Method and system for preventing tampering of website page content

Abstract

The invention discloses a method and system for preventing tampering of website page content, and belongs to the technical field of network security, and the method comprises the following steps: monitoring the website page content at a fixed point, extracting page features, and obtaining a plurality of groups of feature vector sets; performing anomaly identification on the multiple groups of feature vector sets by using a multivariate anomaly detection channel; marking the page features corresponding to the feature anomalies which do not meet the preset risk threshold value as risk features, and performing tampering early warning; afterwards, attack situation awareness is carried out according to the risk feature sequence, an attack type and an attack fluctuation curve are determined, and the monitoring frequency and a preset risk threshold value are dynamically updated according to the attack type and the attack fluctuation curve. According to the method and the device, the technical problem of difficulty in timely and accurate detection and early warning of website page tampering behaviors caused by insufficient monitoring precision and adaptivity in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for preventing tampering with website page content. Background Art

[0002] As Internet applications continue to expand, website content tampering is becoming more common, posing a huge challenge to website security and user trust. Website tampering usually occurs when attackers maliciously change page content, causing false information to spread, user privacy to be leaked, and even financial losses. Especially in key information systems such as e-commerce, banks, and governments, page content tampering will directly affect business processes and data integrity. In order to prevent such tampering, traditional security measures (such as static firewalls and virus detection) are difficult to cope with the ever-changing attack methods, especially in modern websites with dynamic content and complex interactions, where static detection and defense mechanisms are no longer sufficient.

[0003] At present, the tampering prevention measures adopted by the industry are mostly content monitoring and anomaly detection, which mainly detect tampering behaviors through regular monitoring of page elements and anomaly identification of preset thresholds. However, these measures still have shortcomings in terms of real-time, accuracy and adaptability. Specifically, the existing solutions have low accuracy in feature extraction and anomaly detection, and it is difficult to cope with complex and changeable attack modes, resulting in frequent false alarms or missed alarms, which affects the monitoring effect. At the same time, traditional monitoring strategies are often fixed and it is difficult to flexibly adjust the monitoring frequency and risk threshold to adapt to the dynamic changes of attacks. Therefore, there is an urgent need for a method and system to prevent tampering of website page content, which is used to solve the technical problem in the existing technology that website page tampering behaviors are difficult to detect and warn in a timely and accurate manner due to insufficient monitoring accuracy and adaptability. Summary of the invention

[0004] The present application provides a method and system for preventing tampering of website page content, aiming to solve the technical problem in the prior art that website page tampering behavior is difficult to detect and warn in a timely and accurate manner due to insufficient monitoring accuracy and adaptability.

[0005] In view of the above problems, the present application provides a method and system for preventing tampering of website page content.

[0006] The first aspect disclosed in the present application provides a method for preventing tampering with website page content, the method comprising: monitoring the website page content at a fixed point when the website is running, and performing page feature extraction to obtain multiple sets of feature vector sets; using a multivariate anomaly detection channel to perform anomaly identification on the multiple sets of feature vector sets, and outputting multiple feature anomaly degrees; marking page features corresponding to feature anomaly degrees that do not meet a predetermined risk threshold as risk features, and issuing a tampering warning for the risk features; issuing a tampering warning for the risk features, and then also comprising: obtaining a risk feature sequence within a predetermined period, performing attack situation awareness based on the risk feature sequence, determining an attack type and an attack fluctuation curve, and dynamically updating a monitoring frequency and a predetermined risk threshold based on the attack type and the attack fluctuation curve.

[0007] Another aspect disclosed in the present application provides a system for preventing tampering with website page content, the system including a plurality of feature vector set acquisition modules, which are used to monitor website page content at a fixed point when the website is running, and extract page features to obtain a plurality of feature vector sets; a plurality of feature vector set acquisition modules, which are used to identify anomalies of the plurality of feature vector sets using a multivariate anomaly detection channel, and output a plurality of feature anomaly degrees; a plurality of feature vector set acquisition modules, which are used to mark page features corresponding to feature anomaly degrees that do not meet a predetermined risk threshold as risk features, and to issue a tampering warning for the risk features; a dynamic update module, which is used to issue a tampering warning for the risk features, and then to obtain a risk feature sequence within a predetermined period, to perform attack situation awareness based on the risk feature sequence, to determine the attack type and the attack fluctuation curve, and to dynamically update the monitoring frequency and the predetermined risk threshold based on the attack type and the attack fluctuation curve.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages: The adoption of fixed-point monitoring of website page content, feature extraction and multi-channel anomaly detection solves the technical problem of the existing technology that website page tampering behavior is difficult to detect and warn in a timely and accurate manner due to insufficient monitoring accuracy and adaptability. Through fine-grained analysis of multiple sets of feature vectors, combined with BP neural network and big data technology for anomaly identification and dynamic adjustment, the system can accurately identify potential tampering behaviors, respond in real time and provide effective warnings, significantly improving the security and anti-tampering capabilities of website content.

[0009] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A flowchart of a method for preventing tampering of website page content is provided for an embodiment of the present application.

[0011] Figure 2 A structural schematic diagram of a system for preventing tampering of website page content is provided for an embodiment of the present application.

