A website detection method, apparatus, device, and computer storage medium

Abstract

This application provides a website detection method, apparatus, device, and computer storage medium. The method relates to the field of information security technology and aims to improve the accuracy of determining whether a website is a risky website during detection. The method includes: acquiring website data of the website to be detected; wherein the website data contains data of at least one data type to be displayed; for the data to be displayed corresponding to any data type among the at least one data type, selecting a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and performing risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein the risk detection result characterizes the probability that the data to be displayed is risky data; and combining at least one risk detection result corresponding to at least one data type to obtain a website detection result for the website to be detected.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to a website detection method, apparatus, device, and computer storage medium. Background Technology

[0002] With the rapid development of information technology, the content contained in cyberspace has become increasingly diverse, and people can access and view various content through websites on the Internet. However, some risky websites are disguised as legitimate websites, enticing users to click on links and causing financial losses. Therefore, detection technologies for risky websites play a crucial role in improving cyberspace security and protecting against potential asset losses.

[0003] In related technologies, the detection method for risky websites is usually as follows: the network operator or security software installed on the terminal records the addresses of the reported and verified risky websites. When the website address clicked by the user belongs to the recorded website address, a corresponding security warning is issued or the access request is blocked.

[0004] However, because risky websites frequently change their URLs, users may still visit these websites and suffer losses if the recorded information is not updated in a timely manner.

[0005] Therefore, there is an urgent need for a new website detection method to improve the accuracy of determining whether a website is a risky website when conducting website detection. Summary of the Invention

[0006] This application provides a website detection method, apparatus, device, and computer storage medium to improve the accuracy of determining whether a website is a risky website when detecting websites.

[0007] In a first aspect, embodiments of this application provide a website detection method, including:

[0008] Obtain website data of the website to be tested; wherein, the website data includes data of at least one data type to be displayed;

[0009] For any data type among the at least one data type, a target processing method corresponding to the data type of the data to be displayed is selected from a preset set of processing methods, and a risk detection is performed on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein, the risk detection result represents the probability that the data to be displayed is risky data;

[0010] By combining at least one risk detection result corresponding to the at least one data type, the website detection result of the website to be detected is obtained.

[0011] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0012] The step of selecting a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and performing risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection results, includes:

[0013] From the set of processing methods, select the first processing method corresponding to the URL data as the target processing method;

[0014] Based on the aforementioned target processing method, the following operations are performed on the URL data in the website data:

[0015] Based on a preset set of risky URLs, the URL data is subjected to a same-source comparison process to obtain the comparison result corresponding to each associated URL included in the URL data;

[0016] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved to the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0017] Optionally, when all the comparison results indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, the following operations are performed for each associated URL included in the URL data:

[0018] Based on preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein, the URL feature type includes one or more of the following: Uniform Resource Locator (URL) protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0019] Based on the feature information of the associated URL and the correspondence between the URL feature type and the risky URL, the probability that the associated URL is risky data is obtained, and the probability is recorded in the risk detection result.

[0020] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0021] The step of selecting a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and performing risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection results, includes:

[0022] From the set of processing methods, a second processing method corresponding to the text data is selected as the target processing method;

[0023] Based on the aforementioned target processing method, the following operations are performed on the text data in the website data:

[0024] The text data is segmented to obtain at least one segmentation result.

[0025] Based on a preset risk vocabulary set, the at least one word segmentation result is matched.

[0026] Based on the number of matches corresponding to the word segmentation results of the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability that the text data is risk data is positively correlated with the number of matches.

[0027] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0028] The step of selecting a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and performing risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection results, includes:

[0029] From the set of processing methods, a third processing method corresponding to the image data is selected as the target processing method;

[0030] Based on the aforementioned target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0031] The image to be identified is input into a trained image recognition model. The image recognition model extracts features from the image and performs risk image recognition processing based on the obtained image features to obtain the corresponding recognition result. The image recognition model is trained by using risk images from a preset risk image set as training samples and undergoing multiple iterations.

[0032] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0033] Optionally, obtaining the website detection result of the website to be detected based on at least one obtained risk detection result includes:

[0034] When a risk detection result exists, that risk detection result is used as the website detection result for the website to be detected.

[0035] When there are at least two risk detection results, a preset weight coefficient corresponding to the at least two risk detection results is obtained; based on the obtained at least two preset weight coefficients, the at least two risk detection results are weighted and summed to obtain the corresponding risk value;

[0036] Based on the numerical relationship between the risk value and the preset judgment threshold, the website detection result of the website to be detected is obtained.

[0037] Secondly, embodiments of this application provide a website detection device, comprising:

[0038] An acquisition module is used to acquire website data of the website to be detected; wherein, the website data includes data of at least one data type to be displayed;

[0039] The detection module is used to select a target processing method corresponding to the data type to be displayed from a preset set of processing methods for any data type among the at least one data type, and to perform risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein, the risk detection result represents the probability that the data to be displayed is risky data;

[0040] The processing module is used to combine at least one risk detection result corresponding to the at least one data type to obtain the website detection result of the website to be detected.

[0041] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0042] The detection module is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0043] From the set of processing methods, select the first processing method corresponding to the URL data as the target processing method;

[0044] Based on the aforementioned target processing method, the following operations are performed on the URL data in the website data:

[0045] Based on a preset set of risky URLs, the URL data is subjected to a same-source comparison process to obtain the comparison result corresponding to each associated URL included in the URL data;

[0046] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved to the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0047] The detection module is further configured to: when all the obtained comparison results indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, perform the following operations for each associated URL included in the URL data:

[0048] Based on preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein, the URL feature type includes one or more of the following: Uniform Resource Locator (URL) protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0049] Based on the feature information of the associated URL and the correspondence between the URL feature type and the risky URL, the probability that the associated URL is risky data is obtained, and the probability is recorded in the risk detection result.

