Webpage monitoring methods, webpage monitoring devices, electronic devices and readable storage media

Abstract

This application discloses a webpage monitoring method, webpage monitoring device, electronic device, and readable storage medium. The method includes: acquiring target interaction functions included in a target webpage, wherein the target interaction functions include at least one of the following: keyboard interaction functions and mouse interaction functions; recording first page data of the target webpage after it is loaded at the current time; recording second page data of the target webpage when a simulated interaction operation is performed on the target webpage according to the target interaction functions; and obtaining a tampering judgment result of the target webpage by comparing the first page data and the second page data.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a webpage monitoring method, webpage monitoring device, electronic device, and readable storage medium. Background Technology

[0002] Website tampering is a type of cyberattack where attackers spread malicious information by modifying website content. Website tampering typically exploits vulnerabilities in web applications to gain unauthorized access, illegally alter content, and implant hidden links. This type of attack is characterized by its rapid spread, ease of replication, difficulty in mitigating its impact afterward, and challenges in real-time prevention. Currently, website anti-tampering technologies mainly include file-based anti-tampering, content-based anti-tampering, and blockchain-based file anti-tampering. However, all of these technologies have limitations; they cannot detect subtle changes to the page, making it difficult to accurately determine whether a webpage has been tampered with. Summary of the Invention

[0003] This application provides a webpage monitoring method, webpage monitoring device, electronic device, and readable storage medium, which can accurately determine whether a webpage has been tampered with.

[0004] In a first aspect, embodiments of this application provide a webpage monitoring method, the method comprising: acquiring target interaction functions included in a target webpage, wherein the target interaction functions include at least one of the following: keyboard interaction functions and mouse interaction functions; recording first page data of the target webpage after it is loaded at the current time; recording second page data of the target webpage when a simulated interaction operation is performed on the target webpage according to the target interaction functions; and obtaining a tampering judgment result of the target webpage by comparing the first page data and the second page data.

[0005] Secondly, embodiments of this application provide a webpage monitoring device, which includes: an acquisition module for acquiring target interaction functions included in a target webpage, wherein the target interaction functions include at least one of the following: keyboard interaction functions and mouse interaction functions; a first recording module for recording first page data of the target webpage after it is loaded at the current time; a second recording module for recording second page data of the target webpage when a simulated interaction operation is performed on the target webpage according to the target interaction functions; and an analysis module for obtaining a tampering judgment result of the target webpage by comparing the first page data and the second page data.

[0006] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0008] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the steps of the method described in the first aspect.

[0009] In a sixth aspect, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the steps of the method described in the first aspect.

[0010] In this embodiment, the target webpage includes target interaction functions, which include at least one of the following: keyboard interaction functions and mouse interaction functions. Then, the first page data of the target webpage after loading at the current time is recorded. Next, based on the target interaction functions, a simulated interactive operation is performed on the target webpage, and the second page data of the target webpage is recorded. Finally, by comparing the first page data and the second page data, the tampering judgment result of the target webpage is obtained. In this way, by simulating keyboard and mouse operations to trigger dynamic pages, the tampering of the webpage is dynamically determined. This also prevents attackers from intentionally displaying static pages, thus preventing the inability to properly determine whether tampering has occurred. It achieves accurate perception of subtle changes in dynamic and static webpages, thereby improving the accuracy of determining whether a webpage has been tampered with. Attached Figure Description

[0011] Figure 1 This illustration shows a flowchart of a webpage monitoring method provided in an embodiment of this application.

[0012] Figure 2 This illustration shows another flowchart of a webpage monitoring method provided in an embodiment of this application;

[0013] Figure 3 This diagram illustrates the structure of a webpage monitoring device according to an embodiment of this application.

[0014] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0015] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] The following description, in conjunction with the accompanying drawings, details a webpage monitoring method, webpage monitoring device, electronic device, and readable storage medium provided in this application through specific embodiments and application scenarios.

[0017] Figure 1 This application illustrates a webpage monitoring method according to an embodiment. The method can be executed by an electronic device, which may include a server and / or a terminal device. In other words, the method can be executed by software or hardware installed on the electronic device, and includes the following steps:

[0018] S110: Obtain the target interactive functions included in the target webpage.

[0019] The target interaction function includes at least one of the following: keyboard interaction function and mouse interaction function.

[0020] S120: Record the first page data of the target webpage after it is loaded at the current time.