[0012] Description of reference numerals: multiple groups of feature vector set acquisition module 11, multiple groups of feature vector set acquisition module 12, multiple groups of feature vector set acquisition module 13, dynamic update module 14. DETAILED DESCRIPTION

[0013] The overall idea of ​​the technical solution provided by this application is as follows: The embodiments of the present application provide a method and system for preventing tampering of website page content. By monitoring the website page content at a fixed point and extracting multiple sets of feature vectors, these features are identified as abnormal by using a multivariate anomaly detection channel to determine whether the page has been tampered with. By setting a predetermined risk threshold, risky page features are marked and an early warning is issued. Combined with a mechanism for dynamically adjusting the monitoring frequency and risk threshold, the system can adaptively optimize the detection strategy according to the attack situation and fluctuation curve, thereby improving the accuracy and response speed of tampering detection and ensuring website security.

[0014] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically described below in conjunction with the drawings in the specification.

[0015] Embodiment 1, as Figure 1 As shown, an embodiment of the present application provides a method for preventing tampering of website page content, the method comprising: Step S100: When the website is running, the website page content is monitored at a fixed point, and page feature extraction is performed to obtain multiple sets of feature vector sets.

[0016] Specifically, fixed-point monitoring refers to monitoring the content of website pages regularly or regularly at specific time intervals or locations to detect potential abnormal changes. Page feature extraction refers to extracting representative data or features from website pages. These features can help the system identify the core content and structure of the page. Feature vectors are a form of numerical representation of page features. Through feature vectorization, complex information such as text and structure can be converted into numerical representation, which is convenient for subsequent algorithm processing.

[0017] First, the system visits the website page at a predetermined monitoring time interval (e.g., every 5 minutes) to extract features from the main content of the page. Feature extraction tools can include NLP (natural language processing) libraries, such as Python's NLTK or spaCy, to extract text content from the page, web crawler tools (such as BeautifulSoup) to parse HTML structure, or automated testing tools such as Selenium to obtain dynamic page content. Through these tools, the text content of the page is decomposed into features of word frequency or sentence structure, and the hierarchical structure of HTML tags is converted into feature vectors. These vectorized feature sets are called "multiple sets of feature vector sets." For example, the text content of a news page is decomposed into word frequency vectors (e.g., "news" appears 3 times, "headline" appears 2 times), its HTML structure is converted into a hierarchical matrix, and external resources (such as images or advertising links) are represented as URL paths pointed to by the links and their dependencies. Through this feature extraction, after regularly obtaining the features of the page content, the system inputs multiple sets of feature vectors into the anomaly detection channel so that once the detected features change abnormally, they can be identified and tampering warnings can be issued in a timely manner.

[0018] Through multi-level feature extraction and fixed-point monitoring, the monitoring accuracy and response speed of page content are effectively improved, which can detect potential risks at an early stage when the website page is tampered with, and reduce misjudgment and omission of website content tampering.

[0019] Step S200: using a multivariate anomaly detection channel, performing anomaly identification on the plurality of feature vector sets, and outputting a plurality of feature anomaly degrees.

[0020] Specifically, the multivariate anomaly detection channel is an anomaly detection system based on multiple feature dimensions, which can simultaneously analyze whether multiple features in the page content (such as text, structure, and external links) have abnormal changes. Feature abnormality refers to the degree to which the page feature deviates from the normal state. The higher the abnormality, the more abnormal the state of the feature, and the presence of tampering or attack behavior.

[0021] When performing anomaly detection, multiple page features will first be input into the multivariate anomaly detection channel, and each feature detection has a dedicated detection unit. For example, text features can be detected through natural language processing technology to detect changes in word frequency, HTML structures can be detected through graph structure analysis technology to detect changes in tag levels, and external links can be evaluated through URL checks to assess link anomalies.

[0022] The implementation of multivariate anomaly detection channels usually relies on machine learning algorithms, such as using BP neural networks (back propagation neural networks) to build detection models. Each feature (such as text content, HTML structure, external links) corresponds to a detection unit, and these units are independent of each other and work together. For example, for text content detection, the system can use word frequency statistics and NLP technology; for HTML structure detection, tree structure analysis tools can be used to parse tag nesting changes; and for the detection of external resource links, URL fingerprint matching tools or link-based frequency analysis can be used. Each detection unit calculates the abnormality of the input features respectively, and finally outputs multiple feature abnormalities.

[0023] The use of multi-dimensional anomaly detection channels can achieve comprehensive monitoring of page features, allowing the system to analyze anomalies of multiple features at the same time, improving the accuracy and coverage of detection. Through this multi-dimensional anomaly identification, not only can tampering behaviors be discovered more quickly, but the specific source of abnormal features can also be identified more accurately, thereby providing timely warnings for tampered content and enhancing the security and stability of website content.

[0024] Step S300: Mark the page features corresponding to the feature abnormality that does not meet the predetermined risk threshold as risk features, and issue a tampering warning for the risk features.

[0025] Specifically, the predetermined risk threshold refers to a pre-set threshold for determining whether the page content is abnormal. If the feature abnormality is lower than this threshold, it indicates that the feature has been tampered with or other abnormalities. Risk features refer to content features in the page that are marked as tampered with or abnormal, usually features with a feature abnormality lower than the risk threshold. Tampering warning refers to the issuance of a warning signal for the detected risk features to remind the system or management personnel that the page content has been tampered with.

[0026] First, the abnormality of each page feature is compared to determine whether it exceeds the preset risk threshold. For example, suppose a risk threshold is set for the "product description" page feature of an e-commerce website. When the abnormality of the feature is lower than the threshold, it is judged as a potential risk feature. The system will mark such risk features.

