment, the Agent installed on the web server can detect at least one operation on the target web page in real time. The target web page corresponds to the web server. That is, the Agent-side threat handling module can monitor the addition, deletion and modification of kernel files in a timely manner by placing hook functions in the kernel file operation functions.

[0076] 202. The web server determines whether there is a target operation in at least one operation that does not match the initial protection policy corresponding to the target web page. If so, it executes step 203.

[0077] In this embodiment, after detecting at least one operation targeting a target webpage, the webpage server matches the at least one operation with the initial protection policy corresponding to the target webpage to determine whether there is a target operation that does not match the initial protection policy. If there is a target operation that does not match the initial protection policy, step 203 is executed. The initial protection policy is that the webpage tampering protection server distributes the protection rules corresponding to the webpage server in the dynamically updated rule base to the threat processing module on the Agent side corresponding to the webpage server.

[0078] 203. The web server blocks the target operation.

[0079] In this embodiment, if the web server determines that there is a target operation in at least one operation that does not match the initial protection policy, the web server can determine that changing the target operation is a tampering attack. That is, if the web server determines that the target operation does not match the legitimate operation, it can determine that the target operation is a tampering attack and then block the IRP flow to advance the target operation.

[0080] 204. The web server collects detailed information on tampering attacks corresponding to the target operations.

[0081] In this embodiment, if the web server blocks the tampering attack corresponding to the target operation, it can collect detailed information on the tampering attack corresponding to the target operation. The detailed information on the tampering attack includes the tampering time, the name of the tampered asset, the IP address of the tampered asset, the tampering process information, the tampering port information, and the tampered file path information.

[0082] 205. The web server sends detailed information about the tampering attack to the web tampering protection server.

[0083] In this embodiment, after collecting detailed information on the tampering attack corresponding to the target operation, the web server can generate a tampering log corresponding to the detailed information on the tampering attack and send it to the web tampering protection server. This allows the web tampering protection server to determine N high-risk indicators corresponding to the target web page based on the detailed information on the tampering attack and to distribute the protection policies corresponding to the N high-risk indicators to all web servers. Here, N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2.

[0084] 206. The web server protects the target webpage from tampering based on the protection strategies corresponding to N high-risk indicators and the initial protection strategy.

[0085] In this embodiment, after receiving the protection policies corresponding to the N high-risk indicators returned by the webpage tampering protection server, the webpage server can simultaneously perform tampering protection on the target webpage based on the protection policies corresponding to the N high-risk indicators and the initial protection policy.

[0086] In summary, it can be seen that in the embodiments provided in this application, a data collection module is added to the Agent side corresponding to the web server to collect and monitor the website server status daily, report the system status dataset of the website server, and the webpage tampering protection server analyzes from a macro perspective to promptly detect abnormal traffic events of individual websites that have been overlooked, and reasonably predict the tampering risks that have not yet occurred, thus achieving predictive protection. When an Agent detects a tampering attack, it reports the attack log. After analysis, the webpage tampering protection server dynamically updates the rule base and distributes protection policies to other Agents, thus achieving adaptability and proactivity in protection. The above describes the method of protecting against webpage tampering threats from the perspective of the web server; the following describes the method of protecting against webpage tampering threats from the perspective of the webpage tampering protection server.

[0087] Please see Figure 3 , Figure 3 Another flowchart illustrating the webpage tampering protection method provided in this application embodiment includes:

[0088] 301. The webpage tampering protection server receives detailed information about the tampering attack corresponding to the target operation.

[0089] In this embodiment, the webpage tampering protection server receives tampering attack details corresponding to the target operation. These tampering attack details are collected when the webpage server blocks the target operation. The target operation is at least one operation against the target webpage that does not match the initial protection policy corresponding to the target webpage. The tampering attack details include tampering time, name of the tampered asset, IP address of the tampered asset, tampering process information, tampering port information, and path information of the tampered file.

[0090] 302. The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack.

