Webpage monitoring method, webpage monitoring device, electronic equipment and readable storage medium

Abstract

The invention discloses a webpage monitoring method, a webpage monitoring device, electronic equipment and a readable storage medium, and the method comprises the steps that a target interaction function included in a target webpage is acquired, and the target interaction function comprises at least one of a keyboard interaction function and a mouse interaction function; recording first page data of the target webpage loaded at the current moment; recording second page data of the target webpage under the condition of performing simulation interaction operation on the target webpage according to the target interaction function; and comparing the first page data with the second page data to obtain a tampering judgment result of the target webpage.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a web page monitoring method, a web page monitoring device, an electronic device, and a readable storage medium. Background Art

[0002] Web page tampering is a type of network attack in which attackers spread malicious information by tampering with website content. Website tampering usually exploits vulnerabilities in website applications to obtain permissions, illegally tamper with content in web applications, and insert dark links. This type of attack has the characteristics of fast propagation speed, easy replication, difficulty in eliminating the impact afterwards, and difficulty in real-time prevention. At present, web page anti-tampering technologies mainly include: file-based anti-tampering, content-based anti-tampering, and blockchain-based file anti-tampering. However, the above technologies all have certain limitations and cannot perceive subtle changes in the page, which makes it impossible to accurately determine whether the web page has been tampered with. Summary of the invention

[0003] The embodiments of the present application provide a web page monitoring method, a web page monitoring device, an electronic device, and a readable storage medium, which can accurately determine whether a web page has been tampered with.

[0004] In a first aspect, an embodiment of the present application provides a web page monitoring method, the method comprising: obtaining a target interaction function included in a target web page, wherein the target interaction function comprises at least one of the following: a keyboard interaction function, a mouse interaction function; recording first page data of the target web page after being loaded at a current moment; while simulating an interactive operation on the target web page according to the target interaction function, recording second page data of the target web page; and obtaining a tampering judgment result of the target web page by comparing the first page data and the second page data.

[0005] In a second aspect, an embodiment of the present application provides a web page monitoring device, which includes: an acquisition module, used to acquire a target interaction function included in a target web page, wherein the target interaction function includes at least one of the following: a keyboard interaction function, a mouse interaction function; a first recording module, used to record first page data of the target web page after it is loaded at the current moment; a second recording module, used to record second page data of the target web page when simulating an interactive operation on the target web page according to the target interaction function; an analysis module, used to obtain a tampering judgment result of the target web page by comparing the first page data and the second page data.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0008] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the steps of the method described in the first aspect.

[0009] In a sixth aspect, an embodiment of the present application provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer implements the steps of the method described in the first aspect.

[0010] In an embodiment of the present application, a target interaction function included in a target web page is obtained, wherein the target interaction function includes at least one of the following: a keyboard interaction function, a mouse interaction function, and then the first page data of the target web page after being loaded at the current moment is recorded, and then the second page data of the target web page is recorded while simulating an interactive operation on the target web page according to the target interaction function, and finally the tampering judgment result of the target web page is obtained by comparing the first page data with the second page data. In this way, by simulating keyboard and mouse operations, a dynamic page is triggered, and it is dynamically judged whether the web page has been tampered with. At the same time, it can also prevent the attacker from intentionally displaying a static page, which leads to the problem of being unable to normally judge whether the web page has been tampered with, thereby achieving accurate perception of subtle changes in dynamic and static web pages, thereby improving the accuracy of judging whether a web page has been tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram showing a flow chart of a webpage monitoring method provided by an embodiment of the present application;

[0012] Figure 2 Another flow chart of a webpage monitoring method provided by an embodiment of the present application is shown;

[0013] Figure 3 A schematic diagram showing the structure of a webpage monitoring device provided in an embodiment of the present application is shown;

[0014] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0016] In conjunction with the accompanying drawings, a web page monitoring method, a web page monitoring device, an electronic device, and a readable storage medium provided in an embodiment of the present application are described in detail through specific embodiments and their application scenarios.

[0017] Figure 1 A webpage monitoring method provided by an embodiment of the present application is shown, and the method can be executed by an electronic device, and the electronic device can include: a server and / or a terminal device. In other words, the method can be executed by software or hardware installed in the electronic device, and the method includes the following steps:

[0018] S110: Acquire a target interactive function included in the target webpage.

[0019] Wherein, the target interaction function includes at least one of the following: a keyboard interaction function and a mouse interaction function.

[0020] S120: Recording the first page data of the target webpage after it is loaded at the current moment.