[0027] Once a page feature is marked as a risk feature, the system will immediately trigger the tampering warning module. This module can use automated warning tools such as email notifications, SMS reminders, or dashboard alerts to issue real-time warnings to website administrators or security teams. For example, if the HTML structure of a page shows an abnormality, the warning system will record this situation through the alarm log, and can display this warning on the administrator's monitoring interface through an integrated management platform (such as Splunk, Grafana, etc.).

[0028] By setting a predetermined risk threshold and automatically marking risk features, this method can accurately identify potential page tampering behaviors, greatly shortening the detection and response time. The system's tampering warning mechanism can help managers know the risks when page anomalies first appear, avoiding serious data leakage or loss of user trust. At the same time, the automated marking and warning process reduces the burden of manual inspection, improves the efficiency and response speed of overall security maintenance, and enables the system to respond to complex security challenges more agilely.

[0029] Step S400: issuing a tampering warning for the risk feature, which then includes: obtaining a risk feature sequence within a predetermined period, performing attack situation awareness according to the risk feature sequence, determining an attack type and an attack fluctuation curve, and dynamically updating a monitoring frequency and a predetermined risk threshold according to the attack type and the attack fluctuation curve.

[0030] Specifically, the risk feature sequence refers to the set of all risk features detected by the system within a predetermined time period. By recording these features, potential attack patterns can be analyzed and judged. Attack situation awareness is a method for real-time monitoring, identification and analysis of attack activities. It perceives and predicts attack situations by analyzing the changing trends of risk features. Attack type refers to the classification of attack behaviors, including injection attacks, tampering attacks, resource hijacking and other types, so that different protection measures can be taken for different types. Attack fluctuation curve refers to analyzing the changing trend of the intensity of attack behavior based on time or frequency, using curves to show the intensity of attack activities at different time points, helping to intuitively judge the persistence and suddenness of attacks. Monitoring frequency refers to the frequency of monitoring page content, which is dynamically adjusted according to changes in the attack situation to improve response speed.

[0031] After completing the marking of risk features and tampering warning, within a certain predetermined time period, all risk features that occurred in the time period are collected and recorded to form a "risk feature sequence". This risk feature sequence will be used to analyze the attack situation of the current page. By performing statistical analysis on the risk feature sequence, for example, calculating the high-frequency features and abnormal feature fluctuations, the system can make a preliminary judgment on the type and intensity of the attack, thereby perceiving the attack situation.

[0032] Based on this, the system uses attack identification algorithms (such as time series analysis or clustering algorithms) to analyze risk characteristics and generate attack fluctuation curves. Attack fluctuation curves can help security teams identify changing trends in attack behaviors, such as continuous low-frequency attacks or sudden high-frequency attacks. The system can dynamically adjust detection parameters based on attack types (such as SQL injection, malicious code tampering) and attack fluctuation curves (such as frequent peak attack fluctuations). Specifically, if the system detects frequent sudden attacks, the monitoring frequency will increase, allowing for more intensive detection; when the attack intensity is low, the monitoring frequency can be appropriately reduced to save resources. At the same time, the predetermined risk threshold will also be appropriately increased or decreased based on the current attack type and fluctuation situation to enhance the system's adaptability and detection flexibility.

[0033] By acquiring risk feature sequences and performing attack situation awareness, the system can timely identify and predict the trends of different attack behaviors, allowing the security team to make response strategies in advance. At the same time, the system automatically adjusts the monitoring frequency and predetermined risk thresholds based on the attack fluctuation curve, effectively avoiding resource waste and improving the accuracy and efficiency of detection.

[0034] Furthermore, page feature extraction is performed to obtain multiple sets of feature vector sets, including: Extracting features of the website page content according to predetermined page features to obtain multiple sets of feature data sets, wherein the predetermined page features include text content, HTML structure, and external resource links; Performing feature vector mapping on the multiple sets of feature data sets to obtain the multiple sets of feature vector sets.

[0035] Specifically, feature vector mapping refers to converting a feature data set into a numerical vector representation to facilitate subsequent algorithm processing and calculation. The result of feature vector mapping is a set of numerical vectors, each of which represents a page feature, such as a word frequency vector or a structure matrix.

[0036] When performing page feature extraction and feature vector mapping, you must first predefine the main features of the page, which include text content, HTML structure, and external resource links loaded by the page. The specific operation process is to first crawl the page content through tools, such as using Selenium to crawl the dynamic page loading content, and then combine BeautifulSoup to parse the HTML structure and extract the page tags and nested relationships. For the text content part, you can use natural language processing libraries (such as NLTK or spaCy) to extract content features such as word frequency and sentence structure.

[0037] Map the extracted feature data into feature vectors. For example, the text feature data of the page can be converted into a word frequency vector, the HTML structural features can be represented as a nested matrix (such as "div" nested "p" tags, converted into a two-dimensional matrix representation), and the external links can be converted into a pointing URL path vector or connection hierarchy. These vectorized feature data sets can be integrated into a feature vector set so that they can be used as input for the detection algorithm in the next step.

[0038] This step predefines page features and converts them into vector form, so that page feature information can be quantified and compared, making it easier for subsequent detection algorithms to analyze content changes. Through feature vector mapping, the system can more accurately and quickly capture changes in page features, improving the timeliness and accuracy of page tampering detection.

