Webpage tampering monitoring method, system, device, medium and program product

Abstract

The application provides a webpage tampering monitoring method, system, device, medium and program product, and relates to the technical field of network security.The method comprises the following steps: acquiring a current DOM tree, current source code and current webpage screenshot of each webpage, which are recorded as a current data set; acquiring a standard DOM tree, standard source code and standard webpage screenshot of each webpage, which are recorded as a standard data set; acquiring a webpage map, wherein the webpage map comprises a link relationship between the webpages; determining a first webpage tampering degree of each webpage according to the webpage map, the current data set and the standard data set, which is recorded as a webpage tampering degree set; and if a second webpage tampering degree greater than or equal to a preset threshold exists in the webpage tampering degree set, it is determined that the webpage corresponding to the second webpage tampering degree has a tampering risk.The application monitors the webpage by means of the DOM tree, the webpage screenshot and the webpage source code, thereby avoiding inaccurate monitoring caused by incomplete keyword feature libraries.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, system, device, medium, and program product for monitoring webpage tampering. Background Technology

[0002] Website tampering refers to the act of illegally intruding into a website and injecting malicious content into some or all pages of the website, or creating new malicious content on the website.

[0003] Currently, detection is mainly achieved by comparing keyword feature libraries and the source code of web pages across different time periods. Keyword feature library detection relies heavily on the feature library itself; however, if the feature library is incomplete, it can lead to missed or false positives. On the other hand, relying solely on source code comparison is too simplistic and can also result in inaccurate web page monitoring. Summary of the Invention

[0004] This invention provides a method, system, device, medium, and program product for monitoring webpage tampering, which solves the shortcomings of existing technologies that use keyword feature databases and comparison of webpage source code between different time periods for webpage map monitoring, which are prone to false alarms and inaccurate monitoring results.

[0005] This invention provides a method for monitoring webpage tampering, comprising:

[0006] Retrieve the current DOM tree, current source code, and current webpage screenshot for each webpage, and denote them as the current data group;

[0007] Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group;

[0008] Obtain a webpage map, which includes the link relationships between various webpages;

[0009] The first webpage tampering degree of each webpage is determined based on the webpage map, the current data group, and the standard data group, and is denoted as the webpage tampering degree set.

[0010] If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

[0011] Optionally, determining the first degree of webpage tampering for each webpage based on the webpage map, the current data group, and the standard data group includes:

[0012] From all web pages, identify the first distinguishing web pages that differ from the standard page screenshot, and obtain the first distinguishing web page set;

[0013] From the first set of distinguished web pages, determine the second set of distinguished web pages that are different from the standard DOM tree in the current DOM tree, as well as the distinguished DOM nodes in the second set of distinguished web pages;

[0014] Obtain the current source code and standard source code of each second differentiated webpage in the second differentiated webpage set;

[0015] The degree of first page tampering for each second page is determined based on the webpage map, the second set of distinguished pages, and the current and standard source code of the second distinguished pages.

[0016] Optionally, determining a second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, includes:

[0017] Iterate through each of the first distinguished web pages in the first set of distinguished web pages;

[0018] When the current DOM tree of the first distinguishing webpage is different from the standard DOM tree, it is determined to be the second distinguishing webpage, and the distinguishing DOM nodes in the second distinguishing webpage are determined.

[0019] Optionally, determining a second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, includes:

[0020] For each of the first distinguishing web pages, determine whether the first-level nodes of the current DOM tree are the same as those of the standard DOM tree, where the first-level nodes are the root nodes;

[0021] When the first-level nodes of the current DOM tree are different from those of the standard DOM tree, the first distinguishing webpage is determined to be the second distinguishing webpage, and all nodes in the current DOM tree are determined to be the distinguishing DOM nodes.

[0022] Optionally, determining the second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, further includes:

[0023] When the current DOM tree is the same as the N-1 level node of the standard DOM tree, determine whether the current DOM tree is the same as the N level node of the standard DOM tree. The N level node includes all nodes connected to the N-1 level node, where N = 2, 3, 4...;

[0024] When the current DOM tree and the standard DOM tree have different Nth-level nodes, the first distinguishing webpage is determined to be the second distinguishing webpage, and all different Nth-level nodes in the current DOM tree, as well as all nodes connected to the different Nth-level nodes, are determined to be the distinguishing DOM nodes.

