Browser security processing method and system based on credential creation

Abstract

The invention discloses a browser security processing method and system based on credential creation. The method comprises the steps that a browser receives a judgment rule from a server; when the browser receives a network address; the browser compares the codes corresponding to the webpage with the code part in the judgment rule, and if the codes corresponding to the webpage do not exist in the codes corresponding to the webpage, the similarity of the codes exceeds a threshold value, the browser displays the webpage corresponding to the codes; if the codes corresponding to the webpage exist in the codes, the similarity between the codes and the codes exceeds a threshold value, the browser prompts that the problem codes exist in the webpage. By means of the method and device, the problem caused by the fact that when the browser browses the page, safety guarantee can only be carried out through the protection function or protection software of the operating system where the browser is located is solved, and therefore safety problem warning can be carried out through the browser.

Description

Technical Field

[0001] The present application relates to the field of information technology and browsers, and specifically, to a browser security processing method and system based on information technology. Background Art

[0002] The business system is used to process business logic. For example, in the power system, the business system can be used to view the status data of each power device and provide services such as user payment of electricity bills. The business system is a software system. The architecture of the software system includes B / S system and C / S system. The following describes these two architectures.

[0003] The Client / Server structure (C / S structure, referred to as CS structure) is a client and server structure. It is a software system architecture that can fully utilize the advantages of the hardware environment at both ends and reasonably allocate tasks to the Client and Server ends to reduce the communication overhead of the system. Under this architecture, the client needs to be installed in the user's operating system. On the one hand, the user's operating system is varied, and different clients need to be developed for different operating systems; on the other hand, based on security considerations, the client cannot be installed on some users' operating systems. Both aspects limit the development of the CS structure.

[0004] B / S architecture (BS architecture for short) is a browser and server architecture model. It is a variation or improvement of C / S architecture with the rise of Internet technology. In this architecture, the user interface is implemented through a WWW browser, a small part of the transaction logic is implemented on the front end (Browser), but the main transaction logic is implemented on the server side (Server). B / S architecture is a network architecture model after the rise of WEB, and the WEB browser is the most important application software on the client side.

[0005] From the characteristics of the BS architecture, it can be seen that as long as the user's operating system has a browser, the system can be used. For the operating system, the browser is configured by default. Therefore, the business system of the BS system can be more widely used.

[0006] Compared with the CS architecture, the BS architecture may have more security risks. This is because the browser will parse the code in the page when displaying the page. In this case, the programmer who wrote the page may implant code that is harmful to the browser or the system where the browser is located, thereby threatening the security of the browser or the operating system where the browser is located.

[0007] Compared with the existing technical patent CN1349163A, the purpose of the existing technology is to overcome the defects of the existing technology and provide a web page security publishing system based on the bottom layer of the operating system to prevent file tampering, so as to ensure efficient and real-time detection of web page publishing files, prevent illegal operations from tampering with the published files, and ensure normal file publishing of the website, rather than real-time recovery of the web page after the web page tampering occurs. It is guaranteed to prevent web page tampering in time as soon as possible, so as to reduce the system resource cost of web page recovery and shorten the response processing time.

[0008] The existing technical solution is based on the existing web page security publishing system, and its characteristics are that the publishing file detection module in the first-level monitoring terminal is improved to a web page publishing file anti-tampering module set at the bottom of the web page publishing server operating system, which fully takes over the read and write operations of the file system, and the original publishing file upload and recovery protocol module connected to the first and second-level monitoring terminals is improved to a publishing file upload module, which executes the issuance of normal files;

[0009] Furthermore, the web page publishing file tamper-proof module is a file system filter driver module, which is used as a basis to identify user operations through the operation legitimacy identification module, and use the file filter driver module to take over the read and write operations of the file system. When a user accesses the web page file system, the file filter driver module is used to obtain operation information before the operation occurs, and the operation legitimacy identification module is called at the same time to obtain information on whether the operation is legal or not. For legal operations, the corresponding operation rights are granted according to their permission settings; for illegal operations, the access rights to the web page file system are controlled to forcibly block users from illegal operations on the file system. The file filter driver module is written in the form of a virtual device driver (V×D) based on the bottom layer of the system to ensure that the system detects the operation intention before the user performs file read and write operations.