[0050] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0051] The detection module is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0052] From the set of processing methods, a second processing method corresponding to the text data is selected as the target processing method;

[0053] Based on the aforementioned target processing method, the following operations are performed on the text data in the website data:

[0054] The text data is segmented to obtain at least one segmentation result.

[0055] Based on a preset risk vocabulary set, the at least one word segmentation result is matched.

[0056] Based on the number of matches corresponding to the word segmentation results of the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability that the text data is risk data is positively correlated with the number of matches.

[0057] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0058] The detection module is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0059] From the set of processing methods, a third processing method corresponding to the image data is selected as the target processing method;

[0060] Based on the aforementioned target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0061] The image to be identified is input into a trained image recognition model. The image recognition model extracts features from the image and performs risk image recognition processing based on the obtained image features to obtain the corresponding recognition result. The image recognition model is trained by using risk images from a preset risk image set as training samples and undergoing multiple iterations.

[0062] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0063] Optionally, when the processing module obtains the website detection result of the website to be detected based on at least one obtained risk detection result, it is specifically used for:

[0064] When a risk detection result exists, that risk detection result is used as the website detection result for the website to be detected.

[0065] When there are at least two risk detection results, a preset weight coefficient corresponding to the at least two risk detection results is obtained; based on the obtained at least two preset weight coefficients, the at least two risk detection results are weighted and summed to obtain the corresponding risk value;

[0066] Based on the numerical relationship between the risk value and the preset judgment threshold, the website detection result of the website to be detected is obtained.

[0067] Thirdly, embodiments of this application provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor, by executing the instructions stored in the memory, causes the at least one processor to perform the method described in the first aspect or any optional embodiment of the first aspect.

[0068] Fourthly, embodiments of this application provide a computer-readable storage medium for storing instructions that, when executed, cause a method as described in the first aspect or any optional implementation thereof to be implemented.

[0069] Fifthly, embodiments of this application provide a computer program product containing instructions, wherein the computer program product stores instructions that, when run on a computer, cause the computer to perform the method described in the first aspect or any optional implementation thereof.

[0070] The beneficial effects of this application are as follows:

[0071] This solution utilizes the data type of the website data contained in the website to be tested and selects corresponding processing methods. This allows for risk detection of the data to be displayed within the website data based on different processing methods, providing targeted risk detection methods and thus improving the accuracy of risk detection for different types of data. Furthermore, by directly performing risk detection on the data contained in the website to be tested, and using the website data as the basis for judgment, the targeting and personalization of risk detection are improved, thereby increasing the accuracy of risk detection for the website to be tested.

[0072] On the other hand, after conducting risk detection on the data to be displayed for different data types, the risk level of the website to be tested is determined based on the risk detection results. The risk detection of the website to be tested is carried out from multiple aspects and dimensions, which further improves the accuracy of risk detection for the website to be tested. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 This is a schematic diagram illustrating possible application scenarios provided for embodiments of this application;

[0075] Figure 2A flowchart illustrating the website detection method provided in this application embodiment;

[0076] Figure 3 A schematic diagram illustrating the display of a website page to be tested, provided as an embodiment of this application;

[0077] Figure 4 A flowchart illustrating a method for risk detection of URL data provided in this application embodiment;

[0078] Figure 5 A flowchart illustrating another method for risk detection of URL data provided in this application embodiment;

[0079] Figure 6 A flowchart illustrating a method for risk detection of text data provided in this application embodiment;

[0080] Figure 7 A logical schematic diagram of a method for risk detection of text data provided in an embodiment of this application;

[0081] Figure 8 A flowchart illustrating a method for risk detection of image data provided in this application embodiment;

[0082] Figure 9 A logical schematic diagram of a website detection method provided in an embodiment of this application;

[0083] Figure 10 This is a schematic diagram of the structure of a website detection device provided in an embodiment of this application;

[0084] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0085] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0086] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0087] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0088] The acquisition, transmission, storage, and use of data in this application all comply with relevant national laws and regulations.

[0089] With the rapid development of information technology, the content contained in cyberspace has become increasingly diverse, and people can access and view various content through websites on the Internet. However, some risky websites are disguised as legitimate websites, enticing users to click on links and causing financial losses. Therefore, detection technologies for risky websites play a crucial role in improving cyberspace security and protecting against potential asset losses.

[0090] In related technologies, the detection method for risky websites is usually as follows: the network operator or security software installed on the terminal records the addresses of the reported and verified risky websites. When the website address clicked by the user belongs to the recorded website address, a corresponding security warning is issued or the access request is blocked.

[0091] However, because risky websites frequently change their URLs, users may still visit these websites and suffer losses if the recorded information is not updated in a timely manner.

[0092] In view of this, this application proposes a website detection method, which performs corresponding risk detection processing on each type of data included in the website to be detected, thereby obtaining the website detection results for the website to be detected.

[0093] Specifically, when conducting website testing on a website, the first step is to obtain data of at least one data type from the website to be tested, including one or more of the following data types: URL data, text data, and image data.

[0094] For any data type among at least one data types, the target processing method corresponding to the data type to be displayed can be selected from a preset set of processing methods. Based on the corresponding target processing method, risk detection is performed on the data to be displayed, thereby obtaining the corresponding risk detection result to characterize the probability that the data to be displayed is risky data. In this way, by applying different processing methods to different data types and performing corresponding risk detection, the risk level of different data to be displayed on the website can be obtained.

