Automatic front-end website user network behavior security detection system

Abstract

An automatic front-end website user network behavior security detection system comprises a website automatic test module, a front-end code analysis module, a dynamic instrumentation analysis module and a user behavior analysis module, and the website automatic test module analyzes the result information according to the front-end code analysis module and the dynamic instrumentation analysis module. The code collection module is used for interacting with the website code analysis module, executing page operation according to instructions of the website code analysis module, continuously collecting newly loaded codes and outputting the newly loaded codes to the website code analysis module; the front-end code analysis module is used for performing static analysis on the collected front-end codes, identifying key elements and elements related to network operation, and obtaining a JavaScript function related to the network operation; the dynamic instrumentation analysis module modifies a front-end code loaded by a browser according to a JavaScript function, inserts a log recording code into the JavaScript function, and replaces a front-section original webpage code with the JavaScript code obtained after instrumentation; the website automatic test module simulates interaction between a user and a website, log information output by codes after instrumentation is collected by user behaviors, and all potential user network behaviors are obtained by integrating key network behavior related elements obtained by front-end code analysis. Through an automation technology, comprehensive and real-time monitoring of user behaviors is realized, and potential security threats are automatically detected and responded.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to an automated front-end website user network behavior security detection system. Background Art

[0002] With the rapid development of Internet technology, front-end websites play a vital role in various fields such as e-commerce, financial services, social media, and online education. As the interface for users to directly interact with the system, the performance, user experience (UX), and security of the front-end directly affect the success of the website. In order to improve user experience and ensure system security, front-end user behavior monitoring and security detection have become an important part of modern Web applications. User behavior monitoring aims to collect and analyze user operation data on the front-end interface, such as clicks, scrolling, form input, page dwell time, etc., in order to optimize interface design and improve conversion rate. At the same time, security detection focuses on detecting and protecting potential security threats, preventing security incidents such as data leakage and malicious attacks, and ensuring the security of user data and systems.

[0003] Existing front-end user behavior monitoring mainly relies on logging, third-party monitoring tools (such as Google Analytics, Hotjar), and page event monitoring. These methods meet the needs of data collection and analysis to a certain extent, but they have many shortcomings in terms of comprehensiveness, real-time, performance impact, and flexibility. For example, logging requires manual insertion of monitoring points, which has high maintenance costs and is difficult to cover all user behaviors; although third-party tools are rich in functions, they may bring data privacy and security issues, and lack flexibility in highly customized application scenarios; and page event monitoring is prone to performance degradation in complex applications and is difficult to dynamically adapt to changes in page structure. The existing technology for obtaining the call path of JavaScript function execution on web pages has low scalability and is difficult to adapt to diverse application needs; it only focuses on the function call path and fails to capture the actual network behavior of users; the call path consistency is insufficient when processing asynchronous operations and dynamic elements; and the instrumentation process has a greater impact on performance. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention proposes an automated front-end website user network behavior security detection system, which realizes comprehensive and real-time monitoring of user behavior and automatically detects and responds to potential security threats through automation technology.

[0005] The present invention is achieved through the following technical solutions:

[0006] The present invention relates to an automated front-end website user network behavior security detection system, comprising: a website automated testing module, a front-end code analysis module, a dynamic plugging analysis module and a user behavior analysis module, wherein: the website automated testing module interacts with the website code analysis module according to the result information obtained after analysis by the front-end code analysis module and the dynamic plugging analysis module, executes page operations according to the instructions of the website code analysis module, and continuously collects newly loaded codes and outputs them to the website code analysis module; the front-end code analysis module performs static analysis on the collected front-end codes, identifies key elements and elements related to network operations, and obtains JavaScript functions related to network operations; the dynamic plugging analysis module modifies the front-end codes loaded by the browser according to the JavaScript functions, inserts log recording codes into the JavaScript functions, and replaces the original web page codes of the front-end with the JavaScript codes obtained after plugging; the website automated testing module simulates the interaction between users and websites, collects the log information output by the plugging code according to the user behaviors, and obtains all potential user network behaviors by integrating the key network behavior related elements obtained by the front-end code analysis. Technical Effects

[0007] The present invention uses automated control technology and dynamic plugging technology to automatically inject monitoring and detection logic without manually modifying a large amount of front-end code, significantly reducing development and maintenance costs. It realizes automated control of the target website, conducts dynamic and static analysis of the loaded front-end code, extracts the user's network behavior, and performs security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a schematic diagram of the system of the present invention;

[0009] Figure 2 is a flow chart of an embodiment;

[0010] Figure 3-Figure 7 It is a schematic diagram of the effect of the embodiment. DETAILED DESCRIPTION

[0011] like Figure 1 As shown, this embodiment relates to an automated front-end website user network behavior security detection system, including: a website automated testing module, a front-end code analysis module, a dynamic instrumentation analysis module and a user behavior analysis module.