[0039] Furthermore, a multivariate anomaly detection channel is used to perform anomaly identification on the multiple sets of feature vectors, and multiple feature anomaly degrees are output, including: Performing feature complexity and feature impact analysis on the text content, HTML structure and external resource links respectively, and determining multiple feature complexities and multiple feature impacts; According to the multiple feature complexities and multiple feature influences, the number of detection branches of the abnormality detection unit is configured to obtain the number of content branches, the number of structure branches, and the number of link branches, wherein the number of detection branches is positively correlated with the feature complexity and the feature influence; Based on the BP neural network, a content detection unit, a structure detection unit and a link detection unit are constructed according to the number of content branches, the number of structure branches and the number of link branches; The content detection unit, the structure detection unit and the link detection unit are integrated to generate a multivariate anomaly detection channel, the multiple feature vector sets are input into the multivariate anomaly detection channel, and the multiple feature anomaly degrees are output.

[0040] Specifically, feature complexity indicates the complexity of page features. For example, the complexity of HTML structure can be measured based on the nesting depth of tags, the hierarchical structure of the page, etc.; the complexity of text content can be measured based on the diversity of words or the complexity of sentence structure. Feature influence indicates the degree of influence of a certain feature on the overall stability of the page. The number of detection branches refers to the number of branches of the detection unit determined based on the complexity and influence of the page features. The higher the complexity and influence, the more branches will be detected to ensure that feature changes can be fully detected and analyzed.

[0041] Specifically, the text content can be calculated through natural language processing tools (such as NLTK or spaCy) to calculate its vocabulary richness and syntactic structure complexity, thereby obtaining the complexity of text features. At the same time, the complexity of HTML structure can be analyzed by HTML parsing tools (such as BeautifulSoup) to analyze the hierarchical nesting depth of tags, while the complexity of external resource links can be determined by checking link paths and dependencies. Based on these complexity and impact assessments, the system can set the number of branches of the corresponding detection unit according to the complexity and impact of each feature, namely the number of content branches, the number of structural branches, and the number of link branches.

[0042] Next, the BP neural network model is used to build detection units to achieve independent anomaly detection of different features. Specifically, the content detection unit is used to monitor text features, the structure detection unit is used to monitor HTML structure features, and the link detection unit is used to monitor external link features. Each detection unit further refines the detection based on the number of branches. For example, for complex text content, multiple branches can be used to monitor the changes in different word frequencies, and for complex structures, multiple detection levels can be subdivided to capture changes in tag nesting at different depths.

[0043] Finally, the content detection unit, structure detection unit and link detection unit are integrated to generate a multivariate anomaly detection channel, and the extracted multiple feature vector sets are input into the channel for detection. Through the parallel branching structure of the BP neural network, the system analyzes the changes of different features and finally outputs the abnormality of each feature. For example, if the keyword frequency in the text content changes abnormally, the text detection unit will output a higher abnormality; if the HTML tag structure changes significantly, the abnormality of the structure detection unit will increase.

[0044] This method improves the accuracy and pertinence of anomaly detection by accurately analyzing the complexity and influence of page features and reasonably configuring the number of detection branches. By building multi-level detection units through BP neural network, the system can realize parallel feature anomaly detection and promptly discover subtle signs of tampering in complex web pages, effectively improving the timeliness and accuracy of web page tampering detection and ensuring the security and integrity of page content.

[0045] Furthermore, based on the BP neural network, a content detection unit is constructed according to the number of content branches, including: Querying the website operation log, collecting a sample content feature data set, and performing feature vector mapping on the sample content feature data set to obtain a sample feature vector set; Perform feature abnormality retrieval based on the sample content feature data set to obtain a sample feature abnormality set; Constructing a sample data set according to the sample feature vector set and the sample feature anomaly degree set, dividing the sample data set into M equal parts, selecting M parts with replacement, constructing a first training set, iterating and selecting M times, and obtaining M training sets, where M is the number of content branches; Based on the BP neural network, construct M content detection branches according to the number of content branches; Taking the sample feature vector as input and the sample feature abnormality as output, the M training sets are used to perform supervised training on the M content detection branches to obtain M convergent content detection branches, and the content detection unit is constructed based on the integration of the M convergent content detection branches, wherein the output of the content detection unit is the mean of the outputs of the M convergent content detection branches.

[0046] Specifically, the website operation log refers to the various data recorded during the operation of the website, including rich information on page content and status changes. The sample content feature data set refers to the set of page content feature data extracted from the operation log that represents the normal operation of the website, which is used to train the detection model. M training sets refer to dividing the sample data set into M equal parts for building and training multiple detection branches, where the number of M is the same as the number of content branches. The content detection unit is a unit composed of multiple content detection branches, responsible for detecting abnormalities in page content features.

[0047] Before implementing the content detection unit, a large amount of sample content feature data is extracted from the website operation log. Through log parsing tools (such as Logstash or Splunk), the system can filter out normal page access data to form a sample content feature data set. Subsequently, this data set is mapped to a feature vector to obtain a sample feature vector set. For each page content feature (such as text keyword frequency or HTML structure), the vector set will digitize these features for subsequent model input.