[0095] Finally, after performing risk detection on the acquired website data, and combining the risk detection results corresponding to at least one data type, the website detection result for the website to be detected can be obtained. Thus, instead of simply comparing the URL of the website to be detected, risk detection is performed on each piece of data to be displayed within the website to be detected, thereby obtaining the website detection result for that website and determining whether it is a risky website.

[0096] After introducing the main inventive concept of the embodiments of this application, the specific implementation of the website detection method proposed in the embodiments of this application will be described below through some specific embodiments and accompanying drawings.

[0097] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0098] See Figure 1 This is a schematic diagram of a possible application scenario provided by an embodiment of this application. In this scenario, a terminal device 101 and a server 102 may be included.

[0099] Terminal device 101 can be a mobile phone, tablet computer (PAD), personal computer (PC), wearable device, vehicle terminal, etc. Server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.

[0100] Terminal device 101 and server 102 can communicate directly or indirectly through one or more communication networks 103. The communication network 103 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wireless-Fidelity (WIFI) network. Of course, it can also be other possible networks, and this embodiment of the invention does not limit them.

[0101] It should be noted that the website detection method in this embodiment can be executed by a computer device, which can be a terminal device 101 or a server 102. For example, when the website detection method is executed by the server 102, the server can, when a user accesses a website through a terminal device, treat that website as the website to be detected, obtain the website data it contains, and then, for the data to be displayed contained in the website data corresponding to any data type among at least one data type, select the target processing method corresponding to the data type to be displayed from a preset set of processing methods, perform risk detection on the data to be displayed, and thus obtain the corresponding risk detection results. Finally, the server can combine the risk detection results of the data to be displayed of different data types to obtain the website detection results corresponding to the website to be detected. In this way, the server can detect the website to be detected based on the website data contained in the website to be detected, and can make targeted judgments based on the actual content of the website, thereby improving the accuracy of risk detection of the website to be detected.

[0102] It should be noted that, Figure 1 The examples shown are merely illustrative; in reality, the number of terminal devices and servers, as well as the communication methods, are not limited and are not specifically restricted in the embodiments of this application.

[0103] On the other hand, the website detection method provided in this application can be applied to various website detection scenarios. For example, this method can be applied to the scenario of detecting risky websites during enterprise operations. Specifically, every enterprise needs the internet for daily work, and in the current environment of frequent security incidents, user clicks on risky websites may pose security risks to both individuals and enterprises. Using the website detection method provided in this application, websites can be continuously monitored, actions to access risky websites can be identified and blocked, and real-time detection and blocking can be achieved.

[0104] The website detection method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0105] See Figure 2 This is a flowchart of a website detection method provided in an embodiment of this application. The execution entity of this method may be as follows: Figure 1 The terminal device or server shown is not limited in this application. To make the description of the solution clearer and more detailed, the method provided in the embodiments of this application will be described below using a server as the execution subject. Specifically, the execution steps of the method are as follows:

[0106] Step S201: Obtain website data of the website to be tested.

[0107] Before this step is executed, the server first needs to obtain the website to be tested. The website to be tested can be obtained by the server automatically obtaining the corresponding website link of the website to be redirected when the user visits different websites, or it can be obtained by the user actively entering the website link address into the testing interface provided by the server when the user wants to test a certain website. This application does not restrict this.

[0108] Regardless of the method used, after the server obtains the website to be tested, it needs to acquire the website data contained within that website.

[0109] Specifically, website data includes at least one type of data to be displayed. These data types include one or more of the following: URL data, text data, and image data.

[0110] Among them, URL data refers to the URL data associated with the website to be tested. For example, some websites may have hidden links. When a user clicks on the text or image on the website, they will be redirected to a page on another website. Therefore, these hidden URL links on the website are the URL data associated with the website to be tested.

[0111] Text data refers to the text content contained in the pages displayed to users by the website being tested. This can include text data on the page, text data in images or videos, and text data corresponding to the speech in the video after it has been converted into text.

[0112] Image data refers to the image content contained in the pages displayed to users by the website being tested. This can be the image content directly displayed on the page, or the image content of each frame in the video or dynamic images contained on the page.

[0113] When the server obtains website data from the website to be tested, it can obtain one or more of the above-mentioned different data types to be displayed based on the preset configuration information or the content contained in the website to be tested.

[0114] For example, when the website to be tested contains only text content, the server can only obtain the corresponding text data when retrieving the website data. Therefore, the website data only contains data of one data type to be displayed. However, when the website to be tested... Figure 3 As shown, when data includes text, images, and associated URLs, the server can obtain data containing multiple data types to be displayed when retrieving website data.

[0115] When acquiring website data from the website to be tested, the server can use a parsing tool for website pages to parse the webpage content and extract the corresponding website links as URL data.

[0116] After obtaining the website data of the website to be tested as mentioned above, the server can then perform the following operations:

[0117] Step S202: For any data type in at least one data type, select the target processing method corresponding to the data type to be displayed from the preset processing method set, and perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection results.

[0118] The risk detection result represents the probability that the data to be displayed is risky data.

[0119] After the server obtains website data, it needs to select the corresponding processing method and perform risk detection for each of the at least one data type present in the website data.

[0120] Specifically, the server has a pre-defined set of processing methods, which can include at least one processing method, and each processing method corresponds to a different data type.

[0121] The server then needs to select the target processing method corresponding to the data type based on the data type contained in the acquired website data, and perform risk detection on the data to be displayed according to the corresponding relationship, thereby obtaining the corresponding risk detection results.

[0122] For different types of data to be displayed on a website, the server can perform risk detection and processing based on the following methods after selecting the corresponding processing method.