[0012] The website automation test module includes: a page analysis unit, a resource capture unit, an interaction simulation unit and a performance evaluation unit, wherein: the page analysis unit performs page loading sequence analysis according to website structure information to obtain page loading dependency results; the resource capture unit performs resource capture processing according to network request information in the page to obtain complete page resource data results; the interaction simulation unit performs click event simulation processing according to page element interaction information to obtain user interaction path results.

[0013] The front-end code analysis module includes: an HTML parsing unit, a key element extraction unit, a JavaScript analysis unit and a dependency analysis unit, wherein: the HTML parsing unit performs an abstract syntax tree (AST) generation process based on HTML source code information to obtain an HTML structure result; the key element extraction unit performs a key tag and element extraction process based on HTML structure information to obtain a network-related element result; the JavaScript analysis unit performs a data flow and call graph analysis process based on JavaScript source code information to obtain a network interaction function result; the dependency analysis unit performs a cross-module dependency analysis process based on the front-end code comprehensive information to obtain an interaction relationship result between modules.

[0014] The dynamic instrumentation analysis module comprises: a log insertion unit, a code replacement unit, a log collection unit and a call analysis unit, wherein: the log insertion unit performs log code insertion processing according to JavaScript function information to obtain the function code result after instrumentation; the code replacement unit performs source code replacement processing according to the JavaScript code after instrumentation to obtain the complete front-end code result after instrumentation; the log collection unit performs log data collection processing according to the instrumentation code running information to obtain the function call record result; the call analysis unit performs call relationship analysis processing according to the function call record information to obtain the network interaction behavior log result.

[0015] The user behavior analysis module includes: a behavior simulation unit, a parameter extraction unit, a behavior pattern mining unit and a report generation unit, wherein: the behavior pattern mining unit performs behavior pattern mining processing based on user interaction path information to obtain user behavior feature results; the report generation unit performs behavior analysis report generation processing based on user behavior comprehensive information to obtain user network behavior summary results.

[0016] like Figure 2 As shown, the security detection method based on the above system in this embodiment includes:

[0017] Step 1: Load the website automation control module, open the website and simulate the user's automatic browsing of the web page;

[0018] Step 2: Obtain the website source code through the website code analysis module and the website automation control interaction, analyze the website source code, and send the analysis results to the dynamic instrumentation analysis module. The specific operations include:

[0019] 2.1 Automatically download the front-end source code of the website.

[0020] 2.2 Perform program analysis on the HTML in the front-end source code of the website, convert the HTML source code into the form of an abstract syntax tree (AST), discover network-related key elements and tags by traversing the abstract syntax tree, and send the discovered results to the user behavior analysis module for user network behavior collection and analysis.

[0021] 2.3 Perform program analysis on the HTML in the front-end source code of the website, convert the HTML source code into the form of an abstract syntax tree (AST), discover network-related key elements and tags by traversing the abstract syntax tree, and send the discovered results to the website automation test module to guide the website automation test module to continue exploring website resources.

[0022] 2.4 Perform program analysis on the front-end JavaScript source code of the website, use data flow analysis and call graph analysis to find potential network sending and receiving related functions in the code, and send the location of network-related JavaScript functions in the source code and the JavaScript source code to the dynamic instrumentation analysis module.

[0023] Step 3: The user behavior analysis module interacts with the front-end code analysis module to perform code instrumentation on the network function. The specific operations include:

[0024] 3.1 For the JavaScript function and JavaScript source code sent by the front-end code analysis module, a log code is inserted into the function body. This part of the log code records the parameter information when the current function is called.

[0025] 3.2 For the inserted code, replace the JavaScript code of the current front-end website with the inserted JavaScript code. After the front-end source code of the website is replaced with the inserted code, the website automation control module repeats the user behavior simulation test.