[0021] S130: When performing simulated interactive operations on the target webpage according to the target interaction function, record the second page data of the target webpage.

[0022] S140: By comparing the data of the first page and the data of the second page, the tampering judgment result of the target webpage is obtained.

[0023] Understandably, attackers might inject JavaScript files into the target webpage. These files could contain keyboard and / or mouse interaction functions. In this case, when a user enters the page, inadvertently dragging the mouse or clicking the keyboard will cause an illegal message to pop up on the page. Therefore, it is necessary to identify the target interaction functions from the target webpage's JavaScript file and simulate interaction with these functions across the entire page to determine if the webpage changes due to keyboard and mouse actions. Furthermore, to determine if the webpage has been tampered with, it is necessary to record the first page data of the target webpage after loading at the current moment before simulating the interaction, and the second page data after simulating the interaction. Then, by comparing the first and second page data, it is possible to determine whether the target webpage has been tampered with.

[0024] Keyboard interaction functions refer to functions or methods used to handle keyboard input. In front-end development, developers can write JavaScript functions to capture user keyboard input and execute corresponding functions or logic based on these operations. These keyboard interaction functions can include functions that handle the `keydown` event, `keyup` event, and `keypress` event. The function that handles the `keydown` event is triggered when the user presses any key on the keyboard, immediately upon the key being pressed. The function that handles the `keyup` event is triggered when the user releases a key, corresponding to the function that handles the `keydown` event, which is triggered the instant the key is released. The function that handles the `keypress` event is triggered when the user presses a key on the keyboard and that key produces a character (letter, number, etc.). Unlike the function that handles the `keydown` event, the function that handles the `keypress` event is triggered only when a key that produces a character is pressed.

[0025] Mouse interaction functions refer to functions or methods used to handle mouse operations. These functions can capture mouse movements such as moving, clicking, double-clicking, and scrolling, and then respond or process accordingly based on the user's actions. They can also implement user interaction functions such as button clicks, drag-and-drop operations, and mouse hover effects. These functions may include: a `click` function triggered when the mouse clicks an element, a `dblclick` function triggered when the mouse double-clicks an element, a `mousedown` function triggered when the mouse presses down on an element, a `mouseup` function triggered when the mouse releases an element, and a `mousemove` function triggered when the mouse moves over an element. For example, the `mousemove` function corresponds to mouse movement paths, including circular and linear paths. For instance, manipulating the mouse to complete a circular path can include the following:

[0026] (1) Set the center coordinates and radius of the circle, for example, center_x = 500, center_y = 500, radius = 100.

[0027] (2) Set the number of slides, which determines the approximation of the circle. For example, num_points = 30.

[0028] (3) Calculate the coordinates of each point, for example, for iin range(num_points).

[0029] (4) Calculate the angle, for example, angle = 2*math.pi*i / num_points.

[0030] (5) Calculate the coordinates of a point on the circle based on the angle, for example, x = center_x + radius*

[0031] math.cos(angle), y=center_y+radius*math.sin(angle).

[0032] (6) Move the mouse to a new position, for example, pyautogui.moveTo(x,y,duration=0.01).

[0033] Using the mouse to complete a straight line trajectory can include the following:

[0034] (1) Set the coordinates of the start and end points of the line. For example, the start point is the top left corner of the screen: start_pos = (0,0), and the end point is the bottom right corner of the screen: end_pos = (pyautogui.size().width-1,pyautogui.size().height-1), pyautogui.moveTo(x,y,duration=0.01)

[0035] (2) Calculate the next position based on the diagonal pixel points, and use the mouse to complete the straight line operation.

[0036] In this embodiment, the target webpage includes target interaction functions, which include at least one of the following: keyboard interaction functions and mouse interaction functions. Then, the first page data of the target webpage after loading at the current time is recorded. Next, based on the target interaction functions, a simulated interactive operation is performed on the target webpage, and the second page data of the target webpage is recorded. Finally, by comparing the first page data and the second page data, the tampering judgment result of the target webpage is obtained. In this way, by simulating keyboard and mouse operations to trigger dynamic pages, the tampering of the webpage is dynamically determined. This also prevents attackers from intentionally displaying static pages, thus preventing the inability to properly determine whether tampering has occurred. It achieves accurate perception of subtle changes in dynamic and static webpages, thereby improving the accuracy of determining whether a webpage has been tampered with.