[0025] Optionally, the degree of first page tampering for each second differentiated page is determined based on the webpage map, the second differentiated page set, and the current and standard source code of each second differentiated page, including:

[0026] Determine the total number of lines of code in the current source code of the second distinguishing webpage that are different from the standard source code, and the different types of each different line, including addition, deletion and modification;

[0027] The degree of anomaly of the second distinguishing webpage is determined based on the total number of lines of code and the different types of each distinct line;

[0028] The adjustment factor for the second distinguishing webpage is determined based on the webpage map and the second distinguishing webpage set;

[0029] The first webpage tampering degree of the second distinguishing webpage is determined based on the anomaly degree of the second distinguishing webpage and the adjustment coefficient of the second distinguishing webpage.

[0030] Optionally, when it is determined that the webpage corresponding to the second webpage tampering degree is at risk of tampering, an early warning is issued for the webpage corresponding to the second webpage tampering degree.

[0031] This invention also provides a webpage tampering monitoring system, comprising:

[0032] The current data group acquisition module is used to obtain the current DOM tree, current source code, and current webpage screenshot for each webpage, denoted as the current data group.

[0033] The standard data group acquisition module is used to acquire the standard DOM tree, standard source code, and standard page screenshots of each webpage, which are referred to as the standard data group.

[0034] A webpage map acquisition module is used to acquire a webpage map, which includes the link relationships between various webpages;

[0035] The tampering degree determination module is used to determine the first webpage tampering degree of each webpage based on the webpage map, the current data group and the standard data group, which is denoted as the webpage tampering degree set.

[0036] The tampering monitoring module is used to determine that the webpage corresponding to the second webpage tampering degree has a tampering risk if there is a second webpage tampering degree greater than or equal to a preset threshold in the webpage tampering degree set.

[0037] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the webpage tampering monitoring method.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the webpage tampering monitoring method.

[0039] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the webpage tampering monitoring method.

[0040] This invention provides a method, system, device, medium, and program product for monitoring webpage tampering. It acquires the current DOM tree, current source code, and current screenshot of each webpage, denoted as the current data group; acquires the standard DOM tree, standard source code, and standard page screenshot of each webpage, denoted as the standard data group; acquires a webpage map, which includes the link relationships between webpages; determines a first webpage tampering degree for each webpage based on the webpage map, the current data group, and the standard data group, denoted as the webpage tampering degree set; if a second webpage tampering degree greater than or equal to a preset threshold exists in the webpage tampering degree set, then the webpage corresponding to the second webpage tampering degree is determined to have a tampering risk. In other words, this invention monitors whether a webpage has been tampered with by jointly using the DOM tree, webpage screenshot, and webpage source code, avoiding inaccurate monitoring caused by incomplete keyword feature libraries or relying solely on source code comparison, thus improving the accuracy of monitoring. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart of the webpage tampering monitoring method provided by the present invention;

[0043] Figure 2 This is a schematic diagram of the technical principle of the webpage tampering monitoring method provided by the present invention;

[0044] Figure 3 This is a schematic diagram of the DOM tree structure provided in an embodiment of the present invention;

[0045] Figure 4 This is a module diagram of the webpage tampering monitoring system provided by the present invention;

[0046] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0048] The following is combined Figures 1-5 This invention describes the webpage tampering monitoring method, system, device, medium, and program product.

[0049] Figure 1 This is a flowchart of the webpage tampering monitoring method provided by the present invention. Figure 2 This is a schematic diagram of the technical principle of the webpage tampering monitoring method provided by the present invention, such as... Figure 1 and Figure 2 As shown, a method for monitoring webpage tampering includes:

[0050] Step 101: Obtain the current DOM tree, current source code, and current webpage screenshot for each webpage, and denote them as the current data group.

[0051] Among them, the DOM tree is a tree with a DOM structure.

[0052] The basic element of the DOM structure is the node; a webpage is composed of hierarchical nodes.

[0053] The following uses the source code of webpage 1 as an example:

[0054]

[0055]

[0056]

[0057]

[0058]

[0059]

[0060]

[0061] in,,,, 、 Each represents a different node. Their corresponding DOM tree is as follows: Figure 3 As shown.