[0091] In this embodiment, after receiving the detailed information of the tampering attack corresponding to the target operation, the webpage tampering protection server can determine N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack. The method for determining the N high-risk indicators corresponding to the target operation is described in detail below:

[0092] Step 1: The webpage tampering protection server breaks down the tampering attack details into M risk measurement indicators.

[0093] In this step, the webpage tampering protection server decomposes the detailed information of the tampering attack into M risk measurement indicators R = (r1, r2, ..., r...) according to the system's preset classification rules. m ), where r k Let M be the k-th risk measure, and M be an integer greater than or equal to 2.

[0094] Step 2: The webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on M risk assessment indicators.

[0095] In this step, the website tampering protection server determines the risk assessment value corresponding to the target decision group based on M risk measurement indicators. This target decision group is the decision group corresponding to the target webpage. Then, the website tampering protection server determines the group assessment value corresponding to the target decision group based on the risk assessment value. To perform data analysis on n agents, the website tampering protection server sets up a decision group set D = (d1, d2, ..., d...). n ), where d j (j = 1, 2, ..., n) represents the j-th decision group. The target decision group is the decision group corresponding to the target webpage. A risk assessment value vector is given for the target decision group in the decision group set D. For example, if the target decision group is the j-th decision group, then the risk assessment value vector for that target decision group is... Subsequently, the webpage tampering protection server can construct a group decision method based on the OWA operator, which is calculated as follows:

[0096]

[0097] Among them, b i w is the i-th largest factor of the array. i This is the weight vector. Applying the wind direction evaluation value vector of the target decision group to this OWA operator yields the group evaluation value of the target decision group:

[0098]

[0099] Among them, F j Let m be the group evaluation value of the target decision-making group, and m be the number of M risk measurement indicators. for The element in the i-th position after being sorted according to a preset rule (such as descending order, or other rules). This is a vector of risk assessment values ​​corresponding to the target decision group.

[0100] Step 3: The webpage tampering protection server determines N high-risk indicators based on the group evaluation value.

[0101] In this step, after determining the group evaluation value corresponding to the target decision group using the OWA operator's group decision-making method, the website tampering protection server can determine N high-risk indicators based on the group evaluation value, where N is an integer greater than or equal to 1. Specifically, the website tampering protection server introduces a Bayesian network and uses the group evaluation value as prior information for the Bayesian network. Then, based on the prior information of the Bayesian network, it performs inference to obtain the probability distribution conditions of M risk measurement indicators. Finally, it assesses the threat level of the probability distribution conditions of the M risk measurement indicators and calculates the N high-risk indicators with higher threat levels.

[0102] 303. The webpage tampering protection server distributes the protection policies corresponding to N high-risk indicators to the servers managed by the webpage tampering protection server to carry out tampering protection.

[0103] In this embodiment, after identifying N high-risk indicators, the webpage tampering protection server can update these N indicators to the rule base and, based on the protection rules in the rule base, issue corresponding protection policies to the servers managed by the webpage tampering protection server. The servers managed by the webpage tampering protection server include the webpage server corresponding to the target webpage, as well as other servers of the same and different types as the webpage server, for tampering protection. Here, "same type" refers to other servers in the same resource pool as the webpage server, with the same operating system, or the same version of the application. When the webpage server is subjected to a tampering attack, other servers of the same type may also be under tampering threat. Therefore, the protection policies corresponding to the N high-risk indicators can be sent to other servers, allowing them to take preventative measures in advance.

[0104] It should be noted that the webpage tampering protection server can also, after identifying N high-risk indicators, distribute the protection policies corresponding to those N high-risk indicators to all webpage servers under its jurisdiction to prevent the widespread spread of tampering.

[0105] In summary, in the embodiments provided in this application, the webpage tampering protection server can determine the corresponding high-risk indicators based on the detailed information of the tampering attack sent by the webpage server where the illegal operation occurred, and distribute the protection policies corresponding to the high-risk indicators to other servers of the same type, so that other servers can actively defend against the latest tampering attacks to prevent the attacks from spreading on a large scale, thereby realizing the adaptability and initiative of the tampering protection method.