[0021] S130: When simulating an interactive operation on the target webpage according to the target interactive function, recording second page data of the target webpage.

[0022] S140: Obtaining a tampering determination result of the target web page by comparing the first page data with the second page data.

[0023] It is understandable that an attacker may inject a js file into the target web page, and the js file may contain a keyboard interaction function and / or a mouse interaction function. In this case, when the user enters the page, after accidentally dragging the mouse or clicking the keyboard, illegal information will pop up on the page. Therefore, it is necessary to identify the target interaction function from the js file of the target web page, and simulate the interaction operation on the target interaction function in the entire page of the target web page to determine whether the web page has changed due to the keyboard and mouse operation. In addition, in order to determine whether the web page has been tampered with, it is necessary to record the first page data of the target web page after loading at the current moment before simulating the interaction operation, and record the second page data of the target web page after simulating the interaction operation, and then determine whether the target web page has been tampered with by comparing the first page data and the second page data.

[0024] Among them, the keyboard interaction function refers to the function or method used to process keyboard input. In front-end development, developers can write JavaScript functions to capture user operations on the keyboard and execute corresponding functions or logic based on these operations. The keyboard interaction function may include functions for processing keydown events, functions for processing keyup events, functions for processing keypress events, etc. Among them, the function for processing keydown events is triggered when the user presses any key on the keyboard, and is triggered immediately at the moment the key is pressed; the function for processing keyup events is triggered when the user releases the key on the keyboard, corresponding to the function for processing keydown events, and the function for processing keyup events is triggered at the moment the key is released. It is triggered when the user presses a key on the keyboard and the key produces a character (letter, number, etc.). Unlike the function for processing keydown events, the function for processing keypress events is only triggered when a key that can produce a character is pressed.

[0025] The mouse interaction function refers to a function or method used to process mouse operations. The mouse interaction function can capture mouse movements, clicks, double-clicks, scrolls and other operations, and then respond or process accordingly according to the user's operations. At the same time, user interaction functions such as button clicks, drag operations, and mouse hover effects can be implemented through the mouse interaction function. The mouse interaction function may include: a click function triggered when the mouse clicks an element, a dblclick function triggered when the mouse double-clicks an element, a mousedown function triggered when the mouse presses an element, a mouseup function triggered when the mouse releases an element, and a mousemove function triggered when the mouse moves over an element. Exemplarily, the mousemove function corresponds to the mouse sliding trajectory, including a circular trajectory and a straight trajectory. Among them, operating the mouse to complete a circular trajectory may include the following:

[0026] (1) Set the center coordinates and radius of the circle, for example, center_x=500, center_y=500, radius=100.

[0027] (2) Set the number of sliding times, which determines the approximation degree of the circle, for example, num_points=30.

[0028] (3) Calculate the coordinates of each point, for example, for i in range(num_points).

[0029] (4) Calculate the angle, for example, angle = 2*math.pi*i / num_points.

[0030] (5) Calculate the coordinates of the point on the circle based on the angle, for example, x = center_x + radius*

[0031] math.cos(angle), y=center_y+radius*math.sin(angle).

[0032] (6) Move the mouse to a new position, for example, pyautogui.moveTo(x,y,duration=0.01).

[0033] Operating the mouse to complete a straight line trajectory may include the following:

[0034] (1) Set the coordinates of the starting point and end point of the line. For example, the starting point is the upper left corner of the screen: start_pos = (0,0), and the end point is the lower right corner of the screen: end_pos = (pyautogui.size().width-1, pyautogui.size().height-1), pyautogui.moveTo(x, y, duration = 0.01)

[0035] (2) Calculate the next position based on the oblique line pixel points and operate the mouse to complete the straight line operation.

[0036] In an embodiment of the present application, a target interaction function included in a target web page is obtained, wherein the target interaction function includes at least one of the following: a keyboard interaction function, a mouse interaction function, and then the first page data of the target web page after being loaded at the current moment is recorded, and then the second page data of the target web page is recorded while simulating an interactive operation on the target web page according to the target interaction function, and finally the tampering judgment result of the target web page is obtained by comparing the first page data with the second page data. In this way, by simulating keyboard and mouse operations, a dynamic page is triggered, and it is dynamically judged whether the web page has been tampered with. At the same time, it can also prevent the attacker from intentionally displaying a static page, which leads to the problem of being unable to normally judge whether the web page has been tampered with, thereby achieving accurate perception of subtle changes in dynamic and static web pages, thereby improving the accuracy of judging whether a web page has been tampered with.