[0048] Next, by performing feature anomaly retrieval on the sample content feature data set, the system can obtain the feature anomaly of each sample and form a sample feature anomaly set. This anomaly set reflects the normal variation range of each feature. Then, the system divides the sample data set into M parts and selects them with replacement to construct M training sets. This process is similar to "out-of-bag" sampling, and each training set will contain different sample combinations to ensure the diversity and coverage of the training.

[0049] When training the detection unit, the system will build M content detection branches based on the BP neural network according to the number of content branches. Each branch receives the corresponding training set as input and performs supervised training, using the sample feature vector as input and the sample feature abnormality as output to train the weights and thresholds of the BP neural network until the model converges (that is, the training error drops to a set low level). Once all M branches are trained and converged, the system will integrate them into a complete content detection unit, and the final output is the average of the outputs of the M detection branches to obtain a more stable and accurate detection result.

[0050] This method uses BP neural network to supervise the training of different sample training sets, which can capture the complex changes of content features and detect different feature branches, significantly improving the detection accuracy of page content tampering. Through the multi-branch detection structure, the system can effectively reduce the error of a single branch and the false alarm rate of anomaly detection, and enhance the overall accuracy and robustness of the detection unit.

[0051] Further, performing feature abnormality retrieval based on the sample content feature data set to obtain a sample feature abnormality set includes: Randomly selecting first sample content feature data from the sample content feature data set; Using the website type and the first sample content feature data as constraints, searching for similar websites based on big data to obtain a first operation record set; The proportion of abnormal records in the first operation record set is counted, set as the first sample feature abnormality, and added to the sample feature abnormality set.

[0052] Specifically, similar website retrieval refers to searching for other websites with similar structures, functions and uses based on a big data platform with similar features (such as website type and page content), so as to collect historical records of similar websites as a reference for comparison. The first operating record set refers to a data set collected from similar websites that meets the content characteristics of the current sample, reflecting the normal operating conditions under the same or similar conditions. The proportion of abnormal records refers to the proportion of records that show abnormal changes in the operating record set, which is used to measure the abnormality of the feature. It reflects the frequency with which the feature deviates from the normal state in similar websites.

[0053] First, a sample data item is randomly selected from the sample content feature data set, which is called the first sample content feature data. For example, this sample can be the product description content of an e-commerce website or the article content of a news website. Then, based on the type of the website (such as e-commerce, news, social networking, etc.) and the selected sample content features as constraints, similar websites are searched on the Internet based on a big data platform (such as Hadoop or Elasticsearch), and multiple websites with similar content and structure to the website are found. Page content records similar to the first sample content features are extracted from the operation records of these websites to form the first operation record set.

[0054] Next, the first set of operation records is statistically analyzed to calculate the proportion of records that show abnormalities, which is called the abnormal record ratio. Abnormal records include tampered content, changed tag structure, or invalid external links. The system uses this ratio as the feature abnormality of the first sample and adds it to the sample feature abnormality set.

[0055] By obtaining a large number of operation records from similar websites and counting the abnormal proportions, this method can comprehensively measure the normal range of changes in page content features and significantly improve the accuracy of feature abnormality assessment. By using similar website retrieval supported by big data, this solution improves the ability to perceive abnormal content while ensuring data coverage, effectively avoiding misjudgments or missed judgments caused by insufficient data from a single website, and enhancing the system's detection sensitivity and adaptability to page tampering.

[0056] Furthermore, the attack fluctuation curve is determined, including: Perform attack discreteness analysis based on the risk feature sequence to determine attack discreteness; Inputting the attack discreteness into a discreteness-compensation coefficient comparison table to determine a trend compensation coefficient, wherein the trend compensation coefficient is positively correlated with the attack discreteness; The attack fluctuation curve is compensated and updated according to the trend compensation coefficient.

[0057] Specifically, attack discreteness analysis refers to analyzing the degree of dispersion of attack behaviors and measuring whether the distribution of attack characteristics is concentrated in certain time periods or page characteristics, thereby helping to identify the concentration or regularity of attacks. Attack discreteness refers to the numerical indicator obtained in discreteness analysis, which indicates the degree of dispersion of attack characteristics in time or page content. The higher the discreteness, the more dispersed the attack, and the lower the discreteness, the more concentrated the attack. The discreteness-compensation coefficient comparison table is a preset table used to convert attack discreteness into trend compensation coefficients. In the comparison table, the discreteness is positively correlated with the compensation coefficient, that is, the higher the discreteness, the greater the compensation coefficient. The trend compensation coefficient is a coefficient obtained through the comparison table, which is used to compensate and adjust the attack fluctuation curve to more accurately reflect the trend of attack intensity over time.

[0058] First, the risk feature sequence is analyzed through the "attack discreteness analysis" method to determine whether the risk features are concentrated in certain time periods or specific page features. For example, if the "product price" of an e-commerce website is tampered with many times during a specific promotion period, this indicates that the attack is concentrated. Through this analysis, the attack discreteness can be obtained - if the attack behavior occurs frequently and is concentrated in certain time periods, the discreteness will be low; if the attack is more random and dispersed, the discreteness will be higher.

[0059] Next, the system will input the obtained attack discreteness value into the "Discreteness-Compensation Coefficient Comparison Table". This comparison table maps the discreteness value to the trend compensation coefficient. The trend compensation coefficient is used to dynamically adjust the attack fluctuation curve.