[0010] The existing technology has a strong timeliness in preventing the publication page from being tampered with, and can prevent file tampering attacks in advance, thereby eliminating various adverse effects caused by the destruction of the published files and reducing the cost and time required for recovery.

[0011] In the prior art, an additional protection software or protection function is usually added to the operating system to provide protection. On the one hand, this increases the operating burden of the operating system. On the other hand, if the user forgets to start the protection function or protection software, the user's security will not be guaranteed when browsing the web. Summary of the invention

[0012] The embodiments of the present application provide a browser security processing method and system based on trusted computing, so as to at least solve the problem that when browsing a web page in a browser, security can only be guaranteed by relying on the protection function of the operating system where the browser is located or the protection software.

[0013] According to one aspect of the present application, a browser security processing method based on trusted innovation is provided, including: a browser receives a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code part in a web programming language, and each code part is provided with a label, and the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; when the browser receives a network address, wherein the network address is the address of the web page that the browser needs to display, the browser obtains the code corresponding to the web page; the browser compares the code corresponding to the web page with the code part in the judgment rule, if the code corresponding to the web page does not contain a code whose similarity to the code part exceeds a threshold, the browser displays the web page corresponding to the code; if the code corresponding to the web page contains a code whose similarity to the code part exceeds a threshold, wherein the code whose similarity exceeds the threshold is a problem code, the browser prompts that the problem code exists in the web page.

[0014] Furthermore, after the browser prompts that the problem code exists in the web page, the method also includes: the browser asks the user to choose whether to display the problem code in the browser, if the user chooses to display the problem code, all the codes in the web page are displayed; if the user chooses not to display the problem code, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0015] Furthermore, the method also includes: if the user chooses to display the problem code, then obtaining the level corresponding to the code portion whose similarity with the problem code exceeds a threshold in the judgment rule, wherein the higher the level, the greater the degree of harm of the problem code; when the level corresponding to the problem code exceeds a predetermined level, ignoring the user's choice, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0016] Furthermore, the method also includes: obtaining the first-level domain name of the web page, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, adding the first-level domain name to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

[0017] According to another aspect of the present application, there is also provided a browser security processing system based on trusted computing, the system comprising a browser and a server, the browser comprising the following modules: a receiving model, for receiving a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule comprises a code portion in at least one web programming language, each code portion is provided with a label, the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; an acquisition module, for, upon receiving a network address, wherein the network address is the address of the web page that the browser needs to display, acquiring the code corresponding to the web page; a processing module, for comparing the code corresponding to the web page with the code portion in the judgment rule, if the code corresponding to the web page does not contain a code whose similarity to the code portion exceeds a threshold, then displaying the web page corresponding to the code; if the code corresponding to the web page contains a code whose similarity to the code portion exceeds a threshold, wherein the code whose similarity exceeds the threshold is a problem code, then prompting that the problem code exists in the web page.

[0018] Furthermore, the processing module is also used to ask the user to choose whether to display the problem code in the browser. If the user chooses to display the problem code, all the codes in the web page will be displayed; if the user chooses not to display the problem code, the problem code in the web page will be shielded and other codes after shielding will be displayed.

[0019] Furthermore, the processing module is also used for: if the user chooses to display the problem code, then obtaining the level corresponding to the code portion whose similarity with the problem code exceeds a threshold in the judgment rule, wherein the higher the level, the greater the degree of harm of the problem code; when the level corresponding to the problem code exceeds a predetermined level, ignoring the user's choice, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0020] Furthermore, the processing module is also used to: obtain the first-level domain name of the web page, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, add the first-level domain name to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

[0021] According to another aspect of the present application, an electronic device is also provided, comprising a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the above-mentioned method steps.

[0022] According to another aspect of the present application, a computer program is provided, on which computer instructions are stored, wherein the computer instructions implement the above method steps when executed by a processor.

[0023] In the embodiment of the present application, a browser receives a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code part in a web page programming language, each code part is provided with a label, and the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; when the browser receives a network address, wherein the network address is the address of the web page that the browser needs to display, the browser obtains the code corresponding to the web page; the browser compares the code corresponding to the web page with the code part in the judgment rule, and if the code corresponding to the web page does not exist in the code corresponding to the web page, the browser displays the web page corresponding to the code; if the code corresponding to the web page exists in the code corresponding to the web page, the code with a similarity exceeding a threshold value to the code part, wherein the code with a similarity exceeding the threshold value is a problem code, and the browser prompts that the problem code exists in the web page. The present application solves the problem that when a browser browses a page, it can only rely on the protection function or protection software of the operating system where the browser is located to ensure security, so that the browser itself can warn of security issues. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings that form part of this application are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an improper limitation on this application. In the drawings:

[0025] Figure 1 It is a flowchart of a browser security processing method based on trusted computing according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] In the following implementations, rules can be saved in the browser, and the rules are used to indicate codes in the webpage that may have security risks, so that the security issues can be processed on the browser. The processing in the browser is described below in conjunction with the specific implementations.