[0123] In one possible implementation, when the website data contains URL data associated with the website to be detected, the server can perform risk detection processing on that URL data in the following manner:

[0124] See Figure 4 The flowchart below illustrates a method for risk detection of URL data provided in this application embodiment. Figure 4 As shown, the specific implementation steps of this method are as follows:

[0125] Step S401: Select the first processing method corresponding to the URL data from the preset processing method set, and use it as the target processing method.

[0126] The preset processing methods include multiple processing methods, among which the processing method of risk detection for URL data corresponds to the first processing method.

[0127] Specifically, after obtaining the first processing method, and using it as the target processing method, the server can perform the following operations on the URL data in the obtained website data:

[0128] Step S402: Based on the preset risk URL set, perform same-source comparison processing on the URL data to obtain the comparison results corresponding to each associated URL in the URL data.

[0129] First, it's important to clarify that same-origin URLs refer to web page addresses that share the same protocol, domain name, and port. Specifically, if two URLs have the same protocol (e.g., http or https), domain name (or hostname, such as www.example.com), and port number (e.g., 80 or 443), then these two URLs are considered to be from the same origin. For example, the URL http: / / www.example.com / d / p.html has the following same-origin URLs:

[0130] http: / / www.example.com / d2 / other.html;

[0131] http: / / www.example.com / d / in / a.html;

[0132] The URLs in the two examples above are from the same origin as the first URL, because they only differ in path, but share the same protocol, domain name, and port. Therefore, these three URLs are from the same origin.

[0133] Having understood the concept of same-origin URLs, the following will continue with a description of step S402.

[0134] When the server obtains URL data and processes it using the first processing method, the server can perform same-origin comparison processing on the URL data based on a preset set of risky URLs, thereby obtaining the comparison result corresponding to each associated URL in the URL data. The comparison result is used to characterize whether the corresponding associated URL is a same-origin URL as any risky URL in the risky URL set.

[0135] The risky URL set is a collection of risky URLs pre-installed on the server. The URLs included in this set are all URL links that have been identified as risky URLs. The source of these URL links can be public URL resources or URLs continuously recorded by the server after being identified as risky URLs during the execution of the risk detection method. This application does not impose any restrictions on this.

[0136] The process of performing same-origin comparison on URL data can be carried out in a variety of different ways.

[0137] For example, the server can directly obtain information such as the protocol, domain name, and port of each associated URL in the URL data and compare it with the risky URLs in the risky URL set.

[0138] For example, a server can also use a pre-trained same-origin identification model to classify related URLs and determine whether they are same-origin URLs of any risky URL in the risky URL set. When using a trained model to judge URL data, training samples can be constructed beforehand using Power Domain Name System (PDNS) logs. PDNS logs typically refer to the log records generated by the PowerDNS server when processing DNS query requests and responses. These logs contain detailed information about DNS queries, such as the queried domain name, query type, and query source IP. Using PDNS logs, the server can construct training samples containing domain name, type, and true tags. Then, using these training samples, a same-origin identification model is trained based on a decision tree algorithm. After multiple rounds of iterative training to obtain a satisfactory same-origin identification model, this model can be used to classify and identify related URLs in the website data, determining whether they are same-origin URLs of risky URLs in the risky URL set.

[0139] Step S403: When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved to the risk URL set, and based on the comparison result, a risk detection result is obtained to ensure that the URL data is at risk.

[0140] For the comparison results obtained by the server, it will obtain a corresponding comparison result for each associated URL in the URL data. This comparison result is used to characterize whether the associated URL is a same-origin URL of the risk URL in the risk URL set.

[0141] When the comparison results show that the associated URL is a homologous URL to a risk URL in the risk URL set, the server can save the corresponding associated URL to the risk URL set, thereby expanding the content of the risk URL set and providing a more sufficient data foundation for subsequent URL detection.

[0142] Simultaneously, the server will also obtain risk detection results for the URL data based on the comparison results. Optionally, this risk detection result may include a result indicating whether the URL data is risky data, or it may include a probability indicating that the URL data is risky data. The probability value indicating that the URL data is risky data is positively correlated with the number of related URLs that are from the same source as the risky URL in the URL data.

[0143] In this way, by comparing the URLs with those in the risk URL set, the correlation between URLs with the same origin is used to detect risks in the URL data, which improves the accuracy of risk URL identification. At the same time, the identified risk URLs are recorded in the risk URL set, providing a sufficient data foundation for subsequent URL risk detection, which further improves the accuracy and efficiency of risk detection.

[0144] In one possible implementation, when all the results of the same-origin comparison of the obtained URL data indicate that the associated URL is not a same-origin URL of any of the risk URLs in the risk URL set, the server can also perform the following risk detection operation on the URL data:

[0145] Specifically, for each associated URL contained in the URL data, the server can perform the following operations:

[0146] See Figure 5 The flowchart below illustrates another method for risk detection of URL data provided in this application embodiment. Figure 5 As shown, the specific implementation steps of this method are as follows:

[0147] Step S501: Based on the preset URL feature types, extract the feature information corresponding to each URL feature type from the associated URLs;

[0148] The URL characteristics include one or more of the following: URL protocol, domain name length, port, special characters, domain level, number of existing vulnerabilities, and historical vulnerabilities.

[0149] When the server detects associated URLs, it can extract corresponding feature information based on the preset URL feature types mentioned above. For example, when extracting feature information from an associated URL, it can extract the protocol, domain name length, domain name level, port, special characters, and other content corresponding to that associated URL.

[0150] Step S502: Based on the feature information of the associated URLs and the correspondence between URL feature types and risky URLs, obtain the probability that the associated URLs are risky data, and record the probability in the risk detection results.