[0060] Finally, the system compensates and updates the attack fluctuation curve based on the obtained trend compensation coefficient. The attack fluctuation curve will show the fluctuation of attack activities over time. Combined with the adjustment of the compensation coefficient, the system can more accurately display and predict the changes in attack intensity.

[0061] Through the dynamic adjustment of attack discreteness and trend compensation coefficient, the system can finely compensate for the attack fluctuation curve, so that the fluctuation curve can more realistically reflect the changing trend of the attack, especially for concentrated or dispersed attack scenarios. The adaptability is greatly improved. This process significantly enhances the detection accuracy and sensitivity of the system, allowing managers to better understand and predict attack trends, thereby improving the security strategy and protection level of the website in a targeted manner, thereby reducing the risk of attacks.

[0062] Furthermore, the monitoring frequency and the predetermined risk threshold are dynamically updated according to the attack type and the attack fluctuation curve, including: Constructing a monitoring parameter correction model, wherein the monitoring parameter correction model includes an input layer, a frequency correction layer, a threshold correction layer and an output layer; Input the attack type and the attack fluctuation curve into the monitoring parameter correction model, and output a frequency correction coefficient and a threshold correction coefficient; The monitoring frequency and the predetermined risk threshold are dynamically adjusted according to the frequency correction coefficient and the threshold correction coefficient.

[0063] Specifically, the monitoring parameter correction model is a model used to dynamically adjust monitoring parameters. The model calculates the frequency correction coefficient and threshold correction coefficient suitable for the current attack situation based on the input attack type and attack fluctuation curve to adjust the monitoring frequency and risk threshold. The input layer refers to the layer where the model receives input data, including the attack type and attack fluctuation curve, which is used to guide the processing of subsequent layers. The frequency correction layer is used to calculate and adjust the monitoring frequency. The monitoring frequency is the frequency at which the system checks for changes in page content. The higher the frequency, the more sensitive the detection. The threshold correction layer is used to calculate and adjust the risk threshold. The risk threshold refers to the system's tolerance limit for the degree of abnormality of page content features. The lower the threshold, the higher the system's sensitivity to abnormalities. The output layer is the last layer of the model, which outputs the frequency correction coefficient and threshold correction coefficient for dynamic adjustment of the monitoring frequency and risk threshold.

[0064] Construct a "monitoring parameter correction model", which usually uses machine learning algorithms to improve dynamic response capabilities. Specifically, first, a large amount of attack data needs to be collected, including different attack types (such as SQL injection, XSS attack, etc.) and attack fluctuation curves (i.e., the pattern of attack frequency changing over time). By analyzing these data, the key features of the attack are extracted and input into the machine learning model, which is often trained using a deep neural network (such as BP neural network). During the training process, the model learns the relationship between different attack types and attack fluctuations, and can then output appropriate frequency correction coefficients and threshold correction coefficients. The model continuously adjusts parameters through the back propagation algorithm (BP algorithm) to optimize the adjustment strategy of the monitoring frequency and risk threshold, so that the system can adapt to different attack situations and achieve accurate monitoring and dynamic response. The monitoring parameter correction model consists of four parts: input layer, frequency correction layer, threshold correction layer, and output layer. The input layer is used to receive data input of attack type and attack fluctuation curve. For example, the attack type received is "SQL injection" or "cross-site scripting attack", and the attack fluctuation curve shows the trend of attack frequency changing over time.

[0065] In the model, the frequency correction layer calculates an appropriate "frequency correction coefficient" based on the input attack type and fluctuation curve. For example, if the fluctuation curve shows that the attack frequency is gradually increasing, the system will output a higher frequency correction coefficient, thereby increasing the monitoring frequency, so that the system can detect new attacks more promptly. The threshold correction layer calculates the "threshold correction coefficient" based on the attack type and fluctuation. For example, for high-risk attack types, the system will output a lower threshold correction coefficient to lower the predetermined risk threshold so as to be more sensitive to small-amplitude feature anomalies.

[0066] Finally, at the output layer, these two correction coefficients are output and applied to the real-time adjustment of the system's monitoring frequency and risk threshold. For example, when the attack fluctuation curve shows a gradually increasing attack activity, the frequency correction coefficient is increased, the monitoring frequency is increased to once a minute, and the risk threshold is reduced through the threshold correction coefficient to ensure that the system is more sensitive to tampering operations.

[0067] This step realizes the dynamic adaptation of monitoring frequency and risk threshold, significantly enhancing the system's adaptability when facing different attack types and frequency changes, ensuring that the system can quickly adjust the monitoring intensity according to the attack situation.

[0068] In summary, the method for preventing tampering of website page content provided by the embodiment of the present application has the following technical effects: 1. By monitoring the content of website pages at fixed points and extracting feature vector sets, combined with multivariate anomaly detection methods to identify anomalies in page content, potential tampering behaviors can be effectively captured. This technical solution can identify abnormal features of pages in real time and accurately, providing a guarantee for timely detection of tampering incidents, thereby protecting the security of website content, preventing illegal tampering, and improving the website's defense capabilities.

[0069] 2. Use the multivariate anomaly detection channel to identify anomalies in the page feature vector set and output multiple feature anomaly degrees, which can effectively distinguish normal and abnormal page features. This method makes the monitoring of different types of page features more refined and flexible, thereby improving the sensitivity and accuracy of detection and being able to identify potential security threats in a timely manner.