[0029] In the following implementations, a server is involved, and the so-called server can be one or multiple servers in a distributed configuration. Such multiple servers in a distributed configuration can provide services for the browser. The distributed server can provide distributed services for the browser, and the distributed services are first described below.

[0030] In distributed services, commonly used service governance frameworks include Eureka, Consul, Nacos, etc., but there are more or less some problems. For example, the timeliness of service discovery is poor. Generally, it takes a few seconds or minutes to discover a service or perceive the offline of a service. If the service discovery time is shortened by configuration, it will cause a lot of network bottleneck overhead. Due to the peer-to-peer architecture adopted by the current service governance system, each server needs to carry a large number of requests. At the same time, the registry needs to be copied between nodes, and the data consistency is poor. It can only achieve final consistency. It usually takes tens of seconds or even a minute to complete data synchronization. In addition, the most important thing is that the existing frameworks basically do not support service governance in cross-language development environments. For example, in the streaming media storage and management project we are currently developing, 21 services are involved, developed by different developers, and the development languages ​​used include C++, Java, Python, etc. There is no way to use the more popular service governance frameworks on the market to achieve registration and discovery between services.

[0031] Based on the above content, a distributed service management method provided in this embodiment can be used. In this method, by receiving the registration request sent by the target application service, the online of the target application service can be discovered in time, so the timeliness of service discovery is good, and no large network bottleneck overhead is generated. Then, the service state corresponding to the target application service is changed to an online state, ensuring the accuracy of the service state corresponding to the target application service, and updating the application service list, and sending the updated application service list to the target application service, so that the target application service can establish a connection with the application service in the application service list that is online in a timely and accurate manner.

[0032] It should be noted that the distributed service management method provided in the embodiment of the present application may be executed by a distributed service management device, and the distributed service management device may be implemented as part or all of a server through software, hardware, or a combination of software and hardware, wherein the server may be a server cluster composed of multiple servers. In the following method embodiments, the execution subject is taken as an example for explanation.

[0033] The distributed service management method provided in the embodiment of the present application can be developed based on the SOE framework inside the server, and a registration center is developed in the server. Among them, the registration center is a software program for completing the distributed service management method provided in the embodiment of the present application. The SOE framework is an RPC framework based on session technology. All communications are completed through session objects. The session provides complete full-duplex support. The communicating parties use the methods and callbacks of the session objects to call each other. Since the SOE framework itself is a Socket framework based on the RPC protocol, it can achieve platform independence and development language independence. It is simple, practical, efficient, fool-proof, and easy to implement. Unlike RPC systems such as corba, .net-Remoting, ICE, Thrift, BRPC, and Dubbo, SOE is fully self-developed and has a light code stack. Learning it only requires understanding of very few concepts. All communications are completed through session objects. The session provides complete full-duplex support. The communicating parties use the methods and callbacks of the session objects to call each other, and the performance is strong in actual development applications. Therefore, the service governance solution implemented in this embodiment not only has the general functions of the commonly used service governance frameworks on the market, but also has advantages in performance. While reducing server resource consumption, it also has better timeliness. More importantly, it is not limited to the limitations of the development language and is more inclusive.

[0034] Among them, it should be noted that the registration center in the server provided in the embodiment of the present application can be combined with the keepalived component in the server cluster to achieve high availability of the distributed service management method. Among them, keepalived can realize the virtual IP of the server cluster, and other application services establish a connection with the registration center through the virtual IP. When the node where the virtual IP of the server cluster is located fails, the virtual IP will automatically drift to the normal node, thereby ensuring the high availability of the registration center. In other words, the server in the embodiment of the present application is one of the server clusters. When this server has a problem, Keepalived will automatically point the virtual IP to other available servers in the server cluster, so that it can be guaranteed that after the registration center on a server is hung, the virtual IP can quickly drift to other normal registration center servers, thereby ensuring the high availability of the registration center. For the convenience of description, in the following method embodiments, the execution subject is a server as an example for explanation.

