Website detection method, device and equipment and computer storage medium

Abstract

The invention provides a website detection method, device and equipment and a computer storage medium, and the method relates to the technical field of information security, and is used for improving the accuracy of determining whether a website is a risk website or not when the website is detected. The method comprises the following steps: acquiring website data of a to-be-detected website; wherein the website data comprises to-be-displayed data of at least one data type; for the to-be-displayed data corresponding to any data type in the at least one data type, selecting a target processing mode corresponding to the data type of the to-be-displayed data from a preset processing mode set, and performing risk detection on the to-be-displayed data based on the target processing mode to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the to-be-displayed data is risk data; and in combination with the at least one risk detection result corresponding to the at least one data type, obtaining a website detection result of the to-be-detected website.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a website detection method, device and equipment, and a computer storage medium. Background Art

[0002] With the rapid development of information technology, the content contained in cyberspace has become more and more diverse. People can access and watch various contents through websites on the Internet. However, some risky websites are packaged as legitimate websites to induce users to click on links and cause asset losses. Therefore, detection technology for risky websites plays an important role in improving the security of cyberspace and preventing possible asset losses.

[0003] In the related art, the detection method for risky websites is usually: the addresses of risky websites that have been reported and verified are recorded by network operators or security software installed on the terminal. When the website address clicked by the user belongs to the recorded website address, a corresponding security warning prompt is issued or the access request is intercepted.

[0004] However, since risky websites often change their URLs, when record information is not updated in a timely manner, users may still visit risky websites and cause losses.

[0005] Therefore, there is an urgent need for a new website detection method to improve the accuracy of determining whether a website is a risky website when detecting the website. Summary of the invention

[0006] The embodiments of the present application provide a website detection method, apparatus, device and computer storage medium, which are used to improve the accuracy of determining whether a website is a risky website when detecting the website.

[0007] In a first aspect, an embodiment of the present application provides a website detection method, comprising:

[0008] Obtaining website data of a website to be detected; wherein the website data includes data to be displayed of at least one data type;

[0009] For the data to be displayed corresponding to any data type among the at least one data type, a target processing method corresponding to the data type of the data to be displayed is selected from a preset processing method set, and based on the target processing method, risk detection is performed on the data to be displayed to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the data to be displayed is risk data;

[0010] In combination with at least one risk detection result corresponding to the at least one data type, a website detection result of the website to be detected is obtained.

[0011] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0012] Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including:

[0013] Selecting a first processing method corresponding to the URL data from the processing method set as a target processing method;

[0014] Based on the target processing method, the following operations are performed on the URL data in the website data:

[0015] Based on a preset risk website set, the website data is subjected to homology comparison processing to obtain a comparison result corresponding to each associated website included in the website data;

[0016] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved in the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0017] Optionally, when all the obtained comparison results indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, the following operations are performed for each associated URL included in the URL data:

[0018] Based on the preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein the URL feature type includes one or more of the following: Uniform Resource Locator (URL) protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0019] Based on the characteristic information of the associated website and the corresponding relationship between the website characteristic type and the risky website, the probability that the associated website is risk data is obtained, and the probability is recorded in the risk detection result.

[0020] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0021] Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including:

[0022] Selecting a second processing method corresponding to the text data from the processing method set as the target processing method;

[0023] Based on the target processing method, the following operations are performed on the text data in the website data:

[0024] Performing word segmentation processing on the text data to obtain at least one corresponding word segmentation result;

[0025] Based on a preset risk vocabulary set, matching processing is performed on the at least one word segmentation result;

[0026] Based on the matching number corresponding to the word segmentation result that hits the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability of characterizing that the text data is risk data is positively correlated with the matching number.

[0027] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0028] Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including:

[0029] Selecting a third processing method corresponding to the image data from the processing method set as the target processing method;

[0030] Based on the target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0031] The image to be identified is input into a trained image recognition model, and features of the image to be identified are extracted through the image recognition model, and risk image recognition processing is performed based on the acquired image features to obtain corresponding recognition results; wherein the image recognition model is obtained by training after multiple rounds of iterations using risk images in a preset risk image set as training samples;

[0032] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0033] Optionally, obtaining the website detection result of the website to be detected based on the at least one risk detection result obtained includes:

[0034] When there is a risk detection result, using the risk detection result as the website detection result of the website to be detected;

[0035] When there are at least two risk detection results, obtaining preset weight coefficients corresponding to the at least two risk detection results; performing weighted summation on the at least two risk detection results based on the obtained at least two preset weight coefficients to obtain a corresponding risk value;

[0036] Based on the numerical relationship between the risk value and a preset judgment threshold, a website detection result of the website to be detected is obtained.

[0037] In a second aspect, an embodiment of the present application provides a website detection device, including:

[0038] An acquisition module, used to acquire website data of a website to be detected; wherein the website data includes data to be displayed of at least one data type;

[0039] a detection module, configured to select, for the data to be displayed corresponding to any data type among the at least one data type, a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the data to be displayed is risk data;

[0040] The processing module is used to obtain the website detection result of the website to be detected by combining at least one risk detection result corresponding to the at least one data type.