[0037] In one implementation, before recording the first page data of the target web page after loading at the current moment, the method further includes: splitting the HTML file of the target web page to obtain the first content and the second content corresponding to each tag, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

[0038] Among them, the splitting can be regular splitting. The regular expression for obtaining the first content is: >([^>]+?)< / ; the regular expression for obtaining the second content is: <([^>]+?)>. Exemplarily, <pid="paragraph1">Hello World , where "Hello World" is the first content and "<pid="paragraph1">" is the second content. That is to say, the first content is the element content of the tag, and the second content is the attribute information of the tag, and the attribute information may include tag type, id, style, etc.

[0039] Optionally, after obtaining the first content and the second content corresponding to each tag, the method may further include: for each of the tags, classifying the first content according to the second content. It can be understood that the text is usually represented by text tags, such as 、 、 etc.; pictures are usually The tag is presented, and its src attribute points to the URL of the image; videos are usually presented with <video>Tags, or <iframe>References a video player. The URL or source of the video is specified in the src attribute; audio is usually specified using<audio> The second content includes the attribute information of the tag, so the category of the first content in a certain tag can be determined based on the attribute information. Then, when comparing the differences later, different methods can be used for comparison according to different categories of content.

[0040] In this implementation, by splitting each tag, it is possible to avoid missing small, short-term or cleverly hidden tampering when making subsequent judgments based on page data.

[0041] In one implementation, recording the first page data of the target web page after it is loaded at the current moment includes: generating a first snapshot of the target web page at the current moment; and obtaining the first page data by adding a mark to each of the first contents in the first snapshot, wherein the mark is composed of the second content corresponding to the first content.

[0042] It can be understood that a snapshot is taken of the target webpage, and each first content in the snapshot is marked, and the mark can be composed of the corresponding second content, such as a tag ID. Further, if the tag ID does not exist in the corresponding second content, a mark is determined for the first content according to the tag sequence, and then the mark of the first content is added to each first content in the snapshot.

[0043] Optionally, obtaining the first page data by adding a mark to each of the first contents in the first snapshot may include: obtaining a first marked snapshot by adding a mark to each of the first contents in the first snapshot, calculating a hash value for each first content, each second content, and the mark information of each first content, and storing the calculated hash value in the blockchain. Due to the integrity and persistence of the blockchain, changes in web page content can be checked and verified at any time. At the same time, blockchain technology stores all information through a distributed network, which means that even if some nodes are attacked, other nodes still retain a complete copy of the data, thereby ensuring the persistence and stability of web page content.

[0044] Optionally, the first content, the tag information of the first content, the second content, and the corresponding hash value can also be stored in a relational database to facilitate matching, so that regular inspections can be carried out.

[0045] In the above implementation, full range perception is achieved, and in subsequent comparison, the corresponding tag and its web page position can be quickly located according to the snapshot mark.

[0046] In one implementation, recording the second page data of the target webpage includes: generating a second snapshot of the target webpage; and obtaining the second page data by adding a mark to each of the first contents in the second snapshot, wherein the mark is composed of the second content corresponding to the first content. The implementation process of this implementation is the same as the above implementation, and will not be repeated here.

[0047] In one implementation, the step of obtaining the tampering judgment result of the target web page by comparing the first page data and the second page data includes: when the first page data and the second page data are inconsistent, obtaining difference data, wherein the difference data includes at least one difference tag; and determining the tampering judgment result of the target web page according to the at least one difference tag. That is, if the first page data and the second page data are inconsistent, indicating that the page has changed, then obtaining difference data, the difference data includes at least one difference tag, and it is necessary to determine whether the page has been tampered with according to the at least one difference tag. Optionally, during the comparison process, the hash value corresponding to the first page data and the hash value corresponding to the second page data can be compared. If the hash values ​​are inconsistent, it can be determined that the relevant content is at risk of being tampered with.

[0048] In one implementation, determining the tampering judgment result of the target web page based on the difference data includes: when there is a first tag in the at least one difference tag that does not belong to a preset whitelist, determining that the page content corresponding to the first tag in the target web page has a tampering risk; or, when there is a second tag in the at least one difference tag that cannot be correctly restored, determining that the page content corresponding to the second tag in the target web page has a tampering risk.

[0049] It is understandable that in order to prevent risk alerts from appearing when the page is updated normally, a whitelist can be preset so that no alert is issued when the content in the preset whitelist changes. Optionally, the preset whitelist can include time and date tags, regularly pushed news tags, pageview tags, etc. Failure to correctly restore means that some tags have automatic recovery settings. If they cannot be automatically restored, it is possible that the page content corresponding to the tag has been tampered with.