[0151] After the server obtains the characteristic information of the associated URL, it can determine the probability that the associated URL is a risky URL based on the correspondence between the URL characteristic type and the risky URL.

[0152] For example, the server can use a risk classification model pre-trained with the Naive Bayes algorithm to classify these feature information. Based on the relationship between various URL feature types stored in the model and the category of risky URLs, the server can identify the feature information and determine the probability that the associated URL corresponding to the feature information is a risky URL.

[0153] In the process of training the risk classification model, the risk URLs and some normal URLs can be used to construct training samples. Then, these training samples can be used to train the risk classification model in multiple rounds of iteration.

[0154] After obtaining the probability that an associated URL is a risky URL, the server records the probability of that associated URL in the risk detection results. Then, after completing the detection of all associated URLs, the risk detection results can record the probability of each associated URL. In this way, by combining all the probability values, the server can obtain the probability that the URL data is risky data through a weighted summation method. Furthermore, when this probability exceeds a preset threshold, the server can determine that this URL data is risky data.

[0155] In this approach, when no homologous URLs to the risky URL set are found in the URL data, the server can directly perform feature detection on the associated URLs to classify and identify them, determining whether the associated URLs are risky data. Then, based on the risk identification results of all associated URLs, the risk detection result of the URL data is determined. Thus, by using the characteristics of the URLs themselves to judge the degree of risk, the accuracy of risky website detection is further improved.

[0156] The above describes methods for risk detection based on URL data. The following will introduce methods for risk detection based on text data and image data.

[0157] In one possible implementation, when the data on the website contains text data, the server can perform risk detection processing on the text data in the following manner:

[0158] See Figure 6 The flowchart below illustrates a method for risk detection of text data provided in this application embodiment. Figure 6 As shown, the specific implementation steps of this method are as follows:

[0159] Step S601: Select the second processing method corresponding to the text data from the preset processing method set as the target processing method.

[0160] After selecting the second processing method from the set of processing methods, the server can use it as the target processing method to perform the following operations on the text data in the obtained website data:

[0161] Step S602: Perform word segmentation on the text data to obtain at least one corresponding word segmentation result.

[0162] After obtaining the text data, the server needs to perform word segmentation on it. This segmentation can be done using dictionary matching, statistical probability methods, or machine learning to obtain at least one segmentation result.

[0163] Step S603: Based on the preset risk vocabulary set, perform matching processing on at least one word segmentation result.

[0164] like Figure 7 As shown, the server will have a pre-set risk vocabulary set, which includes some words that pose a risk.

[0165] When performing matching processing on the segmented results based on the risk vocabulary set, the server can sort the words in the risk vocabulary set, generate the corresponding risk word search tree, and then use the Deterministic Finite Automaton (DFA) algorithm to perform matching detection on each segmented result, thereby determining whether each segmented result will hit any risk word in the risk vocabulary set.

[0166] Step S604: Based on the number of matches corresponding to the word segmentation results of the hit risk vocabulary set, obtain the risk detection results corresponding to the text data.

[0167] After the server performs matching processing on each word segmentation result, it can obtain the number of matches corresponding to the word segmentation results that hit the risky word set. Based on this number of matches, the server can obtain the risk detection result corresponding to the text data. In the risk detection result, the probability that the text data is risky data is positively correlated with the number of matches. When this probability exceeds a preset threshold, the server can determine that the text data is risky data.

[0168] In this method, the server performs risk detection on the text data in the website data using a preset second processing method, obtains the number of matches of at least one risky word in the risky word set in the text data, and determines the probability that the text data is risky data based on the number of matches, thereby improving the accuracy of risk detection for the website.

[0169] In one possible implementation, when the data on the website contains image data that is part of the website to be detected, the server can perform risk detection processing on the image data in the following manner:

[0170] See Figure 8 The flowchart below illustrates a method for risk detection of image data provided in an embodiment of this application. Figure 8 As shown, the specific implementation steps of this method are as follows:

[0171] Step S801: Select the third processing method corresponding to the image data from the preset processing method set as the target processing method.

[0172] After selecting the third processing method from the set of processing methods, the server can use it as the target processing method and perform the following operations on each image to be identified in the image data of the acquired website data:

[0173] Step S802: Input the image to be identified into the trained image recognition model. Through the image recognition model, feature extraction is performed on the image to be identified, and risk image recognition processing is performed based on the obtained image features to obtain the corresponding recognition results.

[0174] The image recognition model is trained by using risk images from a pre-set risk image set as training samples and undergoing multiple rounds of iteration.

[0175] For the preset risk image set, the image data contained therein can be image data obtained from public data sources or image data generated based on content generation models, and this application does not impose any restrictions on this.

[0176] The risky URL set, risky keyword set, and risky image set mentioned above can all be pre-set as a data set in the server's database as part of the threat intelligence database, so that the server can use them when performing risk detection methods for websites.

[0177] Optionally, when the server obtains image data from the website to be detected, it can extract all the images, perform size transformation and noise reduction processing to obtain relatively standardized images to be identified, and then perform risk detection on each image to be identified separately.

[0178] Furthermore, when performing risk detection on each image to be identified, the server can first use the risk images in the risk image set as training samples to perform multiple rounds of iterative training on the convolutional neural network to obtain an image recognition model. Then, the image to be identified is input into the image recognition model, and the image recognition model is used to extract features from the image to be identified. Based on the obtained image features, risk image recognition processing is performed to obtain the corresponding recognition results.

[0179] When an image recognition model identifies an image, it outputs the corresponding risk probability and non-risk probability. The server can determine whether the image to be identified is a risky image based on the corresponding probability value and use the judgment result as the corresponding recognition result.