[0037] In one implementation, before recording the first page data of the target webpage after it is loaded at the current moment, the method further includes: splitting the HTML file of the target webpage to obtain first content and second content corresponding to each tag, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

[0038] Among them, the splitting can be regular splitting. The regular expression for obtaining the first content is: >([^>]+?)< / ; the regular expression for obtaining the second content is: <([^>]+?)>. Exemplarily, <pid="paragraph1">Hello World , where "Hello World" is the first content and "<pid="paragraph1">" is the second content. That is to say, the first content is the element content of the tag, and the second content is the attribute information of the tag. The attribute information may include tag type, id, style, etc.

[0039] Optionally, after obtaining the first content and the second content corresponding to each tag, the method may further include: for each of the tags, classifying the first content according to the second content. It can be understood that text is usually represented by text tags, for example 、 、 etc.; images are usually in the form of The `<image>` tag is used to display images, and its `src` attribute points to the URL of the image; videos are usually displayed using `<image>` tags. <video>To present using tags, or with <iframe>When referencing a video player, the video's URL or source is specified in the src attribute; audio is typically used...<audio> The content is presented using tags. The second content includes the attribute information of the tags, so the category of the first content within a tag can be determined based on the attribute information. Therefore, when comparing differences later, different comparison methods can be used for different categories of content.

[0040] In this implementation, by splitting each tag, it is possible to avoid missing minor, brief or cleverly hidden tampering when judging based on page data later.

[0041] In one implementation, recording the first page data of the target webpage after it is loaded at the current time includes: generating a first snapshot of the target webpage at the current time; obtaining the first page data by adding a mark to each of the first contents in the first snapshot, wherein the mark is composed of the second contents corresponding to the first contents.

[0042] It is understood that a snapshot of the target webpage is retained, and each item of first content in the snapshot is marked. The mark can be composed of the corresponding second content, such as a tag ID. Further, if the corresponding second content does not have a tag ID, a mark is determined for the first content according to the tag order, and then the mark of the first content is added to each item of first content in the snapshot.

[0043] Optionally, obtaining the first page data by adding a tag to each of the first contents in the first snapshot may include: obtaining a first tagged snapshot by adding a tag to each of the first contents in the first snapshot; calculating the hash value for each first content item, each second content item, and the tag information for each first content item; and storing the calculated hash value in the blockchain. Due to the integrity and durability of the blockchain, changes to the webpage content can be checked and verified at any time. Furthermore, blockchain technology stores all information through a distributed network, meaning that even if some nodes are attacked, other nodes still retain a complete copy of the data, thus ensuring the durability and stability of the webpage content.

[0044] Optionally, the first content, the tag information of the first content, the second content, and the corresponding hash value can also be stored in a relational database for easy matching and regular inspection.

[0045] In the above implementation, full-range perception is achieved, and in subsequent comparison, the corresponding tag and its webpage position can be quickly located based on the snapshot mark.

[0046] In one implementation, recording the second page data of the target webpage includes: generating a second snapshot of the target webpage; obtaining second page data by adding a marker to each of the first contents in the second snapshot, wherein the marker is composed of the second contents corresponding to the first contents. The implementation process of this implementation is the same as the above implementation and will not be repeated here.

[0047] In one implementation, obtaining the tampering judgment result of the target webpage by comparing the first page data and the second page data includes: obtaining difference data when the first page data and the second page data are inconsistent, wherein the difference data includes at least one difference tag; and determining the tampering judgment result of the target webpage based on the at least one difference tag. That is, if the first page data and the second page data are inconsistent, it indicates that the page has changed, so difference data is obtained. This difference data includes at least one difference tag, and it is necessary to determine whether the page has definitely been tampered with based on the at least one difference tag. Optionally, during the comparison process, the hash value corresponding to the first page data and the hash value corresponding to the second page data can be compared. If the hash values ​​are inconsistent, it can be determined that the relevant content is at risk of being tampered with.

[0048] In one implementation, determining the tampering judgment result of the target webpage based on the difference data includes: if a first tag in at least one difference tag does not belong to a preset whitelist, determining that the page content corresponding to the first tag in the target webpage is at risk of tampering; or, if a second tag in at least one difference tag cannot be correctly restored, determining that the page content corresponding to the second tag in the target webpage is at risk of tampering.