[0050] In this implementation, by monitoring the content of difference tags, a refined analysis of web page tampering is achieved, tags of normal web page updates can be whitelisted, and important tags are monitored and automatically responded to, which can reduce false positives and missed reports.

[0051] Optionally, another process schematic diagram of a web page monitoring method is further provided in an embodiment of the present application. As shown in Figure 2, the following steps may be included:

[0052] S210: Regularly split the html file of the target web page to obtain the first content outside the tag and the second content inside the tag.

[0053] Among them, the first content is an element visible to the user, and the second content includes a tag ID and attribute information. The second content has a corresponding relationship with the first content.

[0054] S220: Classify and save the corresponding first content according to the information in the second content.

[0055] That is, classify the first content into pictures, videos, audios, and texts, and save the classified first content.

[0056] S230: Take a snapshot of the target web page and mark it.

[0057] For each second content in the web page snapshot, use the tag ID in the corresponding second content as the mark of the first content. If there is no tag ID in the corresponding second content, determine a mark for the first content in sequence, and finally add the mark of the first content to each first content in the web page snapshot.

[0058] S240: Calculate the hash value for each first content and each second content respectively, and store the calculated hash value in the blockchain.

[0059] In addition, the first content, the marking information of the first content, the second content, and the corresponding hash value can also be stored in a relational database for convenient matching.

[0060] S250: Conduct regular inspections.

[0061] For the monitored website address, compare the hash value of each content calculated in real time with the hash value of each content stored in the blockchain. If the hash values are inconsistent, it is determined that the relevant content has been tampered with.

[0062] S260: Dispose of the tampered content abnormally.

[0063] The time and date tags, page view tags, etc. can be set as the whitelist. When the content in the whitelist changes, no alarm is generated. Also, important tags can be configured for automatic recovery. When it is detected that the content of these tags has been tampered with, the original content of these tags is directly read from the relational database, and the web page is restored using the read original content. In addition, the marks in the web page snapshot can be used to help the supervisor quickly locate the specific tampering position.

[0064] In this implementation method, through monitoring the content of each HTML tag, refined analysis of web page tampering is achieved. Tags that are normally updated daily can be handled as the whitelist, and important tags are monitored and automatically restored. This can effectively reduce false alarms and missed reports. At the same time, attacks such as web page malware injection can also be judged based on changes in HTML tags. After a certain content is tampered with, the web page position corresponding to the tag can be quickly located according to the web page snapshot mark.

[0065] Figure 3 shows a schematic structural diagram of a web page monitoring device provided by an embodiment of the present application. As shown in Figure 3, the web page monitoring device 300 may include: an acquisition module 310, a first recording module 320, a second recording module 330, and an analysis module 340.

[0066] In this embodiment, the acquisition module 310 is configured to acquire target interaction functions included in a target web page, where the target interaction functions include at least one of the following: keyboard interaction functions, mouse interaction functions; the first recording module 320 is configured to record first page data after the target web page is loaded at the current moment; the second recording module 330 is configured to record second page data of the target web page when a simulated interaction operation is performed on the target web page according to the target interaction functions; the analysis module 340 is configured to obtain a tampering judgment result of the target web page by comparing the first page data and the second page data.

[0067] In one implementation, the web page monitoring device 300 may include: a splitting module, used to obtain the first content and the second content corresponding to each tag by splitting the HTML file of the target web page, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

[0068] In one implementation, the first recording module 320 is specifically used to generate a first snapshot of the target web page at the current moment; and obtain the first page data by adding a mark to each of the first contents in the first snapshot, wherein the mark is composed of the second content corresponding to the first content.

[0069] In one implementation, the second recording module 330 is specifically used to generate a second snapshot of the target web page; and obtain second page data by adding a mark to each of the first contents in the second snapshot, wherein the mark is composed of the second content corresponding to the first content.

[0070] In one implementation, the analysis module 340 is specifically used to obtain difference data when the first page data and the second page data are inconsistent, wherein the difference data includes at least one difference tag; and determine the tampering judgment result of the target web page based on the at least one difference tag.

[0071] In one implementation, the analysis module 340 is specifically used to determine that, when there is a first tag in the at least one difference tag that does not belong to a preset whitelist, the page content corresponding to the first tag in the target web page is at risk of tampering; or, when there is a second tag in the at least one difference tag that cannot be correctly restored, determine that there is a tampering risk in the page content corresponding to the second tag in the target web page.

[0072] A web page monitoring device provided in an embodiment of the present application can implement each process implemented in the embodiment of the web page monitoring method. To avoid repetition, it will not be described here.