[0070] 3. Through the analysis and compensation update of the attack fluctuation curve, the monitoring frequency and threshold can be adjusted dynamically. This technology improves the system's adaptive ability, ensuring that when facing the attack frequency fluctuation, the system can adjust the detection strategy in real time, so as to better cope with the changing attack mode and improve the response speed and accuracy to the changes in details.

[0071] Embodiment 2 is based on the same inventive concept as the method for preventing tampering of website page content in the above embodiment. Figure 2 As shown, an embodiment of the present application provides a system for preventing tampering of website page content, the system comprising: The multiple feature vector set acquisition module 11 is used to monitor the website page content at a fixed point when the website is running, and to extract page features to acquire multiple feature vector sets.

[0072] The multiple feature vector set acquisition module 12 is used to use a multivariate anomaly detection channel to perform anomaly identification on the multiple feature vector sets and output multiple feature anomaly degrees.

[0073] The multiple feature vector set acquisition module 13 is used to mark the page features corresponding to the feature abnormality that does not meet the predetermined risk threshold as risk features, and issue tampering warnings for the risk features.

[0074] The dynamic update module 14 is used to issue a tampering warning for the risk features, and then obtain a risk feature sequence within a predetermined period, perform attack situation awareness based on the risk feature sequence, determine the attack type and attack fluctuation curve, and dynamically update the monitoring frequency and predetermined risk threshold based on the attack type and attack fluctuation curve.

[0075] Furthermore, the multiple feature vector set acquisition module 11 is further configured to perform the following steps: According to predetermined page features, feature extraction is performed on the website page content to obtain multiple sets of feature data sets, wherein the predetermined page features include text content, HTML structure and external resource links; feature vector mapping is performed on the multiple sets of feature data sets to obtain the multiple sets of feature vector sets.

[0076] Furthermore, the multiple feature vector set acquisition module 12 is further configured to perform the following steps: The text content, HTML structure and external resource links are analyzed for feature complexity and feature influence respectively to determine multiple feature complexities and multiple feature influences; the number of detection branches of the anomaly detection unit is configured according to the multiple feature complexities and multiple feature influences to obtain the number of content branches, the number of structure branches and the number of link branches, wherein the number of detection branches is positively correlated with the feature complexity and the feature influence; based on the BP neural network, a content detection unit, a structure detection unit and a link detection unit are constructed according to the number of content branches, the number of structure branches and the number of link branches; the content detection unit, the structure detection unit and the link detection unit are integrated to generate a multivariate anomaly detection channel, the multiple groups of feature vector sets are input into the multivariate anomaly detection channel, and the multiple feature anomalies are output.

[0077] Furthermore, the multiple feature vector set acquisition module 12 is further configured to perform the following steps: Query the website operation log, collect the sample content feature data set, and perform feature vector mapping on the sample content feature data set to obtain the sample feature vector set; perform feature anomaly retrieval based on the sample content feature data set to obtain the sample feature anomaly set; construct a sample data set according to the sample feature vector set and the sample feature anomaly set, divide the sample data set into M parts, and select M times with replacement to construct a first training set, iterate and select M times to obtain M training sets, wherein M is the number of content branches; based on the BP neural network, construct M content detection branches according to the number of content branches; take the sample feature vector as input and the sample feature anomaly as output, use the M training sets to perform supervised training on the M content detection branches to obtain M convergent content detection branches, and integrate and construct the content detection unit according to the M convergent content detection branches, wherein the output of the content detection unit is the mean of the outputs of the M convergent content detection branches.

[0078] Furthermore, the multiple feature vector set acquisition module 12 is further configured to perform the following steps: A first sample content feature data is randomly selected from the sample content feature data set; a similar website is searched based on big data with the website type and the first sample content feature data as constraints to obtain a first operation record set; and a proportion of abnormal records in the first operation record set is counted, set as a first sample feature abnormality, and added to the sample feature abnormality set.

[0079] Furthermore, the dynamic update module 14 is also used to perform the following steps: An attack discreteness analysis is performed according to the risk feature sequence to determine the attack discreteness; the attack discreteness is input into a discrete-compensation coefficient comparison table to determine a trend compensation coefficient, wherein the trend compensation coefficient is positively correlated with the attack discreteness; and the attack fluctuation curve is compensated and updated according to the trend compensation coefficient.

[0080] Furthermore, the dynamic update module 14 is also used to perform the following steps: A monitoring parameter correction model is constructed, wherein the monitoring parameter correction model includes an input layer, a frequency correction layer, a threshold correction layer and an output layer; the attack type and the attack fluctuation curve are input into the monitoring parameter correction model, and a frequency correction coefficient and a threshold correction coefficient are output; the monitoring frequency and the predetermined risk threshold are dynamically adjusted according to the frequency correction coefficient and the threshold correction coefficient.

[0081] Any step of the method described above can be stored as a computer instruction or program in an unlimited computer memory, and can be called and recognized by an unlimited computer processor to implement any method in the embodiments of the present application, without any unnecessary restrictions.

[0082] Furthermore, the first or second mentioned above not only represents an order relationship, but also represents a specific concept, and / or refers to the selection of multiple elements individually or in whole. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalent technologies, the present application intends to include these modifications and variations.