[0035] In this embodiment, a distributed service management method is provided, and the process includes the following steps:

[0036] Step 1, receiving the registration request sent by the target application service. Specifically, the target application service can send a registration request to the server based on a full-duplex long connection with the server, and send the service type, service IP, service port, service name, service version, and service process number of the target application service to the server. The server receives the registration request sent by the target application service. Among them, "full-duplex long connection" belongs to the characteristics of the SOE framework, and full-duplex (Full Duplex) is a term for communication transmission. Communication allows data to be transmitted in two directions at the same time, and its capabilities are equivalent to the combination of two simplex communication modes. Full-duplex means that signals can be transmitted in both directions at the same time (instantaneously) (A→B and B→A). It means that A→B and B→A are instantaneously synchronized. Simplex means that only Party A is allowed to transmit information to Party B, while Party B cannot transmit to Party A.

[0037] Step 2: Change the service status of the target application service to an online status according to the registration request. Specifically, after receiving the registration request sent by the target application service and the service type, service IP, service port, service name, service version, service process number and other information of the target application service, the server stores the received service type, service IP, service port, service name, service version, service process number and other information of the target application service in a database for persistence, and changes the service status of the target application service to an online status.

[0038] Step S3, according to the service status corresponding to the target application service, update the application service list. The application service list includes the service status of each application service. Specifically, after the service status corresponding to the target application service is changed to the online status, the server updates the service status corresponding to the target application service in the application service list to the online status, thereby updating the application service list.

[0039] Step S4, receiving the message for obtaining the application service list sent by the target application service. Specifically, the server receives the message for obtaining the application service list sent by the target application service based on the full-duplex long connection between the server and the target application service. Step S105, sending the updated application service list to the target application service. Specifically, after obtaining the message for obtaining the application service list sent by the target application service, the server sends the updated application service list to the target application service. The distributed service management method provided in this embodiment receives a registration request sent by the target application service, and according to the registration request, changes the service status corresponding to the target application service to an online status, thereby ensuring the accuracy of the service status corresponding to the target application service. According to the service status corresponding to the target application service, the application service list is updated to ensure the accuracy of the service status of each application service on the updated application service list. Receive the message for obtaining the application service list sent by the target application service; send the updated application service list to the target application service. Thereby, the target application service can obtain the service status of each application service in a timely and accurate manner. The above method can timely discover the online status of the target application service by receiving the registration request sent by the target application service, so the timeliness of service discovery is good and does not generate a large network bottleneck overhead. Then, the service status corresponding to the target application service is changed to an online status, which ensures the accuracy of the service status corresponding to the target application service, and updates the application service list, and sends the updated application service list to the target application service, so that the target application service can timely and accurately establish a connection with the application service in the application service list that is online. In addition, the above method is applied to a server cluster rather than a single electronic device, which ensures the high availability of the distributed service management method and avoids the failure of the distributed service management method due to abnormalities in a single electronic device.

[0040] In a distributed system, sometimes it is necessary to transfer some files (for example, configuration files) between servers. Generally, the file contents in the configuration file of the master node are overwritten in the configuration files of other nodes. However, when a failure occurs in the master node or the slave node or the entire distributed service cluster (power outage, network failure), some slave nodes in the distributed service cluster may not receive the request, or the configuration file may fail to be written, resulting in inconsistent, unavailable or lost configuration files. As a result, the consistency and availability of configuration files between nodes in the distributed service cluster cannot be guaranteed. In this embodiment, a configuration file synchronization method, device, distributed server cluster and storage medium are provided to solve the problem that the consistency and availability of configuration files between nodes in the distributed service cluster cannot be guaranteed.

[0041] The method is applied to a slave node in a distributed server cluster, wherein the distributed server cluster includes a master node and at least one slave node, and includes: detecting whether the content of a first current configuration file in a first configuration file on the slave node is the same as the content of the first current backup file in a first backup file; the content of the first current backup file is the content stored in the first backup file after the slave node receives the content of a first updated configuration file sent by the master node; when the content of the first current configuration file is the same as the content of the first current backup file, calculating a first current summary corresponding to the content of the first current backup file, and comparing the first current summary with a first storage summary stored in a first storage space on the slave node; when the first current summary is inconsistent with the first storage summary, sending a configuration file content update request to the master node; receiving the content of a second updated configuration file sent by the master node; and updating the content of the first current configuration file based on the content of the second updated configuration file.