[0062] Traditional DOM tree generation uses an HTML parser to analyze HTML elements, and then constructs a DOM tree through tokenization and tree building. This invention, however, does not wait for the entire HTML document to load before parsing; instead, it parses only the data loaded by the network process.

[0063] For example, after the network process receives the response header, it determines the file type based on the content-type field in the header. If the content-type value is "text / html", the browser will determine it's an HTML file. Then, it selects or creates a renderer for the request. Once the renderer is ready, a shared data pipeline is established between the network process and the renderer. Data received by the network process is placed into this pipeline, and the HTML parser then retrieves and processes the data from the pipeline.

[0064] When the HTML parser processes the data, it creates an empty DOM structure with the root "document" by default. Its source code is as follows:

[0065] 1

[0066] 2

[0067] 3 1

[0068] 4 <script type＝"text javascript"src＝'foo.js'>< / script>

[0069] 5 test

[0070] 6

[0071] 7

[0072] When a JavaScript tag is encountered, the entire DOM parsing is paused, and the JavaScript code is executed. However, the JavaScript code needs to be downloaded first. The download environment requires close attention because the download process of the JavaScript file blocks DOM parsing, and downloads are typically very time-consuming, affected by factors such as network conditions and the size of the JavaScript file.

[0073] To address this issue, this invention initiates a pre-parsing thread after the rendering engine receives the byte stream. This thread analyzes the HTML file and related files such as JavaScript and CSS. Once the relevant files are parsed, the pre-parsing thread downloads them in advance.

[0074] Step 102: Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group.

[0075] The standard DOM tree, standard source code, and standard page screenshots are all the correct versions of the generated webpage, or the correct versions after modification and confirmation. In other words, the standard DOM tree, standard source code, and standard page screenshots are confirmed to be correct and have not been tampered with.

[0076] For example, after a webpage is generated and launched, its DOM tree, source code, and webpage screenshots are obtained, and these obtained DOM tree, source code, and webpage screenshots are used as standard DOM tree, standard source code, and standard webpage screenshots for subsequent comparison and tampering.

[0077] For example, after updating and launching a webpage, obtain its DOM tree, source code, and webpage screenshots. Use the obtained DOM tree, source code, and webpage screenshots as standard DOM trees, standard source code, and standard webpage screenshots for subsequent comparison and tampering.

[0078] In other words, at any given moment, there is only one version of the standard DOM tree, standard source code, and standard page screenshot, which is the latest version of the webpage's DOM tree, source code, and webpage screenshot.

[0079] Step 103: Obtain a web map, which includes the link relationships between various web pages.

[0080] Specifically, a webpage map describes the link relationships between webpages: for example, there is a link in webpage 1 that leads to webpage 2.

[0081] Based on this connection, in the web map, there is an edge between the point corresponding to web page 1 and the point corresponding to web page 2, pointing from web page 1 to web page 2. Therefore, the web map is a directed graph.

[0082] Step 104: Determine the first webpage tampering degree of each webpage based on the webpage map, the current data group, and the standard data group, and denot it as the webpage tampering degree set.

[0083] In one specific embodiment, determining the first degree of webpage tampering for each webpage based on the webpage map, the current data group, and the standard data group includes:

[0084] From all web pages, identify the first distinguishing web pages that differ from the standard page screenshot, and obtain the first distinguishing web page set;

[0085] From the first set of distinguished web pages, determine the second set of distinguished web pages that are different from the standard DOM tree in the current DOM tree, as well as the distinguished DOM nodes in the second set of distinguished web pages;

[0086] Obtain the current source code and standard source code of each second differentiated webpage in the second differentiated webpage set;

[0087] The degree of first page tampering for each second page is determined based on the webpage map, the second set of distinguished pages, and the current and standard source code of the second distinguished pages.

[0088] In other words, this invention utilizes webpage screenshots, the current DOM tree, and the current source code simultaneously in the process of determining the degree of tampering, resulting in more diverse data information and ensuring the accuracy of subsequent tampering monitoring.

[0089] In one specific embodiment, determining the second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, includes:

[0090] Iterate through each of the first distinguished web pages in the first set of distinguished web pages;

[0091] When the current DOM tree of the first distinguishing webpage is different from the standard DOM tree, it is determined to be the second distinguishing webpage, and the distinguishing DOM nodes in the second distinguishing webpage are determined.