[0041] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0042] The detection module is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and based on the target processing method, perform risk detection on the data to be displayed, and when obtaining the corresponding risk detection result, specifically for:

[0043] Selecting a first processing method corresponding to the URL data from the processing method set as a target processing method;

[0044] Based on the target processing method, the following operations are performed on the URL data in the website data:

[0045] Based on a preset risk website set, the website data is subjected to homology comparison processing to obtain a comparison result corresponding to each associated website included in the website data;

[0046] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved in the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0047] The detection module is further configured to: when all the comparison results obtained indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, perform the following operations for each associated URL included in the URL data:

[0048] Based on the preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein the URL feature type includes one or more of the following: uniform resource locator URL protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0049] Based on the characteristic information of the associated website and the corresponding relationship between the website characteristic type and the risky website, the probability that the associated website is risk data is obtained, and the probability is recorded in the risk detection result.

[0050] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0051] The detection module is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and based on the target processing method, perform risk detection on the data to be displayed, and when obtaining the corresponding risk detection result, specifically for:

[0052] Selecting a second processing method corresponding to the text data from the processing method set as the target processing method;

[0053] Based on the target processing method, the following operations are performed on the text data in the website data:

[0054] Performing word segmentation processing on the text data to obtain at least one corresponding word segmentation result;

[0055] Based on a preset risk vocabulary set, matching processing is performed on the at least one word segmentation result;

[0056] Based on the matching number corresponding to the word segmentation result that hits the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability of characterizing that the text data is risk data is positively correlated with the matching number.

[0057] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0058] The detection module is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and based on the target processing method, perform risk detection on the data to be displayed, and when obtaining the corresponding risk detection result, specifically for:

[0059] Selecting a third processing method corresponding to the image data from the processing method set as the target processing method;

[0060] Based on the target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0061] The image to be identified is input into a trained image recognition model, and features of the image to be identified are extracted through the image recognition model, and risk image recognition processing is performed based on the acquired image features to obtain corresponding recognition results; wherein the image recognition model is obtained by training after multiple rounds of iterations using risk images in a preset risk image set as training samples;

[0062] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0063] Optionally, when the processing module is used to obtain the website detection result of the website to be detected based on the at least one risk detection result obtained, it is specifically used to:

[0064] When there is a risk detection result, using the risk detection result as the website detection result of the website to be detected;

[0065] When there are at least two risk detection results, obtaining preset weight coefficients corresponding to the at least two risk detection results; performing weighted summation on the at least two risk detection results based on the obtained at least two preset weight coefficients to obtain a corresponding risk value;

[0066] Based on the numerical relationship between the risk value and a preset judgment threshold, a website detection result of the website to be detected is obtained.

[0067] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method described in the first aspect or any optional embodiment of the first aspect.

[0068] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0069] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method described in the first aspect or any optional implementation of the first aspect.

[0070] The beneficial effects of this application are as follows:

[0071] In this solution, the data type of the website data contained in the website to be detected is used to select the corresponding processing method, so that risk detection can be performed on the data to be displayed in the website data based on different processing methods, and a targeted risk detection method is provided, thereby improving the accuracy of risk detection for different data. In addition, risk detection is directly performed on the data contained in the website to be detected, and the website data is used as the basis for judgment, which improves the pertinence and personalization of risk detection and improves the accuracy of risk detection for the website to be detected.

[0072] On the other hand, after conducting risk detection on data to be displayed of different data types, the risk level of the website to be detected is determined based on the risk detection results, and risk detection is performed on the website to be detected from multiple aspects and dimensions, further improving the accuracy of risk detection on the website to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0074] Figure 1 A schematic diagram of possible application scenarios provided for embodiments of the present application;

[0075] Figure 2A flowchart of a method for website detection provided in an embodiment of the present application;

[0076] Figure 3 A schematic diagram of a website page to be detected provided in an embodiment of the present application;

[0077] Figure 4 A flowchart of a method for performing risk detection on website data provided in an embodiment of the present application;

[0078] Figure 5 A flowchart of another method for performing risk detection on website data provided in an embodiment of the present application;

[0079] Figure 6 A flowchart of a method for performing risk detection on text data provided in an embodiment of the present application;

[0080] Figure 7 A logical schematic diagram of a method for performing risk detection on text data provided in an embodiment of the present application;

[0081] Figure 8 A flowchart of a method for performing risk detection on image data provided in an embodiment of the present application;

[0082] Fig. 9 A logical schematic diagram of a website detection method provided in an embodiment of the present application;

[0083] Fig.10 A schematic diagram of the structure of a website detection device provided in an embodiment of the present application;

[0084] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0086] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0087] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0088] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0089] With the rapid development of information technology, the content contained in cyberspace has become more and more diverse. People can access and watch various contents through websites on the Internet. However, some risky websites are packaged as legitimate websites to induce users to click on links and cause asset losses. Therefore, detection technology for risky websites plays an important role in improving the security of cyberspace and preventing possible asset losses.

[0090] In the related art, the detection method for risky websites is usually: the addresses of risky websites that have been reported and verified are recorded by network operators or security software installed on the terminal. When the website address clicked by the user belongs to the recorded website address, a corresponding security warning prompt is issued or the access request is intercepted.

[0091] However, since risky websites often change their URLs, when record information is not updated in a timely manner, users may still visit risky websites and cause losses.

[0092] In view of this, an embodiment of the present application proposes a website detection method, which performs corresponding risk detection processing on each type of data included in the website to be detected, thereby obtaining a website detection result for the website to be detected.

[0093] Specifically, when performing website detection on a website to be detected, firstly, data to be displayed of at least one data type contained in the website to be detected is obtained, and these data types include one or more of URL data, text data, and image data.