[0042] The above configuration file synchronization method detects whether the content of the first current configuration file in the first configuration file on the slave node is the same as the content of the first current backup file in the first backup file, thereby avoiding the situation that the content of the first updated configuration file sent by the master node is stored in the first backup file but not written into the first configuration file. When the content of the first current configuration file is the same as the content of the first current backup file, the first current summary corresponding to the content of the first current backup file is calculated, and the accuracy of the first current summary can be guaranteed. The first current summary is compared with the first storage summary stored in the first storage space on the slave node to verify whether the first storage summary stored in the first storage space is accurate. When the first current summary is inconsistent with the first storage summary, it is determined that the first storage summary stored in the first storage space is inaccurate. In the case of inaccurate first storage summary, the accuracy of the first current configuration file content in the first configuration file cannot be guaranteed. Therefore, the slave node sends a configuration file content update request to the master node, and receives the second updated configuration file content sent by the master node. Then, based on the second updated configuration file content, the first current configuration file content is updated, ensuring that the configuration file content in the slave node is consistent with that in the master node, avoiding the inconsistency, unavailability or loss of the configuration file content on the master node and the slave node, and ensuring the consistency and availability of the configuration files between the nodes in the distributed service cluster.

[0043] Among them, based on the second updated configuration file content, updating the first current configuration file content includes: writing the second updated configuration file content into the first backup file; calculating the update summary corresponding to the second updated configuration file content; obtaining the first current configuration file version number from the first storage space; adding 1 to the first current configuration file version number to generate an updated configuration file version number; storing the update summary and the updated configuration file version number in the first storage space; writing the second updated configuration file content in the first backup file into the first configuration file; and sending a message to the master node indicating that the configuration file content has been successfully updated.

[0044] The configuration file synchronization method provided by the embodiment of the present application writes the second updated configuration file content into the first backup file, realizes the backup of the second updated configuration file content, and avoids the occurrence of unexpected situations such as power failure before the second updated configuration file content is written into the first configuration file to replace the first current configuration file content, resulting in the failure of the configuration file content update. Then, the update summary corresponding to the second updated configuration file content is calculated, ensuring the accuracy of the calculated update summary and the correspondence between the update summary and the second updated configuration file content. The first current configuration file version number is obtained from the first storage space; the first current configuration file version number is added by 1 to generate the update configuration file version number, ensuring the accuracy of the generated update configuration file version number and the correspondence between the update configuration file version number and the second updated configuration file content. Then, the update summary and the update configuration file version number are stored in the first storage space, realizing the storage of the update summary and the update configuration file version number, and ensuring the correspondence between the update summary and the update configuration file version number and the second updated configuration file content. The second updated configuration file content in the first backup file is written into the first configuration file, completing the update of the first current configuration file content in the first configuration file, and realizing the consistency and availability of the configuration file content in the slave node and the configuration file content in the master node. Then, a message indicating that the configuration file content has been successfully updated is sent to the master node, ensuring that the master node can receive the message indicating that the configuration file content has been successfully updated from the slave node, making it easier to record and trace the configuration file content update status of each slave node.

[0045] Among them, in an optional implementation, after updating the first current configuration file content based on the second updated configuration file content, the method also includes: periodically obtaining from the master node a second current summary and a second current configuration file version number corresponding to the second current configuration file content in the second configuration file on the master node; comparing the updated summary and the second current summary, and comparing the second current configuration file version number with the updated configuration file version number; when the updated summary and the second current summary are different, and / or the second current configuration file version number is different from the updated configuration file version number, sending a configuration file content update request to the master node.

[0046] Among them, detecting whether the current configuration file content in the configuration file is the same as the current backup file content in the backup file includes: respectively calculating a first current summary corresponding to the first current configuration file content and a first backup summary corresponding to the first current backup file content; comparing the first current summary with the first backup summary; when the first current summary and the first backup summary are the same, determining that the first current configuration file content is the same as the first current backup file content; when the first current summary and the first backup summary are different, determining that the first current configuration file content is different from the first current backup file content.