[0092] In one specific embodiment, determining the second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, includes:

[0093] For each of the first distinguishing web pages, determine whether the first-level nodes of the current DOM tree are the same as those of the standard DOM tree, where the first-level nodes are the root nodes;

[0094] When the first-level nodes of the current DOM tree are different from those of the standard DOM tree, the first distinguishing webpage is determined to be the second distinguishing webpage, and all nodes in the current DOM tree are determined to be the distinguishing DOM nodes.

[0095] In one specific embodiment, determining the second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, further includes:

[0096] When the current DOM tree is the same as the N-1 level node of the standard DOM tree, determine whether the current DOM tree is the same as the N level node of the standard DOM tree. The N level node includes all nodes connected to the N-1 level node, where N = 2, 3, 4...;

[0097] When the current DOM tree and the standard DOM tree have different Nth-level nodes, the first distinguishing webpage is determined to be the second distinguishing webpage, and all different Nth-level nodes in the current DOM tree, as well as all nodes connected to the different Nth-level nodes, are determined to be the distinguishing DOM nodes.

[0098] In one specific embodiment, determining the first degree of webpage tampering for each second-differentiated webpage based on the webpage map, the second set of differentiated webpages, and the current and standard source code of each second-differentiated webpage includes:

[0099] Determine the total number of lines of code in the current source code of the second distinguishing webpage that are different from the standard source code, and the different types of each different line, including addition, deletion and modification;

[0100] The degree of anomaly of the second distinguishing webpage is determined based on the total number of lines of code and the different types of each distinct line;

[0101] The adjustment factor for the second distinguishing webpage is determined based on the webpage map and the second distinguishing webpage set;

[0102] The first webpage tampering degree of the second distinguishing webpage is determined based on the anomaly degree of the second distinguishing webpage and the adjustment coefficient of the second distinguishing webpage.

[0103] Step 105: If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

[0104] In summary, this invention monitors whether a webpage has been tampered with by using the DOM tree, webpage screenshots, and webpage source code together. This avoids the inaccurate monitoring problems caused by incomplete keyword feature libraries or reliance solely on source code comparison in existing methods, thereby improving the accuracy of monitoring.

[0105] In one specific embodiment, when it is determined that the webpage corresponding to the second webpage tampering degree is at risk of tampering, an early warning is issued for the webpage corresponding to the second webpage tampering degree.

[0106] For the specific principles and steps of steps 104-105, please refer to [link / reference needed]. Figure 2 Specifically, it includes:

[0107] 1. Compare the current webpage screenshot of each webpage with the standard webpage screenshot to determine if they are the same.

[0108] This step only compares the images and is for qualitative judgment only. In other words, it determines whether there has been a change through image comparison; this change could be due to tampering or display anomalies caused by browser or other issues.

[0109] Because comparing images can quickly and intuitively determine whether a change has occurred. If no change has occurred, no further qualitative determination is needed; if a change has occurred, a more detailed qualitative analysis is required.

[0110] To speed up the process of image comparison, the webpage can be divided into blocks. The same blocks are captured from the same location in the current webpage screenshot and the standard page screenshot. The similarity between the two captured blocks is determined by the image comparison method. At this time, the similarity between all blocks will be obtained, and then the average value is used as the result of the image comparison.

[0111] Furthermore, when dividing the image into blocks, it is not based on a fixed distance, but rather on a standard page screenshot. The standard page screenshot is converted into a grayscale image, and the grayscale image is binarized. The findContours() function is used to detect all contours in the processed image. After obtaining the contours, the drawContours() function is used to overlap the contour annotation curves on the original image, and then the image information is divided into blocks based on the curves.

[0112] Of course, other comparison schemes can be used in implementation, but the comparison method is not the focus of this invention and will not be described in detail.

[0113] 2. For web pages with different screenshots, compare their current DOM tree with their standard DOM tree to determine if they are the same.

[0114] For ease of description, all web pages will be labeled A1, A2, ..., A n Where n is the total number of web pages. The set of all web pages is denoted as A = {A1, A2, ..., A...}. n },

[0115] The web pages with different screenshots are labeled B1, B2, ..., B m Where m is the total number of web pages with different screenshots, that is, m ≤ n. All web pages with different screenshots are denoted as B = {B1, B2, ..., Bn}. m Set B is a subset of set A (i.e., screenshots of some web pages are different, and screenshots of other web pages are different). Figure 1 (e.g., the same as set B) or the same as set A (i.e., all webpage screenshots are different).