[0094] For at least one data type, any data type corresponding to the data to be displayed can select a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and perform risk detection on the data to be displayed based on the corresponding target processing method, thereby obtaining corresponding risk detection results to characterize the probability that the data to be displayed is risk data. In this way, by performing corresponding risk detection on different data types with different processing methods, the risk levels of different data to be displayed in the detected website can be obtained.

[0095] Finally, after performing risk detection on the acquired website data, the website detection result of the website to be detected can be obtained by combining at least one risk detection result corresponding to at least one acquired data type. In this way, it is not necessary to only compare the URL of the website to be detected, but to perform risk detection processing on the data to be displayed in the website to be detected, and then obtain the website detection result for the website to be detected, and determine whether the website to be detected is a risky website.

[0096] After completing the introduction of the main inventive ideas of the embodiments of the present application, the specific implementation of the website detection method proposed in the embodiments of the present application will be introduced below through some specific embodiments and drawings.

[0097] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0098] See also Figure 1 , which is a schematic diagram of a possible application scenario provided in an embodiment of the present application. In this scenario, a terminal device 101 and a server 102 may be included.

[0099] The terminal device 101 may be a mobile phone, a tablet computer (PAD), a personal computer (PC), a wearable device, a vehicle-mounted terminal, etc. The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0100] The terminal device 101 and the server 102 may be directly or indirectly connected to each other through one or more communication networks 103. The communication network 103 may be a wired network or a wireless network, for example, a mobile cellular network or a wireless fidelity (Wireless-Fidelity, WIFI) network, or other possible networks, which are not limited in the embodiment of the present invention.

[0101] It should be noted that the website detection method in the embodiment of the present application can be executed by a computer device, which can be a terminal device 101 or a server 102. For example, when the website detection method is executed by the server 102, when a user accesses a website through a terminal device, the server can use the website as a website to be detected, obtain the website data contained therein, and then select the target processing method corresponding to the data type to be displayed from the preset processing method set for the data to be displayed in the website data corresponding to any data type in at least one data type, and perform risk detection on the data to be displayed, thereby obtaining the corresponding risk detection result. Finally, the server can combine the risk detection results of the data to be displayed of different data types to obtain the website detection result corresponding to the website to be detected. In this way, the server can detect the website to be detected based on the website data contained in the website to be detected, and can make targeted judgments based on the actual content of the website, thereby improving the accuracy of risk detection of the website to be detected.

[0102] It should be noted that Figure 1 What is shown is just an example. In fact, the number and communication mode of terminal devices and servers are not limited and are not specifically limited in the embodiments of the present application.

[0103] On the other hand, the website detection method provided by the embodiment of the present application can be applied to a variety of website detection scenarios. For example, the method can be applied to the scenario of risk website detection during enterprise work. Specifically, any enterprise needs the Internet to carry out daily work, and in the current environment where security incidents occur frequently, users' clicks on risky websites may bring security risks to both individuals and enterprises. Using the website detection method provided by the present application, it is possible to continuously monitor websites, identify and prevent actions to access risky websites, and detect and block them in real time.

[0104] The following describes the website detection method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0105] See also Figure 2 , which is a flow chart of a website detection method provided in an embodiment of the present application. The execution subject of the method may be as follows Figure 1 The terminal device or server shown in the figure is not limited in this application. In order to make the introduction of the solution clearer and more detailed, the following will take the execution subject as an example to introduce the method provided in the embodiment of the present application. Specifically, the method execution steps are as follows:

[0106] Step S201: Obtain website data of the website to be detected.

[0107] Before executing this step, the server first needs to obtain the website to be detected that needs to be detected. The acquisition of the website to be detected can be that the server automatically obtains the corresponding website link for the website to be jumped to when the user visits different websites, or when the user expects to detect a certain website, the user actively enters the website link address into the detection interface provided by the server. This application does not impose any restrictions on this.

[0108] Regardless of which method is used, after the server obtains the website to be detected, it is necessary to obtain the website data contained in the website to be detected.

[0109] Specifically, for website data, it includes data to be displayed of at least one data type, including one or more of website data, text data, and image data.

[0110] Among them, the URL data refers to the URL data associated with the website to be detected. For example, for some websites, some links may be hidden. When the user clicks on the text or picture in the website, it will jump to the page of other websites. Therefore, this part of the URL link hidden in the website is the URL data associated with the website to be detected.

[0111] Text data refers to the text content contained in the page displayed to the user by the website to be tested, which may include text data in the page, text data in pictures or videos, and text data corresponding to the voice in the video converted into text.

[0112] Image data refers to the image content contained in the page displayed to the user by the website to be tested. It can be the image content directly displayed in the page, or the image content of each frame in the video or dynamic image contained in the page.

[0113] When the server obtains the website data of the website to be detected, it can obtain one or more types of data to be displayed among the above different data types according to the preset configuration information or the content included in the website to be detected.

[0114] For example, when there is only text content in the website to be detected, the server can only obtain the corresponding text data when obtaining the website data of the website to be detected, so the website data only contains one type of data to be displayed. Figure 3 As shown, when text, images, and associated URLs are included, the server can obtain data to be displayed that includes multiple data types when obtaining website data.

[0115] When obtaining the website data of the website to be detected, the server can utilize a parsing tool for the website page to parse the web page content and extract the corresponding website link as the URL data.