[0180] Step S803: Record the recognition result corresponding to the image to be recognized in the risk detection result.

[0181] After the server obtains the recognition result of the image to be recognized, it can record the corresponding recognition result in the risk detection result.

[0182] In this way, once all the images to be identified have completed the risk detection process, the risk detection results will include the recognition results of all the images to be identified.

[0183] The server can then use the recognition results of the images to be identified in the risk detection results to determine the number of risky images in the website to be detected, and based on the number of risky images, judge the risk level of the image data and the probability that the image data is risky data.

[0184] In this approach, the server uses a pre-trained image recognition model to perform risk detection on image data in the website to be detected, determining whether each image to be identified is a risky image. Then, the number of risky images is used to determine the risk level of the image data. Based on the data to be displayed in the website to be detected, the risk level of the website is judged, which further improves the accuracy of risk detection for websites.

[0185] The above describes methods for risk detection of URL data, text data, and image data. However, it's important to note that once the server obtains website data, it can select an appropriate processing method to perform risk detection based on the data types it contains. For example, when the website data includes all three data types mentioned above, the server needs to perform risk detection on the data to be displayed for each of these three data types based on three preset processing methods, thereby obtaining the corresponding risk detection results.

[0186] Therefore, after performing risk detection on the website data, the server can proceed with the following operations:

[0187] Step S203: Combine at least one risk detection result corresponding to at least one data type to obtain the website detection result of the website to be detected.

[0188] After the server performs risk detection on the website data and obtains at least one risk detection result, the server can combine the at least one risk detection result to obtain the corresponding website detection result for the website to be detected.

[0189] For example, in one possible implementation, the server processes different amounts of risk detection results in different ways, namely:

[0190] When a risk detection result exists, the server can directly use that result as the website detection result for the website to be detected.

[0191] When there are at least two risk detection results, the server needs to obtain the preset weight coefficients corresponding to the at least two risk detection results; then, based on the obtained at least two preset weight coefficients, the at least two risk detection results are weighted and summed to obtain the corresponding risk value; finally, based on the numerical relationship between the risk value and the preset judgment threshold, the website detection result of the website to be detected is obtained.

[0192] For example, let's illustrate the above with the case of three risk detection results. When there are three risk detection results corresponding to three data types, the server first needs to obtain the preset weight system corresponding to these three risk detection results. Then, based on these preset weight coefficients, the three risk detection results are weighted and summed to obtain the corresponding risk value. Finally, based on the numerical relationship between the risk value and a preset judgment threshold, when the risk value is greater than or equal to the judgment threshold, the server can determine that the website to be detected is a risky website; when the risk value is less than the judgment threshold, the server can determine that the website to be detected is a non-risky website.

[0193] For example, suppose that in the three risk detection results, the probability of the corresponding data to be displayed being risky data is represented by the corresponding detection score value. Then, after the server performs risk detection on a website to be detected, it will get three detection scores, which will be denoted as sDT, sDFA, and sCNN respectively.

[0194] The corresponding preset weight coefficients obtained by the server can then be denoted as wDT, wDFA, and wCNN, respectively. These three preset weight coefficients represent the relative importance of each risk detection result in the final judgment. The specific values ​​of these preset weight coefficients can be determined based on the historical performance, accuracy, recall, and other indicators of different processing methods, and this application does not impose any restrictions on this. Optionally, in one possible implementation, the user can preset thresholds to limit different preset weight coefficients, setting the preset weight coefficient corresponding to the first processing method to the maximum value of the three preset weight coefficients, thereby emphasizing the importance of risk detection for URL data.

[0195] Finally, the server obtains the final risk value using the following formula (Formula 1) in a weighted and normalized manner:

[0196]

[0197] Specifically, as shown in Formula 1, the score corresponding to each processing method is multiplied by its corresponding weight, and then these weighted scores are added together. The sum is then divided by the sum of all weights to obtain a standardized score, which serves as the corresponding risk value.

[0198] This solution utilizes the data type of the website data contained in the website to be tested and selects corresponding processing methods. This allows for risk detection of the data to be displayed within the website data based on different processing methods, providing targeted risk detection methods and thus improving the accuracy of risk detection for different types of data. Furthermore, by directly performing risk detection on the data contained in the website to be tested, and using the website data as the basis for judgment, the targeting and personalization of risk detection are improved, thereby increasing the accuracy of risk detection for the website to be tested.

[0199] On the other hand, after conducting risk detection on the data to be displayed for different data types, the risk level of the website to be tested is determined based on the risk detection results. The risk detection of the website to be tested is carried out from multiple aspects and dimensions, which further improves the accuracy of risk detection for the website to be tested.

[0200] The above describes a website detection method and various possible implementation methods provided by embodiments of this application. To facilitate a comprehensive understanding of the solution, the following will combine... Figure 9 This section provides an overall overview of the plan.

[0201] like Figure 9 As shown, when performing website testing on a website, it is first necessary to obtain the link address of the website to be tested, and then obtain the website data contained in the website from it; the website data includes: URL data, text data, and image data.

[0202] Once this data is acquired, the server can select the appropriate processing method from a set of preset processing methods and combine it with a preset threat intelligence database to process it. For URL data, it can perform same-origin comparison and link risk detection; for text data, it can perform text matching; and for image data, it can perform image recognition. All of these processing methods can be used as a unified risk detection process.

[0203] After obtaining the risk detection results for each type of data, the server can combine these risk detection results to obtain the website detection results for the website to be detected. The website detection results include: the result indicating whether the website to be detected is a risky website, and the confidence score result corresponding to the result.