[0116] In this step, each element in set B will be read sequentially, and its current DOM tree will be compared with its standard DOM tree to determine whether the two are the same.

[0117] The comparison process is as follows (taking left to right as an example):

[0118] 1) Start comparing from the root node to determine if the root nodes of the two nodes are the same. If they are not the same, stop comparing and determine the range of nodes that are different to the entire webpage.

[0119] 2) If the root nodes are the same, compare whether the leftmost nodes connected to the root nodes are the same. If they are not the same, determine the leftmost node and all nodes connected to it as different, and then continue to compare the second node from the left. If the leftmost nodes are the same, continue to compare the second node from the left.

[0120] Similarly, all nodes connected to the root node (denoted as second-level nodes) are compared.

[0121] In other words, this step compares nodes in a certain order, such as from left to right or from right to left, which ensures the efficiency and comprehensiveness of the comparison.

[0122] It should be noted that the comparison order from right to left is the same as the principle from left to right mentioned above, and will not be repeated here.

[0123] 3) For third-level nodes (all nodes connected to second-level nodes), the comparison is still performed from left to right. For any node, if it is already determined to be in a different range (e.g., its parent node is different during comparison, so the node is considered to be in a different range), then it is not processed further, and the next node is processed directly. If it is not determined to be in a different range, then its current DOM tree is compared with the corresponding node in the standard DOM tree. If they are the same, the next node is compared. If they are different, then the node and all its connected nodes are determined to be in a different range, and the next node is compared.

[0124] And so on, comparing all nodes across all layers.

[0125] At this point, the system will compare the current DOM tree of each webpage with the standard DOM tree to see if they are the same, as well as the different sets of nodes.

[0126] 3. For web pages with different DOM trees, determine whether they have been tampered with based on their different node positions, webpage maps, current source code, and standard source code.

[0127] For ease of description, web pages with not identical DOM trees are denoted as C1, C2, ..., C6. k Where k is the total number of web pages whose DOM trees are not completely identical, that is, k ≤ m. The web pages whose DOM trees are not completely identical are denoted as C = {C1, C2, ..., Cm}. k Set C is a subset of set B (i.e., some web pages have different DOM trees, while others have the same DOM tree) or set C is the same as set B (i.e., all web pages have different DOM trees).

[0128] For web pages whose DOM trees are not completely identical, such as web page 3,

[0129] 1) Determine the different sets of nodes for webpage 3.

[0130] 2) Determine the current source code segment corresponding to different node sets in the current source code.

[0131] 3) Identify the standard source code segments corresponding to different node sets in the standard source code.

[0132] 4) Based on the standard source code segment, determine the total number of lines of code that are different between the current source code segment and the standard source code segment, as well as the different types of each different line.

[0133] The different types include adding, deleting, and modifying.

[0134] Specifically, if the current line of code in the source code segment includes all the content of the same line of code in the standard source code segment, only with more content, then the type is "increment".

[0135] If the line of code in the standard source code segment includes all the content of the line of code in the current source code segment, and only the standard source code segment is missing content, then the type is deletion.

[0136] In addition, the type is determined to be modified.

[0137] 5) Calculate the anomaly degree of webpage k:

[0138]

[0139] Among them, U 当 U represents the total number of lines in the current source code segment corresponding to different node sets. 标 U' represents the total number of lines of standard source code segments corresponding to different nodes in the standard source code, and U' represents the total number of distinct lines of code. 增 For the total number of lines of type increment in different code, U′ 删 For the total number of lines of type 'delete' in different codes, U′ 改 N represents the total number of lines of code of type [type] that are different from each other. 当 N represents the total number of distinct nodes in the current source code. 标 N represents the total number of distinct nodes in the standard source code. 当增 The total number of nodes involved in the current source code for code of type increment, N. 标增 The total number of nodes involved in incremental code in the standard source code, N 当删 The total number of nodes involved in the current source code for code of type "delete", N. 标删 The total number of nodes involved in the code of type delete in the standard source code, N 当改 The total number of nodes involved in the modified code in the current source code, N. 标改 The total number of nodes involved in the code of type "modified" in the standard source code.