[0047] The above method calculates the first current summary corresponding to the content of the first current configuration file and the first backup summary corresponding to the content of the first current backup file, respectively, to ensure the accuracy of the calculated first current summary and the first backup summary. Then, the first current summary is compared with the first backup summary, so there is no need to compare the content of the first current configuration file with the content of the first current backup file, which simplifies the comparison process. When the first current summary and the first backup summary are the same, it is determined that the content of the first current configuration file is the same as the content of the first current backup file; when the first current summary and the first backup summary are different, it is determined that the content of the first current configuration file is different from the content of the first current backup file, which ensures the accuracy of the result of whether the content of the first current configuration file is the same as that in the first current backup file.

[0048] The method further includes: when the content of the first current configuration file is different from the content of the first current backup file, writing the content of the first current backup file into the first configuration file. The configuration file synchronization method provided in the embodiment of the present application, when the content of the first current configuration file is different from the content of the first current backup file, writing the content of the first current backup file into the first configuration file, thereby ensuring that the content in the first configuration file is the same as the content in the first backup file.

[0049] Of course, in the specific implementation, you can also choose a distributed service management method and a configuration file synchronization method different from the above, which will not be described here one by one.

[0050] In the following implementation, a browser security processing method based on Xinchuang is provided. Figure 1 is a flowchart of a browser security processing method based on Xinchuang according to an embodiment of the present application, such as Figure 1 As shown, the steps involved in the method are explained.

[0051] Step S102, the browser receives a judgment rule from the server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code portion in a web page programming language, each code portion is provided with a label, and the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located;

[0052] Step S104, when the browser receives a network address, wherein the network address is the address of a web page that the browser needs to display, the browser obtains a code corresponding to the web page;

[0053] Step S106, the browser compares the code corresponding to the webpage with the code part in the judgment rule, and if the code corresponding to the webpage does not contain a code whose code part similarity exceeds a threshold, the browser displays the webpage corresponding to the code;

[0054] Step S108: If there is a code in the code corresponding to the webpage whose similarity with the code part exceeds a threshold, wherein the code whose similarity exceeds the threshold is a problem code, the browser prompts that the problem code exists in the webpage.

[0055] Through the above steps, the problem that when browsing a page with a browser, security can only be guaranteed by relying on the protection function of the operating system where the browser is located or the protection software is solved, so that security problem warnings can be issued through the browser itself.

[0056] As an optional implementation, after the browser prompts that the problem code exists in the web page, the method also includes: the browser asks the user to choose whether to display the problem code in the browser; if the user chooses to display the problem code, all the codes in the web page are displayed; if the user chooses not to display the problem code, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0057] Optionally, if the user chooses to display the problem code, the level corresponding to the code portion whose similarity with the problem code exceeds a threshold in the judgment rule is obtained, wherein the higher the level, the greater the degree of harm of the problem code. When the level corresponding to the problem code exceeds a predetermined level, the user's choice is ignored, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0058] As another implementation, the first-level domain name of the web page is obtained, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, the first-level domain name is added to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

[0059] A software interface is added to the operating system where the browser is located. When the protection software in the operating system (hereinafter referred to as protection software and protection function) detects a security threat, it is judged that the security threat is caused by the web page code browsed by the browser. If the judgment result is yes, the web page code causing the security threat is sent to the browser through the software interface.

[0060] After receiving the webpage code, the browser determines the type of programming language used by the webpage code; extracts a parameter part and a code part from the webpage code according to the type of programming language, wherein the code part is a part using preset instructions and / or operations in the programming language; the browser saves the code part in the browser. The browser also sends the code part to a server connected to the browser, and the server saves the code part after receiving the code part.

[0061] After the server receives more than a predetermined number of code parts from multiple browsers, the server classifies the multiple code parts of each programming language type, and the classification is determined based on the similarity of the codes. The similarity can be determined based on the logical sequence of predetermined instructions and / or operations used by the code parts. It can also be determined by machine learning (i.e., artificial intelligence).

[0062] Machine learning can be divided into supervised machine learning and unsupervised machine learning.

[0063] Supervised Learning

[0064] By training with existing training samples to obtain an optimal model, this model is then used to map all inputs to corresponding outputs, and a simple judgment is made on the output to achieve the purpose of prediction and classification, which also gives the ability to predict and classify unknown data. Just like practicing with standard answers and then taking an exam, the accuracy rate is higher than practicing without answers and then taking an exam. For example, when humans were young, they did not know whether cows and birds belonged to the same category, but as people grew up and various knowledge was continuously input, the models in people's brains became more and more accurate, and the judgment of animals became more and more accurate.