[0073] The webpage monitoring device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in an electronic device. The embodiment of the present application is not specifically limited.

[0074] The webpage monitoring device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0075] Optionally, as shown in Figure 4, an embodiment of the present application further provides an electronic device 400, including a processor 410, a memory 420, a program or instruction stored on the memory 420 and executable on the processor 410. When the program or instruction is executed by the processor 410, it implements each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0076] An embodiment of the present application further provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0077] Among them, the processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc, etc.

[0078] Another embodiment of the present application provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run a program or instruction to implement each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0079] An embodiment of the present application further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer is caused to implement each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0080] It should be understood that the chip mentioned in the embodiment of the present application may also be referred to as a system-on-chip, a system chip, a chip system, or a system-on-chip, etc.It should be noted that, in this article , term " comprises ", " comprises " or its any other variant is intended to contain non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only comprise those elements, but also comprise other elements not clearly listed, or also comprise the element inherent to such process, method, article or device.In the case of no more restrictions, the element limited by the sentence " comprises one ...", does not exclude that in the process, method, article or device comprising this element, there are also other identical elements.In addition, it should be noted that the scope of the method and device in the embodiment of the present application is not limited to perform functions in the order shown or discussed, and may also include performing functions in substantially the same manner or in reverse order according to the function involved, for example, may perform the described method in a different order from that described, and may also add, omit or combine various steps.In addition, the features described with reference to some examples may be combined in other examples. By the description of the above embodiment, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by the mode of software adding necessary general hardware platform, certainly can also be by hardware, but the former is a better embodiment in many cases.Based on such understanding, the technical scheme of the present application is essentially or the part that contributes to the prior art can be embodied in the form of software product, and the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, CD), including some instructions to make a terminal (can be mobile phone, computer, server, air conditioner, or network equipment etc.) perform the method described in each embodiment of the present application.

[0083] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present application, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present application and the claims, all of which are within the protection of the present application.< / iframe> < / video>

Claims

1. A webpage monitoring method, characterized in that: The method comprises: Acquire a target interaction function included in the target webpage, wherein the target interaction function includes at least one of the following: a keyboard interaction function and a mouse interaction function; Recording the first page data of the target web page after it is loaded at the current moment; When simulating an interactive operation on the target webpage according to the target interactive function, recording second page data of the target webpage; By comparing the first page data and the second page data, a tampering determination result of the target web page is obtained.

2. The method according to claim 1, characterized in that Before recording the first page data of the target webpage after loading at the current moment, the method further includes: By splitting the HTML file of the target webpage, the first content and the second content corresponding to each tag are obtained, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

3. The method according to claim 2, characterized in that The recording of the first page data of the target webpage after loading at the current moment includes: Generate a first snapshot of the target webpage at the current moment; The first page data is obtained by adding a mark to each of the first contents in the first snapshot, wherein the mark is composed of the second content corresponding to the first content.

4. The method according to claim 2, characterized in that: The recording of the second page data of the target webpage includes: generating a second snapshot of the target webpage; The second page data is obtained by adding a mark to each of the first contents in the second snapshot, wherein the mark is composed of the second contents corresponding to the first contents.

5. The method according to claim 1, characterized in that The step of obtaining a tampering determination result of the target webpage by comparing the first page data with the second page data includes: When the first page data and the second page data are inconsistent, obtaining difference data, wherein the difference data includes at least one difference tag; A tampering determination result of the target webpage is determined according to the at least one difference tag.

6. The method according to claim 5, characterized in that Determining the tampering judgment result of the target webpage according to the difference data includes: In the case that a first tag in the at least one difference tag does not belong to the preset whitelist, determining that the page content corresponding to the first tag in the target webpage has a tampering risk; or In the case that a second tag in the at least one difference tag cannot be correctly restored, it is determined that the page content corresponding to the second tag in the target webpage has a risk of tampering.

7. A webpage monitoring device, characterized in that: The device comprises: An acquisition module, used for acquiring a target interaction function included in a target webpage, wherein the target interaction function includes at least one of the following: a keyboard interaction function and a mouse interaction function; A first recording module, used to record the first page data of the target web page after it is loaded at the current moment; A second recording module, configured to record second page data of the target webpage when a simulated interactive operation is performed on the target webpage according to the target interactive function; The analysis module is used to obtain a tampering judgment result of the target web page by comparing the first page data with the second page data.

8. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the webpage monitoring method as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the web page monitoring method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer implements the steps of the web page monitoring method according to any one of claims 1 to 6.

Images