[0140] 6) In the webpage map, identify all webpage nodes that can be reached from webpage k, and all webpage nodes that can reach webpage k.

[0141] Determine the adjustment factor for webpage k

[0142] If a webpage node remains unchanged, the anomaly score is 0.

[0143] 7) Calculate webpages

[0144] 8) Determine the relationship between the degree of tampering of each webpage and the preset threshold. If there is a webpage tampering degree greater than the preset threshold, then it is considered that there is a risk of webpage tampering, an early warning is issued, and information about the webpages with a degree greater than the preset threshold is provided.

[0145] The preset threshold is an empirical value, or it can be obtained through big data analysis. However, it is not the focus of this invention and will not be described in detail here.

[0146] It should be noted that steps 101-105 of the present invention can be set to perform a webpage tampering monitoring process every preset period (such as half a day, one day, one week, one month, etc., the smaller the period, the more timely the monitoring), so as to know in a timely manner whether the monitored webpage has been tampered with.

[0147] This invention allows web pages to be monitored according to actual monitoring needs by setting monitoring time periods. For example, a monitoring period of one week can be set for some web pages with lower importance, while a monitoring period of half a day can be set for important web pages, thus achieving on-demand monitoring and saving monitoring resources.

[0148] The webpage tampering monitoring system provided by the present invention is described below. The webpage tampering monitoring system described below can be referred to in correspondence with the webpage tampering monitoring method described above.

[0149] like Figure 4 As shown, a webpage tampering monitoring system includes:

[0150] The current data group acquisition module 401 is used to acquire the current DOM tree, current source code, and current webpage screenshot of each webpage, denoted as the current data group.

[0151] The standard data group acquisition module 402 is used to acquire the standard DOM tree, standard source code, and standard page screenshots of each webpage, denoted as the standard data group.

[0152] The webpage map acquisition module 403 is used to acquire a webpage map, which includes the link relationships between various webpages.

[0153] The tampering degree determination module 404 is used to determine the first webpage tampering degree of each webpage based on the webpage map, the current data group and the standard data group, which is denoted as the webpage tampering degree set.

[0154] The tampering monitoring module 405 is used to determine that the webpage corresponding to the second webpage tampering degree has a tampering risk if there is a second webpage tampering degree greater than or equal to a preset threshold in the webpage tampering degree set.

[0155] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a webpage tampering monitoring method, which includes:

[0156] Get the current DOM tree, current source code, and current screenshot of each webpage, and denote them as the current data group.

[0157] Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group.

[0158] Obtain a web map, which includes the link relationships between various web pages.

[0159] The first degree of webpage tampering for each webpage is determined based on the webpage map, the current data group, and the standard data group, and is denoted as the webpage tampering degree set.

[0160] If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

[0161] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0162] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is capable of executing a webpage tampering monitoring method, the method comprising:

[0163] Get the current DOM tree, current source code, and current screenshot of each webpage, and denote them as the current data group.

[0164] Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group.

[0165] Obtain a web map, which includes the link relationships between various web pages.

[0166] The first degree of webpage tampering for each webpage is determined based on the webpage map, the current data group, and the standard data group, and is denoted as the webpage tampering degree set.

[0167] If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

[0168] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform a webpage tampering monitoring method, the method comprising:

[0169] Get the current DOM tree, current source code, and current screenshot of each webpage, and denote them as the current data group.

[0170] Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group.

[0171] Obtain a web map, which includes the link relationships between various web pages.

[0172] The first degree of webpage tampering for each webpage is determined based on the webpage map, the current data group, and the standard data group, and is denoted as the webpage tampering degree set.

[0173] If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring webpage tampering, characterized in that, include: Get the current DOM tree, current source code, and current screenshot of each webpage, and denote them as the current data group; Obtain the standard DOM tree, standard source code, and standard page screenshots for each webpage, and denote them as the standard data group; Obtain a webpage map, which includes the link relationships between various webpages; The first webpage tampering degree of each webpage is determined based on the webpage map, the current data group, and the standard data group, and is denoted as the webpage tampering degree set. If there is a second webpage tampering degree in the set of webpage tampering degrees that is greater than or equal to a preset threshold, then it is determined that the webpage corresponding to the second webpage tampering degree has a risk of tampering.