[0116] After the server obtains the website data of the website to be detected, it can continue to perform the following operations:

[0117] Step S202: For the data to be displayed corresponding to any data type in at least one data type, a target processing method corresponding to the data type with the display data is selected from a preset processing method set, and based on the target processing method, risk detection is performed on the data to be displayed to obtain a corresponding risk detection result.

[0118] The risk detection result represents the probability that the data to be displayed is risky data.

[0119] After the server obtains the website data, for at least one type of data in the website data, the server needs to select a corresponding processing method and perform risk detection on it respectively.

[0120] Specifically, a processing method set is preset in the server, and the processing method set may include at least one processing method, and each processing method corresponds to a different data type.

[0121] The server needs to select a target processing method corresponding to the data type according to the data type contained in the acquired website data, and perform risk detection on the data to be displayed based on the corresponding relationship, so as to obtain the corresponding risk detection results.

[0122] For the data of different data types to be displayed in the website data, after the server selects the corresponding processing method, the method adopted when performing risk detection processing on it can be carried out in the following way.

[0123] In a possible implementation, when the data type included in the website data includes URL data associated with the website to be detected, the server may adopt the following method when performing risk detection processing on the URL data:

[0124] See also Figure 4 , which is a flow chart of a method for performing risk detection on website data provided in an embodiment of the present application, such as Figure 4 As shown, the specific implementation steps of this method are as follows:

[0125] Step S401: Selecting a first processing method corresponding to the URL data from a preset processing method set as a target processing method.

[0126] The preset processing method set includes multiple processing methods, among which the processing method for risk detection on URL data corresponds to the first processing method.

[0127] Specifically, after obtaining the first processing method, the server can use it as the target processing method and perform the following operations on the URL data in the obtained website data:

[0128] Step S402: Based on a preset risky website set, perform homology comparison processing on the website data to obtain a comparison result corresponding to each associated website included in the website data.

[0129] First of all, it should be noted that homologous web addresses (or "homogeneous URLs") refer to web page addresses with the same protocol, domain name, and port number. Specifically, if two URLs have the same protocol (such as http or https), domain name (or host name, such as www.example.com), and port number (such as 80 or 443), then the two URLs are considered to be homologous. For example, the URL http: / / www.example.com / d / p.html has the following homologous URLs:

[0130] http: / / www.example.com / d2 / other.html;

[0131] http: / / www.example.com / d / in / a.html;

[0132] The two URLs in the above examples are homologous to the first URL because they only have different paths, but the other protocols, domain names and ports are the same. Therefore, these three URLs are homologous URLs.

[0133] After understanding the concept of the same-source website or same-source URL, the following will continue to introduce step S402.

[0134] When the server obtains the URL data and then processes the URL data using the first processing method, the server can perform homology comparison processing on the URL data based on a preset risk URL set to obtain a comparison result corresponding to each associated URL in the URL data. The comparison result is used to indicate whether the corresponding associated URL is a homology URL of any risk URL in the risk URL set.

[0135] Among them, the risky URL set is a collection of risky URLs preset in the server. The URLs included in the set are all URL links that have been determined to be risky URLs. The sources of these URL links can be public URL resources or they can be continuously recorded by the server after determining them as risky URLs during the execution of the risk detection method. This application does not impose any restrictions on this.

[0136] The process of performing homology comparison on URL data may be performed in a variety of different ways.

[0137] Exemplarily, the server may directly obtain information such as the protocol, domain name, port, etc. of each associated URL in the URL data, and compare the information with the risky URLs in the risky URL set.

[0138] For another example, the server can also classify the associated URLs through a pre-trained homology identification model to determine whether they are homology URLs of any risk URL in the risk URL set. Among them, when using the trained model to judge the URL data, the domain name system (Power Domain Name System, PDNS) log can be used in advance to construct training samples. The PDNS log usually refers to the log records generated by the PowerDNS server when processing DNS query requests and responses. These logs contain detailed information about DNS queries, such as the queried domain name, query type, query source IP, etc. In this way, using the PDNS log, the server can construct training samples containing domain names, types, real labels, etc., and then use these training samples to train the homology identification model based on the decision tree algorithm. In this way, after multiple rounds of iterative training to obtain a homology identification model that meets the requirements, the model can be used to classify and identify each associated URL in the website data to determine whether it is a homology URL of the risk URL in the risk URL set.

[0139] Step S403: When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved in the risk URL set, and based on the comparison result, a risk detection result is obtained to ensure that the URL data has risks.

[0140] For the comparison result obtained by the server, a corresponding comparison result is obtained for each associated URL in the URL data, and the comparison result is used to indicate whether the associated URL is a homologous URL of the risk URL in the risk URL set.

[0141] When the comparison results show that the associated URL is the same source URL as the risk URL in the risk URL set, the server can save the corresponding associated URL into the risk URL set to expand the content of the risk URL set and provide a more sufficient data basis for subsequent URL detection.

[0142] At the same time, the server will also obtain the risk detection result for the URL data based on the comparison result. Optionally, the risk detection result may include a result indicating whether the URL data is risk data, and may also include a probability indicating whether the URL data is risk data, wherein the value indicating the probability of the URL data being risk data is positively correlated with the number of associated URLs in the URL data that are the same source URLs as the risk URLs.