[0106] The above describes the protection method against webpage tampering threats provided in this application from the perspectives of the webpage server and the webpage tampering protection server, respectively. The following describes the protection method against webpage tampering threats provided in this application from the perspective of the interaction between the webpage server and the webpage tampering protection server.

[0107] Please see Figure 4 , Figure 4 Another flowchart illustrating the webpage tampering protection method provided in this application embodiment includes:

[0108] 401. The web server detects at least one operation performed on the target webpage.

[0109] 402. The web server determines whether there is a target operation in at least one operation that does not match the initial protection policy corresponding to the target webpage.

[0110] 403. If so, the web server will block the target operation.

[0111] 404. The web server collects detailed information on tampering attacks corresponding to the target operation.

[0112] 405. The web server sends detailed information about the tampering attack to the web tampering protection server.

[0113] It should be noted that steps 401 to 405 are related to... Figure 2 Steps 201 to 205 are similar and have been explained in detail above, so they will not be repeated here.

[0114] 406. The webpage tampering protection server receives detailed information about the tampering attack corresponding to the target operation.

[0115] 407. The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack.

[0116] 408. The webpage tampering protection server distributes the protection policies corresponding to N high-risk indicators to the servers managed by the webpage tampering protection server to carry out tampering protection.

[0117] It should be noted that steps 406 to 408 are related to... Figure 3 Steps 301 to 303 are similar and have been described in detail above, so they will not be repeated here.

[0118] In summary, it can be seen that in the embodiments provided in this application, a data collection module is added to the Agent side corresponding to the web server to collect the status information of the web server in real time. The detailed information of the tampering attack corresponding to the illegal operation is sent to the web tampering protection server. The web tampering protection server can determine the corresponding high-risk indicators based on the detailed information of the tampering attack sent by the web server where the illegal operation occurred, and distribute the protection policy corresponding to the high-risk indicator to other servers of the same type, so that other servers can actively defend against the latest tampering attacks, prevent the attack from spreading on a large scale, and realize the adaptability and initiative of the tampering protection method.

[0119] The above describes this application from the perspective of webpage tampering prevention methods. The following describes this application from the perspective of webpage servers and webpage tampering prevention servers.

[0120] Please see Figure 5 , Figure 5 This is a schematic diagram of the virtual structure of a webpage tampering protection server provided in an embodiment of this application. The webpage tampering protection server 500 includes:

[0121] The receiving unit 501 is used to receive tampering attack details corresponding to the target operation. The tampering attack details are collected when the web server blocks the target operation. The target operation is at least one operation against the target webpage that does not match the initial protection policy corresponding to the target webpage.

[0122] The determining unit 502 is used to determine N high-risk indicators corresponding to the target operation based on the tampering attack details, wherein N is an integer greater than or equal to the target operation.

[0123] The distribution unit 503 is used to distribute the protection policies corresponding to the N high-risk indicators to the servers managed by the webpage tampering protection server for tampering protection.

[0124] In one possible design, the determining unit 502 includes:

[0125] The decomposition module 5021 is used to decompose the tampering attack details into M risk measurement indicators, wherein M is an integer greater than or equal to 2;

[0126] The first determining module 5022 is used to determine the group evaluation value of the target decision group corresponding to the target webpage based on the M risk evaluation indicators;

[0127] The second determining module 5023 is used to determine the N high-risk indicators based on the group evaluation value.

[0128] In one possible design, the first determining module 5022 is specifically used for:

[0129] The webpage tampering protection server determines the risk assessment value corresponding to the target decision group based on the M risk measurement indicators, wherein the target decision group is the decision group corresponding to the target webpage;

[0130] The webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value.

[0131] In one possible design, the first determining module 5022 determines the group evaluation value corresponding to the target decision group based on the risk evaluation value, including:

[0132] The group evaluation value corresponding to the target decision group is determined by the following formula:

[0133]

[0134] Among them, F j The group evaluation value of the target decision-making group is m, where m is the number of the M risk measurement indicators. for The element in the i-th position after being sorted according to preset rules. This is a vector of risk assessment values ​​corresponding to the target decision group.