Claims

1. A method for preventing tampering of website page content, characterized in that: Methods include: When the website is running, the website page content is monitored at a fixed point, and page features are extracted to obtain multiple sets of feature vector sets; Using a multivariate anomaly detection channel, performing anomaly identification on the multiple sets of feature vectors, and outputting multiple feature anomaly degrees; Marking page features corresponding to feature abnormality levels that do not meet a predetermined risk threshold as risk features, and issuing tampering warnings for the risk features; The risk feature is subjected to tampering warning, and then further includes: obtaining a risk feature sequence within a predetermined period, performing attack situation awareness according to the risk feature sequence, determining the attack type and the attack fluctuation curve, and dynamically updating the monitoring frequency and the predetermined risk threshold according to the attack type and the attack fluctuation curve.

2. A method for preventing tampering of website page content according to claim 1, characterized in that: Perform page feature extraction to obtain multiple sets of feature vectors, including: Extracting features of the website page content according to predetermined page features to obtain multiple sets of feature data sets, wherein the predetermined page features include text content, HTML structure, and external resource links; Performing feature vector mapping on the multiple sets of feature data sets to obtain the multiple sets of feature vector sets.

3. A method for preventing tampering of website page content according to claim 2, characterized in that: Using the multivariate anomaly detection channel, the multiple feature vector sets are anomaly identified and multiple feature anomaly degrees are output, including: Performing feature complexity and feature impact analysis on the text content, HTML structure and external resource links respectively, and determining multiple feature complexities and multiple feature impacts; According to the multiple feature complexities and multiple feature influences, the number of detection branches of the abnormality detection unit is configured to obtain the number of content branches, the number of structure branches, and the number of link branches, wherein the number of detection branches is positively correlated with the feature complexity and the feature influence; Based on the BP neural network, a content detection unit, a structure detection unit and a link detection unit are constructed according to the number of content branches, the number of structure branches and the number of link branches; The content detection unit, the structure detection unit and the link detection unit are integrated to generate a multivariate anomaly detection channel, the multiple feature vector sets are input into the multivariate anomaly detection channel, and the multiple feature anomaly degrees are output.

4. A method for preventing tampering of website page content according to claim 3, characterized in that: Based on the BP neural network, a content detection unit is constructed according to the number of content branches, including: Querying the website operation log, collecting a sample content feature data set, and performing feature vector mapping on the sample content feature data set to obtain a sample feature vector set; Perform feature abnormality retrieval based on the sample content feature data set to obtain a sample feature abnormality set; Constructing a sample data set according to the sample feature vector set and the sample feature anomaly degree set, dividing the sample data set into M equal parts, selecting M parts with replacement, constructing a first training set, iterating and selecting M times, and obtaining M training sets, where M is the number of content branches; Based on the BP neural network, construct M content detection branches according to the number of content branches; Taking the sample feature vector as input and the sample feature abnormality as output, the M training sets are used to perform supervised training on the M content detection branches to obtain M convergent content detection branches, and the content detection unit is constructed based on the integration of the M convergent content detection branches, wherein the output of the content detection unit is the mean of the outputs of the M convergent content detection branches.

5. A method for preventing tampering of website page content according to claim 4, characterized in that: Performing feature abnormality retrieval based on the sample content feature data set to obtain a sample feature abnormality set includes: Randomly selecting first sample content feature data from the sample content feature data set; Using the website type and the first sample content feature data as constraints, searching for similar websites based on big data to obtain a first operation record set; The proportion of abnormal records in the first operation record set is counted, set as the first sample feature abnormality, and added to the sample feature abnormality set.

6. A method for preventing tampering of website page content according to claim 1, characterized in that: Determine the attack fluctuation curve, including: Perform attack discreteness analysis based on the risk feature sequence to determine attack discreteness; Inputting the attack discreteness into a discreteness-compensation coefficient comparison table to determine a trend compensation coefficient, wherein the trend compensation coefficient is positively correlated with the attack discreteness; The attack fluctuation curve is compensated and updated according to the trend compensation coefficient.

7. A method for preventing tampering of website page content according to claim 1, characterized in that: Dynamically update the monitoring frequency and the predetermined risk threshold according to the attack type and the attack fluctuation curve, including: Constructing a monitoring parameter correction model, wherein the monitoring parameter correction model includes an input layer, a frequency correction layer, a threshold correction layer and an output layer; Input the attack type and the attack fluctuation curve into the monitoring parameter correction model, and output a frequency correction coefficient and a threshold correction coefficient; The monitoring frequency and the predetermined risk threshold are dynamically adjusted according to the frequency correction coefficient and the threshold correction coefficient.

8. A system for preventing tampering of website page content, characterized in that: For executing the method according to any one of claims 1 to 7, the system comprises: A module for acquiring multiple sets of feature vector sets is used to monitor the content of website pages at fixed points when the website is running, and to extract page features to acquire multiple sets of feature vector sets; A module for acquiring multiple sets of feature vector sets, used to identify anomalies on the multiple sets of feature vector sets using a multivariate anomaly detection channel, and output multiple feature anomaly degrees; A module for acquiring multiple sets of feature vector sets, used to mark page features corresponding to feature abnormality that do not meet a predetermined risk threshold as risk features, and to issue tampering warnings for the risk features; The dynamic update module is used to issue a tampering warning for the risk features, then obtain a risk feature sequence within a predetermined period, perform attack situation awareness based on the risk feature sequence, determine the attack type and attack fluctuation curve, and dynamically update the monitoring frequency and predetermined risk threshold based on the attack type and attack fluctuation curve.

Images