[0143] In this way, by performing homology comparison with risk URLs in the risk URL set, the correlation between homology URLs is utilized to perform risk detection on URL data, thereby improving the accuracy of risk URL identification. At the same time, the identified risk URLs are recorded in the risk URL set, providing sufficient data basis for subsequent risk detection of URLs, further improving the accuracy of risk detection while also improving the efficiency of risk detection.

[0144] In a possible implementation, when the comparison results of the homology comparison for the URL data all indicate that the associated URL is not a homology URL of any risk URL in the risk URL set, the server may further perform the following risk detection operations on the URL data:

[0145] Specifically, for each associated URL included in the URL data, the server may perform the following operations respectively:

[0146] See also Figure 5 , which is a flow chart of another method for performing risk detection on website data provided by an embodiment of the present application, such as Figure 5 As shown, the specific implementation steps of this method are as follows:

[0147] Step S501: based on the preset URL feature types, extracting feature information corresponding to each URL feature type from the associated URLs;

[0148] Among them, the URL feature type includes one or more of the following: URL protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, historical vulnerabilities, etc.

[0149] When the server detects an associated URL, it can extract the corresponding feature information based on the above-mentioned preset URL feature type. For example, when extracting feature information from an associated URL, it can extract the protocol, domain name length, domain name level, port, special characters, etc. corresponding to the associated URL.

[0150] Step S502: Based on the characteristic information of the associated website, and the correspondence between the website characteristic type and the risky website, the probability that the associated website is risk data is obtained, and the probability is recorded in the risk detection result.

[0151] After the server obtains the characteristic information of the associated URL, the server can obtain the probability that the associated URL is a risky URL based on the correspondence between the URL characteristic type and the risky URL.

[0152] Exemplarily, the server can use a risk classification model that has been pre-trained using a naive Bayes algorithm to classify the feature information, identify the feature information based on the relationship between the various URL feature types stored in the model and the category of risky URLs, and determine the probability that the associated URL corresponding to the feature information is a risky URL.

[0153] In the process of training the risk classification model, URLs in the risk URL set and some general normal URLs can be used to jointly construct training samples, and then these training samples are used to perform multiple rounds of iterative training on the risk classification model.

[0154] After obtaining the probability that the associated URL is a risky URL, the server can record the probability corresponding to the associated URL in the risk detection result. Then, after completing the detection of all associated URLs, the risk detection result can record the probability corresponding to all associated URLs. In this way, after integrating all probability values, the server can obtain the probability that the URL data is risk data by weighted summation, and further, when the probability exceeds a preset threshold, the server can determine that the URL data is risk data.

[0155] In this way, when there is no homologous URL in the risk URL set in the URL data, the server can directly detect the characteristics of the associated URLs, classify and identify them, determine whether the associated URLs are risk data, and then determine the risk detection results of the URL data based on the risk identification results of all associated URLs. In this way, the risk level of the URL is judged by using the characteristics of the URL itself, further improving the accuracy of risk website detection.

[0156] The above introduces the method of risk detection for URL data. The following will continue to introduce the method of risk detection for text data and image data.

[0157] In a possible implementation, when the data type included in the website data includes text data included in the website to be detected, the server may adopt the following method when performing risk detection processing on the text data:

[0158] See also Figure 6 , which is a flow chart of a method for performing risk detection on text data provided in an embodiment of the present application, such as Figure 6 As shown, the specific implementation steps of this method are as follows:

[0159] Step S601: Selecting a second processing method corresponding to the text data from a preset processing method set as a target processing method.

[0160] After the server selects the second processing method from the processing method set, it can use it as the target processing method and perform the following operations on the text data in the acquired website data:

[0161] Step S602: Perform word segmentation processing on the text data to obtain at least one corresponding word segmentation result.

[0162] After the server obtains the text data, it needs to perform word segmentation on the text data. When performing word segmentation on the text data, the server can use a dictionary matching method, a statistical probability method, or a machine learning method to perform word segmentation on the text data, and then obtain at least one corresponding word segmentation result.

[0163] Step S603: Based on a preset risk vocabulary set, matching processing is performed on at least one word segmentation result.

[0164] like Figure 7 As shown, a risk vocabulary set is preset in the server, and these risk vocabulary sets include some risky words.

[0165] When matching the word segmentation results based on the risk vocabulary set, the server can sort the words in the risk vocabulary set, generate a corresponding risk word search tree, and then use a deterministic finite automaton (DFA) algorithm to match the word segmentation results one by one, and then determine whether each word segmentation result will hit any risk word in the risk vocabulary set.

[0166] Step S604: based on the matching number corresponding to the word segmentation result of the hit risk vocabulary set, the risk detection result corresponding to the text data is obtained.

[0167] After the server performs matching processing on each word segmentation result, the server can obtain the number of matches corresponding to the word segmentation result that hits the risk vocabulary set. Based on the number of matches, the server can obtain the risk detection result corresponding to the text data, wherein the probability of representing the text data as risk data in the risk detection result is positively correlated with the number of matches, and when the probability exceeds a preset threshold, the server can determine that the text data is risk data.

[0168] In this method, the server uses a preset second processing method to perform corresponding risk detection on the text data in the website data, obtains the number of matches of at least one risk word in the risk vocabulary set in the text data, and determines the probability that the text data is risk data based on the number of matches, thereby improving the accuracy of risk detection for the website.