[0135] In one possible design, the second determining module 5023 is specifically used for:

[0136] The webpage tampering protection server determines the group evaluation value as prior information of the Bayesian network;

[0137] The webpage tampering protection server determines the probability distribution conditions of the M risk measurement indicators based on the prior information of the Bayesian network.

[0138] The webpage tampering protection server assesses the threat level of the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

[0139] Please see Figure 6 , Figure 6 This is a schematic diagram of the virtual structure of a web server provided in an embodiment of this application. The web server 600 includes:

[0140] The detection unit 601 is used to detect at least one operation targeting the target webpage in real time.

[0141] The judgment unit 602 is used to determine whether there is a target operation in the at least one operation that does not match the initial protection strategy corresponding to the target webpage;

[0142] The blocking unit 603 is configured to block the target operation if the target operation exists in the at least one operation;

[0143] Collection unit 604 is used to collect detailed information on tampering attacks corresponding to the target operation;

[0144] The sending unit 605 is used to send the tampering attack details to the webpage tampering protection server, so that the webpage tampering protection server determines N high-risk indicators corresponding to the target webpage based on the tampering attack details, and returns the protection strategy corresponding to the N high-risk indicators, wherein N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2.

[0145] Protection unit 606 is used to protect the target webpage from tampering based on the protection strategies corresponding to the N high-risk indicators and the initial protection strategy.

[0146] Those skilled in the art will understand that, for the sake of simplicity and brevity, the above description of the webpage tampering protection server and the specific workflow of the webpage server can be found in the preceding text. Figure 1 , Figure 2 and Figure 3 The specific working process will not be elaborated here.

[0147] This application also provides another website tampering protection server. Please refer to [link / reference]. Figure 7 , Figure 7 This is a schematic diagram of the structure of a webpage tampering protection server provided in this application embodiment. The server 700 can vary significantly due to different configurations or performance, and may include one or more central processing units (CPUs) 722 (e.g., one or more processors) and a memory 732, and one or more storage media 730 (e.g., one or more mass storage devices) for storing application programs 742 or data 744. The memory 732 and storage media 730 can be temporary or persistent storage. The program stored in the storage media 730 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server. Furthermore, the CPU 722 may be configured to communicate with the storage media 730 and execute the series of instruction operations in the storage media 730 on the server 700.

[0148] Server 700 may also include one or more power supplies 727, one or more wired or wireless network interfaces 750, one or more input / output interfaces 758, and / or one or more operating systems 741, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0149] The steps performed by the webpage tampering protection server in the above embodiments can be based on this. Figure 7 The server structure shown.

[0150] This application also provides another web server in its embodiments; please refer to [link / reference]. Figure 8 , Figure 8 This is a schematic diagram of a web server structure provided in an embodiment of this application. The server 800 can vary significantly due to different configurations or performance, and may include one or more central processing units (CPUs) 822 (e.g., one or more processors) and a memory 832, and one or more storage media 830 (e.g., one or more mass storage devices) for storing application programs 842 or data 844. The memory 832 and storage media 830 can be temporary or persistent storage. The program stored in the storage media 830 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server. Furthermore, the CPU 822 may be configured to communicate with the storage media 830 and execute the series of instruction operations in the storage media 830 on the server 800.

[0151] Server 800 may also include one or more power supplies 828, one or more wired or wireless network interfaces 850, one or more input / output interfaces 858, and / or one or more operating systems 841, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0152] The steps performed by the web server in the above embodiments can be based on this. Figure 8 The server structure shown.

[0153] This application also provides a computer-readable storage medium storing at least one executable instruction, which, when executed on a computing device, causes the computing device to perform the optimized method for webpage tampering protection described in any of the above embodiments.