[0204] Based on the same inventive concept, embodiments of this application also provide a website detection device.

[0205] See Figure 10 This is a schematic diagram of the structure of a website detection device provided in an embodiment of this application. The device may be the aforementioned server or a chip or integrated circuit in the device. The device includes modules / units / technical means for executing the method executed by the server in the above method embodiment.

[0206] For example, the device 1000 includes:

[0207] The acquisition module 1001 is used to acquire website data of the website to be detected; wherein, the website data includes data to be displayed of at least one data type;

[0208] The detection module 1002 is used to select a target processing method corresponding to the data type to be displayed from a preset set of processing methods for any data type among the at least one data type, and to perform risk detection on the data to be displayed based on the target processing method to obtain a corresponding risk detection result; wherein, the risk detection result represents the probability that the data to be displayed is risky data;

[0209] The processing module 1003 is used to obtain the website detection result of the website to be detected by combining at least one risk detection result corresponding to the at least one data type.

[0210] Optionally, the at least one data type includes: URL data associated with the website to be detected;

[0211] The detection module 1002 is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0212] From the set of processing methods, select the first processing method corresponding to the URL data as the target processing method;

[0213] Based on the aforementioned target processing method, the following operations are performed on the URL data in the website data:

[0214] Based on a preset set of risky URLs, the URL data is subjected to a same-source comparison process to obtain the comparison result corresponding to each associated URL included in the URL data;

[0215] When the comparison result indicates that the associated URL is a homologous URL of at least one risk URL in the risk URL set, the associated URL is saved to the risk URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained.

[0216] The detection module 1002 is further configured to: when all the obtained comparison results indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, perform the following operations for each associated URL included in the URL data:

[0217] Based on preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein, the URL feature type includes one or more of the following: Uniform Resource Locator (URL) protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities;

[0218] Based on the feature information of the associated URL and the correspondence between the URL feature type and the risky URL, the probability that the associated URL is risky data is obtained, and the probability is recorded in the risk detection result.

[0219] Optionally, the at least one data type includes: text data contained in the website to be detected;

[0220] The detection module 1002 is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0221] From the set of processing methods, a second processing method corresponding to the text data is selected as the target processing method;

[0222] Based on the aforementioned target processing method, the following operations are performed on the text data in the website data:

[0223] The text data is segmented to obtain at least one segmentation result.

[0224] Based on a preset risk vocabulary set, the at least one word segmentation result is matched.

[0225] Based on the number of matches corresponding to the word segmentation results of the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability that the text data is risk data is positively correlated with the number of matches.

[0226] Optionally, the at least one data type includes: image data contained in the website to be detected;

[0227] The detection module 1002 is used to select a target processing method from a preset set of processing methods that corresponds to the data type of the data to be displayed, and to perform risk detection on the data to be displayed based on the target processing method to obtain the corresponding risk detection result. Specifically, it is used for:

[0228] From the set of processing methods, a third processing method corresponding to the image data is selected as the target processing method;

[0229] Based on the aforementioned target processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed respectively:

[0230] The image to be identified is input into a trained image recognition model. The image recognition model extracts features from the image and performs risk image recognition processing based on the obtained image features to obtain the corresponding recognition result. The image recognition model is trained by using risk images from a preset risk image set as training samples and undergoing multiple iterations.

[0231] The recognition result corresponding to the image to be recognized is recorded in the risk detection result.

[0232] Optionally, when the processing module 1003 obtains the website detection result of the website to be detected based on at least one obtained risk detection result, it is specifically used for:

[0233] When a risk detection result exists, that risk detection result is used as the website detection result for the website to be detected.

[0234] When there are at least two risk detection results, a preset weight coefficient corresponding to the at least two risk detection results is obtained; based on the obtained at least two preset weight coefficients, the at least two risk detection results are weighted and summed to obtain the corresponding risk value;

[0235] Based on the numerical relationship between the risk value and the preset judgment threshold, the website detection result of the website to be detected is obtained.

[0236] As one example, Figure 10 The device described can be used to perform Figure 2 The method described in the illustrated embodiment is therefore relevant to the functions that each functional module of the device can achieve. Figure 2 The description of the embodiments shown will not be repeated here.

[0237] It should be noted that although several modules or sub-modules of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more units described above can be embodied in a single module. Conversely, the features and functions of a module described above can be further divided and embodied by multiple modules.

[0238] As one possible product form of the aforementioned device, see [link to product description]. Figure 11 This application also provides an electronic device 1100, comprising:

[0239] At least one processor 1101; and a communication interface 1103 communicatively connected to the at least one processor 1101; the at least one processor 1101 causes the electronic device 1100 to execute the method steps performed by any device in the above method embodiments through the communication interface 1103 by executing instructions stored in the memory 1102.

[0240] Optionally, the memory 1102 is located outside the electronic device 1100.

[0241] Optionally, the electronic device 1100 includes the memory 1102, which is connected to the at least one processor 1101. The memory 1102 stores instructions that can be executed by the at least one processor 1101. (Appendix) Figure 11 The dashed line indicates that memory 1102 is optional for electronic device 1100.

[0242] The processor 1101 and the memory 1102 can be coupled through an interface circuit or integrated together; no restriction is imposed here.

[0243] This application embodiment does not limit the specific connection medium between the processor 1101, memory 1102, and communication interface 1103. This application embodiment... Figure 11 The processor 1101, memory 1102, and communication interface 1103 are connected via a bus 1104. Figure 11 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. The bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 11 The text uses only a single thick line to represent a bus, but this does not imply that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiments of this application can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0244] For example, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0245] It should be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct RAM (DR RAM).