2. The webpage tampering monitoring method according to claim 1, characterized in that, The degree of first-order webpage tampering for each webpage is determined based on the webpage map, the current data group, and the standard data group, including: From all web pages, identify the first distinguishing web pages that differ from the standard page screenshot, and obtain the first distinguishing web page set; From the first set of distinguished web pages, determine the second set of distinguished web pages that are different from the standard DOM tree in the current DOM tree, as well as the distinguished DOM nodes in the second set of distinguished web pages; Obtain the current source code and standard source code of each second differentiated webpage in the second differentiated webpage set; The degree of first page tampering for each second page is determined based on the webpage map, the second set of distinguished pages, and the current and standard source code of the second distinguished pages.

3. The webpage tampering monitoring method according to claim 2, characterized in that, Determining second distinguishing web pages from the first distinguishing web page set, where the current DOM tree differs from the standard DOM tree, includes: Iterate through each of the first distinguished web pages in the first set of distinguished web pages; When the current DOM tree of the first distinguishing webpage is different from the standard DOM tree, it is determined to be the second distinguishing webpage, and the distinguishing DOM nodes in the second distinguishing webpage are determined.

4. The webpage tampering monitoring method according to claim 2, characterized in that, Determining second distinguishing web pages from the first distinguishing web page set, where the current DOM tree differs from the standard DOM tree, includes: For each of the first distinguishing web pages, determine whether the first-level nodes of the current DOM tree are the same as those of the standard DOM tree, where the first-level nodes are the root nodes; When the first-level nodes of the current DOM tree are different from those of the standard DOM tree, the first distinguishing webpage is determined to be the second distinguishing webpage, and all nodes in the current DOM tree are determined to be the distinguishing DOM nodes.

5. The webpage tampering monitoring method according to claim 4, characterized in that, Determining a second distinguishing webpage from the first distinguishing webpage set, where the current DOM tree differs from the standard DOM tree, further includes: When the current DOM tree is the same as the N-1 level node of the standard DOM tree, determine whether the current DOM tree is the same as the N level node of the standard DOM tree. The N level node includes all nodes connected to the N-1 level node, where N = 2, 3, 4...; When the current DOM tree and the standard DOM tree have different Nth-level nodes, the first distinguishing webpage is determined to be the second distinguishing webpage, and all different Nth-level nodes in the current DOM tree, as well as all nodes connected to the different Nth-level nodes, are determined to be the distinguishing DOM nodes.

6. The webpage tampering monitoring method according to claim 2, characterized in that, The degree of first-level webpage tampering for each second-level webpage is determined based on the webpage map, the second set of differentiated webpages, and the current and standard source code of each second-level differentiated webpage, including: Determine the total number of lines of code in the current source code of the second distinguishing webpage that are different from the standard source code, and the different types of each different line, including addition, deletion and modification; The degree of anomaly of the second distinguishing webpage is determined based on the total number of lines of code and the different types of each distinct line; The adjustment factor for the second distinguishing webpage is determined based on the webpage map and the second distinguishing webpage set; The first webpage tampering degree of the second distinguishing webpage is determined based on the anomaly degree of the second distinguishing webpage and the adjustment coefficient of the second distinguishing webpage.

7. The webpage tampering monitoring method according to any one of claims 1-6, characterized in that, When it is determined that the webpage corresponding to the second webpage tampering degree is at risk of tampering, an early warning is issued for the webpage corresponding to the second webpage tampering degree.

8. A webpage tampering monitoring system, characterized in that, include: The current data group acquisition module is used to obtain the current DOM tree, current source code, and current webpage screenshot for each webpage, denoted as the current data group. The standard data group acquisition module is used to acquire the standard DOM tree, standard source code, and standard page screenshots of each webpage, which are referred to as the standard data group. A webpage map acquisition module is used to acquire a webpage map, which includes the link relationships between various webpages; The tampering degree determination module is used to determine the first webpage tampering degree of each webpage based on the webpage map, the current data group and the standard data group, which is denoted as the webpage tampering degree set. The tampering monitoring module is used to determine that the webpage corresponding to the second webpage tampering degree has a tampering risk if there is a second webpage tampering degree greater than or equal to a preset threshold in the webpage tampering degree set.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the webpage tampering monitoring method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the webpage tampering monitoring method as described in any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the webpage tampering monitoring method as described in any one of claims 1 to 7.

Images