[0049] It is understood that, in order to prevent risk alerts from occurring during normal page updates, a whitelist can be pre-set. This way, when the content in the pre-set whitelist changes, no alert will be triggered. Optionally, the pre-set whitelist may include date and time tags, regularly pushed news tags, visit volume tags, etc. "Unable to restore correctly" means that some tags have an automatic recovery setting. If automatic recovery is not possible, the page content corresponding to that tag may have been tampered with.

[0050] In this implementation, by monitoring the content of the difference tags, a refined analysis of webpage tampering is achieved. Tags that are updated normally on the webpage can be whitelisted, and important tags can be monitored and automatically responded to, which can reduce false alarms and missed alarms.

[0051] Optionally, an embodiment of the present application further provides another process schematic diagram of a web page monitoring method. As shown in Figure 2, the method may include the following steps:

[0052] S210: Regularly split the html file of the target web page to obtain the first content outside the tag and the second content inside the tag.

[0053] Among them, the first content is the user-visible element, and the second content includes the tag ID and attribute information. The second content has a corresponding relationship with the first content.

[0054] S220: Classify and save the corresponding first content according to the information in the second content.

[0055] That is, classify the first content into pictures, videos, audios, and texts, and save the classified first content.

[0056] S230: Take a snapshot of the target web page and mark it.

[0057] For each second content in the web page snapshot, use the tag ID in the corresponding second content as the mark of the first content. If there is no tag ID in the corresponding second content, determine a mark for the first content in sequence, and finally add the mark of the first content to each first content in the web page snapshot.

[0058] S240: Calculate the hash value for each first content and each second content respectively, and store the calculated hash value in the blockchain.

[0059] In addition, the first content, the marking information of the first content, the second content, and the corresponding hash value can also be stored in a relational database for convenient matching.

[0060] S250: Regularly inspect.

[0061] For the monitored website address, compare the hash value of each content calculated in real time with the hash value of each content stored in the blockchain. If the hash values are inconsistent, it is determined that the relevant content has been tampered with.

[0062] S260: Dispose of the tampered content abnormally.

[0063] The time and date tags, page view tags, etc. can be set as the whitelist. When the content in the whitelist changes, no alarm is generated. Also, important tags can be configured for automatic recovery. When it is detected that the content of these tags has been tampered with, the original content of these tags is directly read from the relational database, and the web page is restored using the read original content. In addition, the marks in the web page snapshot can be used to help the supervisor quickly locate the specific tampering position.

[0064] In this implementation method, through monitoring the content of each HTML tag, refined analysis of web page tampering is achieved. Tags that are normally updated daily can be handled as the whitelist, and important tags are monitored and automatically restored, which can effectively reduce false alarms and missed alarms. At the same time, attacks such as web page malware injection can also be judged by changes in HTML tags. After a certain content is tampered with, the web page position corresponding to the tag can be quickly located according to the web page snapshot mark.

[0065] Figure 3 shows a schematic structural diagram of a web page monitoring device provided by an embodiment of the present application. As shown in Figure 3, the web page monitoring device 300 may include: an acquisition module 310, a first recording module 320, a second recording module 330, and an analysis module 340.

[0066] In this embodiment, the acquisition module 310 is configured to acquire target interaction functions included in a target web page, where the target interaction functions include at least one of the following: keyboard interaction functions, mouse interaction functions; the first recording module 320 is configured to record first page data after the target web page is loaded at the current moment; the second recording module 330 is configured to record second page data of the target web page when a simulated interaction operation is performed on the target web page according to the target interaction functions; the analysis module 340 is configured to obtain a tampering judgment result of the target web page by comparing the first page data and the second page data.

[0067] In one implementation, the webpage monitoring device 300 may include: a splitting module, used to split the HTML file of the target webpage to obtain first content and second content corresponding to each tag, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

[0068] In one implementation, the first recording module 320 is specifically used to generate a first snapshot of the target webpage at the current time; by adding a mark to each of the first contents in the first snapshot, first page data is obtained, wherein the mark is composed of the second contents corresponding to the first contents.

[0069] In one implementation, the second recording module 330 is specifically used to generate a second snapshot of the target webpage; by adding a mark to each of the first contents in the second snapshot, second page data is obtained, wherein the mark is composed of the second contents corresponding to the first contents.

[0070] In one implementation, the analysis module 340 is specifically used to obtain difference data when the first page data and the second page data are inconsistent, wherein the difference data includes at least one difference tag; and to determine the tampering judgment result of the target webpage based on the at least one difference tag.