[0169] In a possible implementation, when the data type included in the website data includes image data included in the website to be detected, the server may adopt the following method when performing risk detection processing on the image data:

[0170] See also Figure 8 , is a flow chart of a method for performing risk detection on image data provided in an embodiment of the present application, such as Figure 8 As shown, the specific implementation steps of this method are as follows:

[0171] Step S801: Selecting a third processing method corresponding to the image data from a preset processing method set as a target processing method.

[0172] After the server selects the third processing method from the processing method set, it can use it as the target processing method and perform the following operations on each image to be identified in the image data obtained from the website data:

[0173] Step S802: Input the image to be identified into the trained image recognition model, extract features of the image to be identified through the image recognition model, and perform risk image recognition processing based on the acquired image features to obtain corresponding recognition results.

[0174] Among them, the image recognition model is obtained by training through multiple rounds of iterations using risk images in a preset risk image set as training samples.

[0175] For the preset risk image set, the image data contained therein may be image data acquired from a public data source, or may be image data generated based on a content generation model, and this application does not impose any restrictions on this.

[0176] As for the risk URL set, risk vocabulary set, and risk image set mentioned above, they can all be pre-set in the server's database as a data set in the threat intelligence library for use by the server when executing the risk detection method for the website.

[0177] Optionally, when the server obtains image data from the website to be detected, it can perform extraction operations on all the images therein, and then continue to perform size transformation and noise reduction processing to obtain relatively standardized images to be identified, and then perform risk detection on each image to be identified.

[0178] Furthermore, when performing risk detection on each image to be identified, the server can first use the risk images in the risk image set as training samples, perform multiple rounds of iterative training on the convolutional neural network to obtain an image recognition model, and then input the image to be identified into the image recognition model, use the image recognition model to extract features of the image to be identified, and perform risk image recognition processing based on the acquired image features to obtain corresponding recognition results.

[0179] When the image recognition model identifies the image to be identified, it will output the corresponding risk probability and non-risk probability. The server can determine whether the image to be identified is a risk image based on the corresponding probability value, and use the judgment result as the corresponding recognition result.

[0180] Step S803: Record the recognition result corresponding to the image to be recognized in the risk detection result.

[0181] After obtaining the recognition result of the image to be recognized, the server can record the corresponding recognition result in the risk detection result.

[0182] In this way, when all the images to be identified have completed the risk detection process, the risk detection result includes the identification results of all the images to be identified.

[0183] The server can use the recognition result of the image to be recognized in the risk detection result to determine the number of risk images in the website to be detected, and based on the number of risk images, judge the risk level of the image data and the probability that the image data is risk data.

[0184] In this method, the server uses a pre-trained image recognition model to perform risk detection on the image data in the website to be detected, determines whether each image to be identified is a risky image, and then uses the number of risk images to determine the risk level of the image data. The risk level of the website is judged based on the data to be displayed in the website to be detected, thereby further improving the accuracy of risk detection for the website.

[0185] The above respectively introduces the methods for risk detection for URL data, text data, and image data. However, it should be noted that after the server obtains the website data, the server can select an appropriate processing method to perform risk detection on the website data according to the data type contained in the website data. For example, when the website data includes the above three data types, the server needs to perform risk detection on the data to be displayed corresponding to the three data types based on the three preset processing methods, and then obtain the corresponding risk detection results.

[0186] Therefore, after the server performs risk detection on the website data, it can continue to perform the following operations:

[0187] Step S203: Acquire a website detection result of the website to be detected in combination with at least one risk detection result corresponding to at least one data type.

[0188] After the server performs risk detection on the website data and obtains at least one corresponding risk detection result, the server can obtain a corresponding website detection result for the website to be detected in combination with the at least one risk detection result.

[0189] For example, in a possible implementation, the server adopts different processing methods according to different numbers of risk detection results, namely:

[0190] When there is a risk detection result, the server can directly use the risk detection result as the website detection result of the website to be detected.

[0191] When there are at least two risk detection results, the server needs to obtain the preset weight coefficients corresponding to the at least two risk detection results; then, based on the at least two preset weight coefficients obtained, the server performs weighted summation on the at least two risk detection results to obtain the corresponding risk value; finally, based on the numerical relationship between the risk value and the preset judgment threshold, the server obtains the website detection result of the website to be detected.

[0192] Exemplarily, the above content is explained by taking the existence of three risk detection results as an example. When there are risk detection results corresponding to three data types, the server first needs to obtain the preset weight system corresponding to the three risk detection results, and then based on these preset weight coefficients, perform weighted summation on the three risk detection results to obtain the corresponding risk value. Finally, based on the numerical relationship between the risk value and the preset judgment threshold, when the risk value is greater than or equal to the judgment threshold, the server can determine that the website to be detected is a risky website, and when the risk value is less than the judgment threshold, the server can determine that the website to be detected is a non-risky website.

[0193] For example, assuming that in the three risk detection results, the probability that the corresponding data to be displayed is risky data is represented by the value of the corresponding detection score, then after the server performs risk detection on a website to be detected, it will obtain three detection scores, and these three detection scores are recorded as sDT, sDFA, and sCNN respectively.

[0194] Then the corresponding preset weight coefficients obtained by the server can be recorded as: wDT, wDFA, wCNN, respectively. These three preset weight coefficients represent the relative importance of each risk detection result in the final judgment. The specific values ​​of these preset weight coefficients can be determined according to the historical performance, accuracy, recall rate and other indicators of different processing methods. This application does not limit this. Optionally, in a possible implementation, the user can preset thresholds for limiting different preset weight coefficients, and set the preset weight coefficient corresponding to the first processing method to the maximum value of the three preset weight coefficients, so as to emphasize the importance of risk detection for URL data.