[0246] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0247] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0248] As another possible product form, this application embodiment also provides a computer-readable storage medium for storing instructions that, when executed, cause a computer to perform the method steps performed by any of the devices in the above method examples.

[0249] As another possible product form, this application embodiment also provides a computer program product containing instructions, wherein the computer program product stores instructions that, when run on a computer, cause the computer to execute the method steps performed by any device in the above method embodiments.

[0250] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0251] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0252] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0253] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0254] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A website detection method, characterized in that, include: Obtain website data of the website to be tested; wherein, the website data includes data of at least one data type to be displayed; When the data type is URL data associated with the website to be detected, a first processing method corresponding to the URL data is selected from a preset set of processing methods. Based on the first processing method, the following operations are performed on the URL data in the website data: Based on a preset set of risky URLs, a same-origin comparison is performed on the URL data to obtain the comparison result corresponding to each associated URL included in the URL data; when the comparison result indicates that the associated URL is a same-origin URL as at least one risky URL in the risky URL set, the associated URL is saved to the risky URL set, and based on the comparison result, a risk detection result indicating that the URL data has a risk is obtained; the risk detection result indicates the probability that the data to be displayed is risky data. When the data type is text data contained in the website to be detected, a second processing method corresponding to the text data is selected from the set of processing methods, and based on the second processing method, the following operations are performed on the text data in the website data: the text data is segmented to obtain at least one corresponding segmentation result; the at least one segmentation result is matched based on a preset risk vocabulary set; the risk detection result corresponding to the text data is obtained based on the number of matches corresponding to the segmentation results that hit the risk vocabulary set; wherein, in the risk detection result, the probability that the text data is risky data is positively correlated with the number of matches; When the data type is image data contained in the website to be detected, a third processing method corresponding to the image data is selected from the set of processing methods. Based on the third processing method, for each image to be identified in the image data corresponding to the third data type in the website data, the following operations are performed: the image to be identified is input into a trained image recognition model. The image recognition model extracts features from the image to be identified and performs risk image recognition processing based on the obtained image features to obtain the corresponding recognition result. The image recognition model is trained by using risk images from a preset risk image set as training samples and performing multiple iterations. The recognition result corresponding to the image to be identified is recorded in the risk detection result. By combining at least one risk detection result corresponding to the at least one data type, the website detection result of the website to be detected is obtained.

2. The method as described in claim 1, characterized in that, After obtaining the risk detection result characterizing the risk of the URL data based on the comparison result, the method further includes: When all the comparison results indicate that the associated URL is not a homologous URL of any risk URL in the risk URL set, the following operations are performed for each associated URL included in the URL data: Based on preset URL feature types, feature information corresponding to each URL feature type is extracted from the associated URLs; wherein, the URL feature type includes one or more of the following: Uniform Resource Locator (URL) protocol, domain name length, port, special characters, domain name level, number of existing vulnerabilities, and historical vulnerabilities; Based on the feature information of the associated URL and the correspondence between the URL feature type and the risky URL, the probability that the associated URL is risky data is obtained, and the probability is recorded in the risk detection result.

3. The method as described in claim 1 or 2, characterized in that, The step of obtaining the website detection result of the website to be detected based on at least one obtained risk detection result includes: When a risk detection result exists, that risk detection result is used as the website detection result for the website to be detected. When there are at least two risk detection results, a preset weight coefficient corresponding to the at least two risk detection results is obtained; based on the obtained at least two preset weight coefficients, the at least two risk detection results are weighted and summed to obtain the corresponding risk value; Based on the numerical relationship between the risk value and the preset judgment threshold, the website detection result of the website to be detected is obtained.

4. A website detection device, characterized in that, include: An acquisition module is used to acquire website data of the website to be detected; wherein, the website data includes data of at least one data type to be displayed; The detection module is configured to, when the data type is URL data associated with the website to be detected, select a first processing method corresponding to the URL data from a preset set of processing methods, and based on the first processing method, perform the following operations on the URL data in the website data: perform homology comparison processing on the URL data based on a preset set of risky URLs, and obtain the comparison result corresponding to each associated URL included in the URL data; when the comparison result indicates that the associated URL is a homology URL of at least one risky URL in the set of risky URLs, save the associated URL to the set of risky URLs, and obtain a risk detection result indicating that the URL data has a risk based on the comparison result; the risk detection result indicates the probability that the data to be displayed is risky data; when the data type is text data contained in the website to be detected, select a second processing method corresponding to the text data from the set of processing methods, and based on the second processing method, perform the following operations on the text data in the website data: perform word segmentation processing on the text data, and obtain at least one corresponding word segmentation result. Based on a preset risk vocabulary set, the at least one word segmentation result is matched; based on the number of matches corresponding to the word segmentation results that hit the risk vocabulary set, the risk detection result corresponding to the text data is obtained; wherein, in the risk detection result, the probability that the text data is risky data is positively correlated with the number of matches; when the data type is image data contained in the website to be detected, a third processing method corresponding to the image data is selected from the processing method set, and based on the third processing method, the following operations are performed on each image to be identified in the image data corresponding to the third data type in the website data: the image to be identified is input into a trained image recognition model, the image to be identified is feature extracted through the image recognition model, and risk image recognition processing is performed based on the obtained image features to obtain the corresponding recognition result; wherein, the image recognition model is trained by using risk images in a preset risk image set as training samples after multiple iterations; the recognition result corresponding to the image to be identified is recorded in the risk detection result; The processing module is used to combine at least one risk detection result corresponding to the at least one data type to obtain the website detection result of the website to be detected.

5. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-3 to be implemented.

7. A computer program product containing instructions, characterized in that, The computer program product stores instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1-3.

Images