[0154] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0155] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0156] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0158] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0159] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0160] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0161] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for preventing webpage tampering, characterized in that, include: The webpage tampering protection server receives detailed tampering attack information corresponding to the target operation. This detailed tampering attack information is collected when the webpage server blocks the target operation. The target operation is at least one operation detected by the webpage server in real time that does not match the initial protection policy corresponding to the target webpage. The webpage tampering protection server collects and filters traffic data fed back by the distributed Agent proxy to predict potential tampering risks. The Agent proxy is installed on the user's webpage server to monitor the site and block tampering attacks. The Agent proxy includes a data collection module and a threat processing module. The data collection module is used to dynamically monitor, analyze, and control all inbound and outbound traffic to the website server, monitor the website server status information in real time, and form a system status dataset of the website server, which is sent to the webpage tampering protection server in real time. The threat processing module monitors the addition, deletion, and modification operations of kernel files by placing hook functions in kernel file operation functions, and feeds back the tampering attack log to the webpage tampering protection server when blocking tampering attacks, so that it can update the anti-tampering rule base. The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the tampering attack details, where N is an integer greater than or equal to 1; The webpage tampering protection server updates the N high-risk indicators to the rule base, and according to the protection rules in the rule base, distributes the protection policies corresponding to the N high-risk indicators to the servers managed by the webpage tampering protection server to perform tampering protection. The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, including: The webpage tampering protection server decomposes the tampering attack details into M risk measurement indicators, where M is an integer greater than or equal to 2; The webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on the M risk measurement indicators; The webpage tampering protection server determines the group evaluation value as prior information of the Bayesian network; The webpage tampering protection server infers the probability distribution conditions of the M risk measurement indicators based on the prior information of the Bayesian network. The webpage tampering protection server assesses the threat level of the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

2. The method according to claim 1, characterized in that, The webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on the M risk measurement indicators, including: The webpage tampering protection server determines the risk assessment value corresponding to the target decision group based on the M risk measurement indicators, wherein the target decision group is the decision group corresponding to the target webpage; The webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value.

3. The method according to claim 2, characterized in that, The webpage tampering protection server determines the group evaluation value corresponding to the target decision group based on the risk evaluation value, including: The group evaluation value corresponding to the target decision group is determined by the following formula: ； in, The group evaluation value of the target decision-making group is m, where m is the number of the M risk measurement indicators. For the weight vector, for The element in the i-th position after being sorted according to preset rules. This is a vector of risk assessment values ​​corresponding to the target decision group.

4. A method for preventing webpage tampering, characterized in that, include: The web server monitors at least one operation performed on the target webpage in real time. The web server determines whether any of the at least one operations is a target operation that does not match the initial protection strategy corresponding to the target webpage; If so, the web server blocks the target operation; The web server collects detailed information on the tampering attack corresponding to the target operation; The web server sends the detailed information of the tampering attack to the webpage tampering protection server, enabling the webpage tampering protection server to determine N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, update the N high-risk indicators to the rule base, and return the protection strategy corresponding to the N high-risk indicators according to the protection rules in the rule base, where N is an integer greater than or equal to 1; the webpage tampering protection server collects and filters traffic data fed back by the distributed Agent proxy to predict potential tampering risks; wherein the Agent proxy is installed on the user's webpage. The server monitors and blocks website tampering attacks. The agent includes a data collection module and a threat handling module. The data collection module dynamically monitors, analyzes, and controls all inbound and outbound traffic to the website server, monitors the website server status information in real time, and generates a system status dataset of the website server, which is then sent to the website tampering protection server in real time. The threat handling module monitors the addition, deletion, and modification operations of kernel files by placing hook functions in kernel file operation functions, and when blocking tampering attacks, it feeds back the tampering attack logs to the website tampering protection server so that it can update the anti-tampering rule base. The web server performs tamper protection on the target webpage based on the protection strategies corresponding to the N high-risk indicators and the initial protection strategy; The webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, including: The webpage tampering protection server decomposes the tampering attack details into M risk measurement indicators, where M is an integer greater than or equal to 2; The webpage tampering protection server determines the group evaluation value of the target decision group corresponding to the target webpage based on the M risk measurement indicators; The webpage tampering protection server determines the group evaluation value as prior information of the Bayesian network; The webpage tampering protection server infers the probability distribution conditions of the M risk measurement indicators based on the prior information of the Bayesian network. The webpage tampering protection server assesses the threat level of the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