[0195] Finally, the server obtains the final risk value in a weighted and normalized manner using the following formula 1:

[0196]

[0197] Specifically, as shown in Formula 1, the score corresponding to each treatment method is multiplied by its corresponding weight, and then the weighted scores are added together. Then, the total is divided by the sum of all weights to obtain a standardized score as the corresponding risk value.

[0198] In this solution, the data type of the website data contained in the website to be detected is used to select the corresponding processing method, so that risk detection can be performed on the data to be displayed in the website data based on different processing methods, and a targeted risk detection method is provided, thereby improving the accuracy of risk detection for different data. In addition, risk detection is directly performed on the data contained in the website to be detected, and the website data is used as the basis for judgment, which improves the pertinence and personalization of risk detection and improves the accuracy of risk detection for the website to be detected.

[0199] On the other hand, after conducting risk detection on data to be displayed of different data types, the risk level of the website to be detected is determined based on the risk detection results, and risk detection is performed on the website to be detected from multiple aspects and dimensions, further improving the accuracy of risk detection on the website to be detected.

[0200] The above describes a website detection method and various possible implementation methods provided by the embodiments of the present application. In order to facilitate an overall understanding of the solution, the following will combine Fig. 9 , and give an overall introduction to the program.

[0201] like Fig. 9 As shown, when performing the website detection method for a website to be detected, it is first necessary to obtain the link address of the website to be detected, and then obtain the website data contained in the website to be detected; wherein the website data includes: URL data, text data and image data.

[0202] After obtaining this data, the server can select the corresponding processing method from the preset processing method set and process it in combination with the preset threat intelligence library. The URL data can be processed for homology comparison and link risk detection, the text data can be processed for text matching, and the image data can be processed for image recognition. These processing methods can be unified as risk detection processing.

[0203] After obtaining the risk detection results for each type of data, the server can combine these risk detection results to obtain website detection results for the website to be detected, where the website detection results include: a result characterizing whether the website to be detected is a risky website, and a confidence score result corresponding to the result.

[0204] Based on the same inventive concept, an embodiment of the present application also provides a website detection device.

[0205] See also Fig.10 , is a structural schematic diagram of a website detection device provided in an embodiment of the present application. The device can be the above-mentioned server or a chip or integrated circuit in the device, etc. The device includes a module / unit / technical means for executing the method executed by the server in the above-mentioned method embodiment.

[0206] Exemplarily, the device 1000 includes:

[0207] The acquisition module 1001 is used to acquire website data of the website to be detected; wherein the website data includes data to be displayed of at least one data type;

[0208] The detection module 1002 is used to select, for the data to be displayed corresponding to any data type in the at least one data type, a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the data to be displayed is risk data;

[0209] The processing module 1003 is used to obtain the website detection result of the website to be detected in combination with at least one risk detection result corresponding to the at least one data type.

[0210] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0211] The detection module 1002 is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method. When obtaining the corresponding risk detection result, it is specifically used to:

[0212] Selecting a first processing method corresponding to the URL data from the processing method set as a target processing method;

[0213] Based on the target processing method, the following operations are performed on the URL data in the website data:

[0214] Based on a preset risk website set, the website data is subjected to homology comparison processing to obtain a comparison result corresponding to each associated website included in the website data;

[0215] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved in the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0216] The detection module 1002 is further configured to: when all the comparison results obtained indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, perform the following operations for each associated URL included in the URL data:

[0217] Based on the preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein the URL feature type includes one or more of the following: uniform resource locator URL protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0218] Based on the characteristic information of the associated website and the corresponding relationship between the website characteristic type and the risky website, the probability that the associated website is risk data is obtained, and the probability is recorded in the risk detection result.

[0219] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0220] The detection module 1002 is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method. When obtaining the corresponding risk detection result, it is specifically used to:

[0221] Selecting a second processing method corresponding to the text data from the processing method set as the target processing method;

[0222] Based on the target processing method, the following operations are performed on the text data in the website data:

[0223] Performing word segmentation processing on the text data to obtain at least one corresponding word segmentation result;

[0224] Based on a preset risk vocabulary set, matching processing is performed on the at least one word segmentation result;

[0225] Based on the matching number corresponding to the word segmentation result that hits the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability of characterizing that the text data is risk data is positively correlated with the matching number.

[0226] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0227] The detection module 1002 is used to select a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method. When obtaining the corresponding risk detection result, it is specifically used to:

[0228] Selecting a third processing method corresponding to the image data from the processing method set as the target processing method;

[0229] Based on the target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0230] The image to be identified is input into a trained image recognition model, and features of the image to be identified are extracted through the image recognition model, and risk image recognition processing is performed based on the acquired image features to obtain corresponding recognition results; wherein the image recognition model is obtained by training after multiple rounds of iterations using risk images in a preset risk image set as training samples;

[0231] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0232] Optionally, when the processing module 1003 is used to obtain the website detection result of the website to be detected based on the at least one risk detection result obtained, it is specifically used to:

[0233] When there is a risk detection result, using the risk detection result as the website detection result of the website to be detected;

[0234] When there are at least two risk detection results, obtaining preset weight coefficients corresponding to the at least two risk detection results; performing weighted summation on the at least two risk detection results based on the obtained at least two preset weight coefficients to obtain a corresponding risk value;

[0235] Based on the numerical relationship between the risk value and a preset judgment threshold, a website detection result of the website to be detected is obtained.