[0065] Supervised learning can be divided into regression and classification.

[0066] Regression: Given a bunch of independent variables X and dependent variables Y, fit a function, where the independent variables X are the feature vectors and the dependent variables Y are the labels. And the values ​​of the labels are continuous, such as LR.

[0067] Classification: Its data set consists of feature vectors X and their labels Y. After you use the data to train a model, you are given a piece of data with only feature vectors but no labels, and you are asked to find out which label it is. The output result is discrete. For example, logistics, SVM, KNN, etc.

[0068] Unsupervised Learning

[0069] In unsupervised learning, there are no training samples in advance, and the data needs to be modeled directly. For example, when visiting an art exhibition, you know nothing about art, but after appreciating many works, you can divide them into different factions. The main algorithm of unsupervised learning is clustering. The purpose of clustering is to group similar things together. It is mainly obtained by calculating the distance between samples and groups. The main algorithms include Kmeans, hierarchical clustering, and EM algorithm.

[0070] In this embodiment, an unsupervised learning algorithm is used to classify all codes of a programming language type to obtain one or more categories. The server summarizes each category to obtain rules related to all codes in the category, and the rules include the same instructions and / or operations, and the same logical order of these instructions and / or operations. The server sends all rules corresponding to all programming language types to the browser.

[0071] After receiving the rules sent by the server, the browser saves the rules from the server. Through the above operations, the browser saves the code part and the rules. When the browser browses a predetermined web page, the code in the predetermined web page is compared with the rules. If the rules match, the browser prompts that there is a security problem with the predetermined web page. If the rules do not exist in the browser, the browser sends a request message to the server, wherein the request message is used to request the server to send the rules. In the case of not receiving the rules, the browser compares the code in the predetermined web page with the code part saved by the browser. If the similarity exceeds a threshold, it prompts that there is a security problem with the web page.

[0072] In another embodiment, when the browser fails to obtain the rule from the server, the browser may also obtain an IP address pre-configured in the browser, which is an address trusted by the browser, and the browser broadcasts a request message to all IP addresses, wherein the request message is used to request the rule from the browser at the IP address, and after receiving the rule, the rule is saved. It should be noted that the time period for broadcasting the request message is pre-configured, and the pre-configured time period is the time period when the browser load is lower than a predetermined value. The number of times the request message is broadcasted within the predetermined time period is subject to an upper limit, which is also pre-configured. This embodiment can avoid adding additional network load due to excessive number of request messages being sent.

[0073] In this embodiment, an electronic device is provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the method in the above embodiment.

[0074] The above program can be run in the processor, or it can also be stored in the memory (or computer-readable medium), which includes permanent and non-permanent, removable and non-removable media. Information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0075] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0076] Such a device or system is provided in this embodiment. The system is called a browser security processing system based on Xinchuang, and the system includes a browser and a server, and the browser includes the following modules: a receiving model, which is used to receive a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code part in a web page programming language, and each code part is provided with a label, which is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; an acquisition module, which is used to obtain the code corresponding to the web page when receiving a network address, wherein the network address is the address of the web page to be displayed by the browser; a processing module, which is used to compare the code corresponding to the web page with the code part in the judgment rule, if the code corresponding to the web page does not exist in the code corresponding to the web page, the web page corresponding to the code is displayed; if there is a code in the code corresponding to the web page, the code with a similarity exceeding a threshold value with the code part, wherein the code with a similarity exceeding the threshold value is a problem code, then it is prompted that the problem code exists in the web page.

[0077] The system or device is used to implement the functions of the method in the above-mentioned embodiment. Each module in the system or device corresponds to each step in the method, which has been explained in the method and will not be repeated here.

[0078] Optionally, the processing module is also used to ask the user to choose whether to display the problem code in the browser. If the user chooses to display the problem code, all the codes in the web page will be displayed; if the user chooses not to display the problem code, the problem code in the web page will be shielded and other codes after shielding will be displayed.