5. A webpage tampering protection server, characterized in that, The webpage tampering protection server collects and filters traffic data returned by distributed agent proxies to predict potential tampering risks; including: The receiving unit is used to receive tampering attack details corresponding to the target operation. The tampering attack details are collected by the web server when it blocks the target operation. The target operation is at least one operation against the target webpage that is not matched with the initial protection policy corresponding to the target webpage, which is detected by the web server in real time. The determining unit is configured to determine N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, wherein N is an integer greater than or equal to 1; The distribution unit is used to update the N high-risk indicators to the rule base, and according to the protection rules in the rule base, distribute the protection policies corresponding to the N high-risk indicators to the servers managed by the webpage tampering protection server for tampering protection. The determining unit is further configured to: The tampering attack details are decomposed into M risk measurement indicators, where M is an integer greater than or equal to 2; The group evaluation value of the target decision group corresponding to the target webpage is determined based on the M risk measurement indicators. The group evaluation value is determined as the prior information of the Bayesian network; Based on the prior information of the Bayesian network, the probability distribution conditions of the M risk measurement indicators are determined. Threat level assessment is performed on the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators; The Agent is installed on the user's web server to monitor the site and block tampering attacks. The Agent includes a data collection module and a threat handling module. The data collection module dynamically monitors, analyzes, and controls all inbound and outbound traffic to the web server, monitors the web server's status information in real time, and generates a system status dataset that is sent to the web tampering protection server in real time. The threat handling module monitors the addition, deletion, and modification of kernel files by placing hook functions in kernel file operation functions. When a tampering attack is blocked, the module feeds back the tampering attack log to the web tampering protection server so that it can update its anti-tampering rule base.

6. A web server, characterized in that, include: The detection unit is used to detect at least one operation targeting the target webpage in real time. The judgment unit is used to determine whether there is a target operation in the at least one operation that does not match the initial protection strategy corresponding to the target webpage; A blocking unit is configured to block the target operation if the target operation exists in at least one of the operations; The collection unit is used to collect detailed information on the tampering attack corresponding to the target operation; The sending unit is configured to send the detailed information of the tampering attack to the webpage tampering protection server, so that the webpage tampering protection server determines N high-risk indicators corresponding to the target operation based on the detailed information of the tampering attack, updates the N high-risk indicators to the rule base, and returns the protection policy corresponding to the N high-risk indicators according to the protection rules in the rule base, wherein N is an integer greater than or equal to 1; the webpage tampering protection server collects and filters traffic data fed back by the distributed Agent proxy to predict tampering risks that have not yet occurred; wherein the Agent proxy is installed on the user's webpage. The server monitors and blocks website tampering attacks. The agent includes a data collection module and a threat handling module. The data collection module dynamically monitors, analyzes, and controls all inbound and outbound traffic to the website server, monitors the website server status information in real time, and generates a system status dataset of the website server, which is then sent to the website tampering protection server in real time. The threat handling module monitors the addition, deletion, and modification operations of kernel files by placing hook functions in kernel file operation functions, and when blocking tampering attacks, it feeds back the tampering attack logs to the website tampering protection server so that it can update the anti-tampering rule base. The protection unit is used to protect the target webpage from tampering based on the protection strategies corresponding to the N high-risk indicators and the initial protection strategy; The webpage tampering protection server is further used for: The tampering attack details are decomposed into M risk measurement indicators, where M is an integer greater than or equal to 2; The group evaluation value of the target decision group corresponding to the target webpage is determined based on the M risk measurement indicators. The group evaluation value is determined as the prior information of the Bayesian network; Based on the prior information of the Bayesian network, the probability distribution conditions of the M risk measurement indicators are determined. Threat level assessments are performed on the probability distribution conditions of the M risk measurement indicators to determine the N high-risk indicators.

7. A computer program product, when the computer program product is run on a computer, causes the computer to perform the webpage tampering protection method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one executable instruction, which, when executed on a computing device, causes the computing device to perform the webpage tampering protection method as described in any one of claims 1 to 4.

Images