[0236] As an example, Fig.10 The apparatus described can be used to perform Figure 2 Therefore, for the functions that can be realized by each functional module of the device, reference can be made to Figure 2 The description of the illustrated embodiment will not be repeated here.

[0237] It should be noted that, although several modules or submodules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0238] As a possible product form of the above device, see Fig.11 The embodiment of the present application further provides an electronic device 1100, including:

[0239] At least one processor 1101; and a communication interface 1103 communicatively connected to the at least one processor 1101; the at least one processor 1101 executes instructions stored in the memory 1102, so that the electronic device 1100 executes the method steps performed by any device in the above method embodiments through the communication interface 1103.

[0240] Optionally, the memory 1102 is located outside the electronic device 1100 .

[0241] Optionally, the electronic device 1100 includes the memory 1102, the memory 1102 is connected to the at least one processor 1101, and the memory 1102 stores instructions that can be executed by the at least one processor 1101. Fig.11 The dashed lines indicate that the memory 1102 is optional for the electronic device 1100 .

[0242] The processor 1101 and the memory 1102 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0243] The specific connection medium between the processor 1101, the memory 1102 and the communication interface 1103 is not limited in the embodiment of the present application. Fig.11 In the embodiment, the processor 1101, the memory 1102 and the communication interface 1103 are connected via a bus 1104. Fig.11 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0244] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0245] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0246] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0247] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0248] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.

[0249] As another possible product form, an embodiment of the present application also provides a computer program product including instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method steps executed by any device in the above method embodiment.

[0250] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0251] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0252] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0253] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0254] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A website detection method, characterized in that: include: Obtaining website data of a website to be detected; wherein the website data includes data to be displayed of at least one data type; For the data to be displayed corresponding to any data type among the at least one data type, a target processing method corresponding to the data type of the data to be displayed is selected from a preset processing method set, and based on the target processing method, risk detection is performed on the data to be displayed to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the data to be displayed is risk data; In combination with at least one risk detection result corresponding to the at least one data type, a website detection result of the website to be detected is obtained.

2. The method according to claim 1, characterized in that The at least one data type includes: URL data associated with the website to be detected; Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including: Selecting a first processing method corresponding to the URL data from the processing method set as a target processing method; Based on the target processing method, the following operations are performed on the URL data in the website data: Based on a preset risk website set, the website data is subjected to homology comparison processing to obtain a comparison result corresponding to each associated website included in the website data; When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved in the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

3. The method according to claim 2, characterized in that The method further comprises: When all the comparison results obtained indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, the following operations are performed for each associated URL included in the URL data: Based on the preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein the URL feature type includes one or more of the following: uniform resource locator URL protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities; Based on the characteristic information of the associated website and the corresponding relationship between the website characteristic type and the risky website, the probability that the associated website is risk data is obtained, and the probability is recorded in the risk detection result.

4. The method according to claim 1, characterized in that The at least one data type includes: text data contained in the website to be detected; Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including: Selecting a second processing method corresponding to the text data from the processing method set as the target processing method; Based on the target processing method, the following operations are performed on the text data in the website data: Performing word segmentation processing on the text data to obtain at least one corresponding word segmentation result; Based on a preset risk vocabulary set, matching processing is performed on the at least one word segmentation result; Based on the matching number corresponding to the word segmentation result that hits the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability of characterizing that the text data is risk data is positively correlated with the matching number.

5. The method according to claim 1, characterized in that The at least one data type includes: image data contained in the website to be detected; Then, selecting a target processing method corresponding to the data type of the data to be displayed from the preset processing method set, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result, including: Selecting a third processing method corresponding to the image data from the processing method set as the target processing method; Based on the target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively: The image to be identified is input into a trained image recognition model, and features of the image to be identified are extracted through the image recognition model, and risk image recognition processing is performed based on the acquired image features to obtain corresponding recognition results; wherein the image recognition model is obtained by training after multiple rounds of iterations using risk images in a preset risk image set as training samples; The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining, based on the at least one risk detection result obtained, a website detection result of the website to be detected, includes: When there is a risk detection result, using the risk detection result as the website detection result of the website to be detected; When there are at least two risk detection results, obtaining preset weight coefficients corresponding to the at least two risk detection results; performing weighted summation on the at least two risk detection results based on the obtained at least two preset weight coefficients to obtain a corresponding risk value; Based on the numerical relationship between the risk value and a preset judgment threshold, a website detection result of the website to be detected is obtained.

7. A device for website detection, characterized in that: include: An acquisition module, used to acquire website data of a website to be detected; wherein the website data includes data to be displayed of at least one data type; a detection module, configured to select, for the data to be displayed corresponding to any data type among the at least one data type, a target processing method corresponding to the data type of the data to be displayed from a preset processing method set, and perform risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein the risk detection result represents the probability that the data to be displayed is risk data; The processing module is used to obtain the website detection result of the website to be detected by combining at least one risk detection result corresponding to the at least one data type.

8. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 5 by executing the instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising instructions, characterized in that The computer program product stores instructions, and when the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

Images