[0079] Optionally, the processing module is also used for: if the user chooses to display the problem code, then obtaining the level corresponding to the code portion whose similarity with the problem code exceeds a threshold in the judgment rule, wherein the higher the level, the greater the degree of harm of the problem code; when the level corresponding to the problem code exceeds a predetermined level, ignoring the user's choice, the problem code in the web page is shielded, and other codes after shielding are displayed.

[0080] Optionally, the processing module is also used to: obtain the first-level domain name of the web page, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, add the first-level domain name to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

[0081] The above implementation solves the problem that when browsing a page with a browser, security can only be guaranteed by the protection function of the operating system or the protection software where the browser is located, so that a warning of security problems can be issued by the browser itself.

[0082] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A browser security processing method based on Xinchuang, characterized in that: include: The browser receives a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code portion in a web page programming language, each code portion is provided with a label, and the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; When the browser receives a network address, wherein the network address is the address of the web page that the browser needs to display, the browser obtains a code corresponding to the web page; The browser compares the code corresponding to the webpage with the code part in the judgment rule, and if the code corresponding to the webpage does not contain the code whose similarity to the code part exceeds the threshold, the browser displays the webpage corresponding to the code; If there is a code in the code corresponding to the webpage whose similarity with the code part exceeds a threshold, wherein the code whose similarity exceeds the threshold is a problem code, the browser prompts that the problem code exists in the webpage.

2. The method according to claim 1, characterized in that After the browser prompts that the problem code exists in the webpage, the method further includes: The browser asks the user to choose whether to display the problem code in the browser. If the user chooses to display the problem code, all the codes in the web page will be displayed; if the user chooses not to display the problem code, the problem code in the web page will be shielded and other codes after shielding will be displayed.

3. The method according to claim 2, characterized in that The method further comprises: If the user chooses to display the problem code, the level corresponding to the code part whose similarity with the problem code exceeds a threshold in the judgment rule is obtained, wherein the higher the level, the greater the degree of harm of the problem code. When the level corresponding to the problem code exceeds a predetermined level, the user's choice is ignored, the problem code in the web page is shielded, and other codes after shielding are displayed.

4. The method according to claim 3, characterized in that The method further comprises: The first-level domain name of the web page is obtained, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, the first-level domain name is added to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

5. A browser security processing system based on Xinchuang, the system includes a browser and a server, characterized in that: The browser includes the following modules: A receiving model, used for receiving a judgment rule from a server, wherein the judgment rule is generated by the server, and the judgment rule includes at least one code part in a web page programming language, each code part is provided with a label, and the label is used to indicate the security of the code, and the security is used to indicate whether the code has a destructive effect or illegal operation on the browser or the operating system where the browser is located; An acquisition module, configured to, upon receiving a network address, wherein the network address is the address of a web page to be displayed by the browser, acquire a code corresponding to the web page; A processing module is used to compare the code corresponding to the web page with the code part in the judgment rule. If the code corresponding to the web page does not contain a code whose similarity to the code part exceeds a threshold, the web page corresponding to the code is displayed; if the code corresponding to the web page contains a code whose similarity to the code part exceeds a threshold, and the code whose similarity exceeds the threshold is a problem code, it is prompted that the problem code exists in the web page.

6. The system according to claim 5, characterized in that The processing module is also used to ask the user to choose whether to display the problem code in the browser. If the user chooses to display the problem code, all the codes in the web page will be displayed; if the user chooses not to display the problem code, the problem code in the web page will be shielded and other codes after shielding will be displayed.

7. The system according to claim 6, characterized in that The processing module is also used for: If the user chooses to display the problem code, the level corresponding to the code part whose similarity with the problem code exceeds a threshold in the judgment rule is obtained, wherein the higher the level, the greater the degree of harm of the problem code. When the level corresponding to the problem code exceeds a predetermined level, the user's choice is ignored, the problem code in the web page is shielded, and other codes after shielding are displayed.

8. The system according to claim 7, characterized in that The processing module is also used for: The first-level domain name of the web page is obtained, and when the number of problem codes exceeding a predetermined level in the web page corresponding to the first-level domain name exceeds a pre-configured number, the first-level domain name is added to a blacklist, wherein access to the first-level domain names in the blacklist is restricted.

9. An electronic device comprising a memory and a processor; wherein: The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described in any one of claims 1 to 4.

10. A computer program having computer instructions stored thereon, wherein: When the computer instructions are executed by a processor, the method steps described in any one of claims 1 to 4 are implemented.

Images