[0071] In one implementation, the analysis module 340 is specifically used to determine that the page content corresponding to the first tag in the target webpage is at risk of being tampered with when a first tag in the at least one difference tag does not belong to a preset whitelist; or, when a second tag in the at least one difference tag cannot be correctly restored, determine that the page content corresponding to the second tag in the target webpage is at risk of being tampered with.

[0072] The webpage monitoring device provided in this application embodiment can realize the various processes implemented in the webpage monitoring method embodiment. To avoid repetition, it will not be described again here.

[0073] The webpage monitoring device in the embodiments of this application can be a device, or it can be a component, integrated circuit, or chip in an electronic device. The embodiments of this application do not impose specific limitations.

[0074] The webpage monitoring device in this application embodiment can be a device with an operating system. The operating system can be the Android operating system, the iOS operating system, or other possible operating systems. This application embodiment does not specifically limit the specific operating system.

[0075] Optionally, as shown in Figure 4, an embodiment of the present application further provides an electronic device 400, including a processor 410, a memory 420, a program or instruction stored on the memory 420 and executable on the processor 410. When the program or instruction is executed by the processor 410, it implements each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0076] An embodiment of the present application further provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0077] Among them, the processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disc, etc.

[0078] Another embodiment of the present application provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run a program or instruction to implement each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0079] An embodiment of the present application further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer is caused to implement each process of the above-mentioned embodiment of the web page monitoring method and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0080] It should be understood that the chip mentioned in the embodiment of the present application may also be referred to as a system-on-chip, system chip, chip system, or system-on-chip, etc.

[0081] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0083] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.< / iframe> < / video>

Claims

1. A webpage monitoring method, characterized in that, The method includes: Obtain the target interactive functions included in the target webpage, wherein the target interactive functions include at least one of the following: keyboard interactive functions and mouse interactive functions; Record the data of the first page of the target webpage after it is loaded at the current moment; When performing simulated interactive operations on the target webpage according to the target interaction function, record the second page data of the target webpage; By comparing the data on the first page and the data on the second page, the result of the tampering judgment of the target webpage is obtained.

2. The method according to claim 1, characterized in that, Before recording the first page data of the target webpage after it is loaded at the current moment, the method further includes: By splitting the HTML file of the target webpage, the first content and the second content corresponding to each tag are obtained, wherein the first content includes the element content of the tag, and the second content includes the attribute information of the tag.

3. The method according to claim 2, characterized in that, The recording of the first page data of the target webpage after it is loaded at the current moment includes: Generate a first snapshot of the target webpage at the current moment; First page data is obtained by adding a tag to each of the first contents in the first snapshot, wherein the tag is composed of the second content corresponding to the first content.

4. The method according to claim 2, characterized in that, The second page data of the target webpage that is recorded includes: Generate a second snapshot of the target webpage; Second page data is obtained by adding a tag to each of the first contents in the second snapshot, wherein the tag is composed of the second contents corresponding to the first contents.

5. The method according to claim 1, characterized in that, The step of obtaining the tampering judgment result of the target webpage by comparing the data of the first page and the data of the second page includes: In the event that the data on the first page and the data on the second page are inconsistent, difference data is obtained, wherein the difference data includes at least one difference tag; The tampering judgment result of the target webpage is determined based on the at least one difference tag.

6. The method according to claim 5, characterized in that, The step of determining the tampering judgment result of the target webpage based on the difference data includes: If, among the at least one difference tag, the first tag is not in the preset whitelist, it is determined that the page content corresponding to the first tag on the target webpage is at risk of being tampered with; or... If a second tag cannot be correctly restored in at least one of the difference tags, it is determined that the page content corresponding to the second tag on the target webpage is at risk of being tampered with.

7. A webpage monitoring device, characterized in that, The device includes: The acquisition module is used to acquire target interactive functions included in the target webpage, wherein the target interactive functions include at least one of the following: keyboard interactive functions and mouse interactive functions; The first recording module is used to record the first page data of the target webpage after it is loaded at the current moment; The second recording module is used to record the second page data of the target webpage when the target webpage is subjected to simulated interactive operation according to the target interaction function; The analysis module is used to obtain the tampering judgment result of the target webpage by comparing the data of the first page and the data of the second page.

8. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the web page monitoring method as described in any one of claims 1-6.

9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the web page monitoring method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the web page monitoring method as described in any one of claims 1-6.

Images