[0026] Step 4: Interact with the website automation control through the user behavior analysis module to obtain key network elements and log records and generate results. The specific operations include:

[0027] 4.1 Collect the results of the front-end code analysis module website front-end code analysis and summarize the key elements of user-clickable network behavior.

[0028] 4.2 Collect the diaries generated by the logging code of the dynamic instrumentation, analyze the diaries, and collect the key parameters that users use to interact with the backend information.

[0029] 4.3 Based on the above collected results, all potential user network behaviors are summarized.

[0030] After specific practical experiments, under the specific environment settings of Linux, the method was started in command line mode, combined with Python 3.8 and Selenium automation tools, and the runtime results of each module could be obtained during the operation. During the experiment, by simulating website automated access, dynamic plugging and code analysis, a JSON file containing detailed results was finally generated. The specific data is as follows: Key element extraction: The network-related element tags and their hyperlinks in the page were extracted, including cross-domain links and internal resource links. Form information collection: The user login form was found, including the user name, password and related parameter fields, and the encryption status was automatically marked and stored as structured data. Dynamic plugging log: The JavaScript file after plugging successfully recorded the network request log, including function calls and parameter information. Final output: A comprehensive JSON file was generated, containing the following content: Key hyperlinks in the website and their corresponding URLs. Form elements and attribute fields (such as encryption type, field name). Functions dynamically called by JavaScript and related parameter information. The experimental results show that the present invention can efficiently extract the key elements and dynamic behaviors of the website, providing comprehensive and reliable data support for subsequent security analysis and behavior research.

[0031] Compared with the prior art, the present invention supports a variety of Web application scenarios and optimizes the real-time adaptability to complex dynamic pages. Combined with the front-end user behavior analysis and security detection modules, the present invention can record user interaction behaviors and key network security events, generate behavior paths and interaction data through dynamic log analysis, and guide the automated testing module to achieve more comprehensive coverage. In addition, a modular architecture design is adopted to organically combine automated testing, front-end code analysis, dynamic plug-in analysis, and user behavior analysis modules. The modules work together to further enhance the flexibility and monitoring depth of the system. By fully integrating the interaction details between the user side and the server side, the present invention achieves accurate identification and rapid location of security threats, providing an efficient and real-time security monitoring solution for modern Web applications.

[0032] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. An automated front-end website user network behavior security detection system, characterized in that: include: Website automation testing module, front-end code analysis module, dynamic instrumentation analysis module and user behavior analysis module, wherein: the website automation testing module interacts with the website code analysis module based on the result information obtained after analysis by the front-end code analysis module and the dynamic instrumentation analysis module, performs page operations according to the instructions of the website code analysis module, and continuously collects newly loaded codes and outputs them to the website code analysis module; The front-end code analysis module performs static analysis on the collected front-end code, identifies key elements and elements related to network operations, and obtains JavaScript functions related to network operations; the dynamic instrumentation analysis module modifies the front-end code loaded by the browser according to the JavaScript function, inserts logging code into the JavaScript function, and replaces the original web page code with the JavaScript code obtained after instrumentation; the website automation testing module simulates the user's interaction with the website, collects the log information output by the code after instrumentation, and integrates the key network behavior-related elements obtained from the front-end code analysis to obtain all potential user network behaviors.

2. The automated front-end website user network behavior security detection system according to claim 1 is characterized in that: The website automation test module includes: a page analysis unit, a resource capture unit, an interaction simulation unit and a performance evaluation unit, wherein: the page analysis unit performs page loading sequence analysis according to website structure information to obtain page loading dependency results; the resource capture unit performs resource capture processing according to network request information in the page to obtain complete page resource data results; the interaction simulation unit performs click event simulation processing according to page element interaction information to obtain user interaction path results.

3. The automated front-end website user network behavior security detection system according to claim 1 is characterized in that: The front-end code analysis module includes: an HTML parsing unit, a key element extraction unit, a JavaScript analysis unit and a dependency analysis unit, wherein: the HTML parsing unit performs an abstract syntax tree (AST) generation process based on HTML source code information to obtain an HTML structure result; the key element extraction unit performs a key tag and element extraction process based on HTML structure information to obtain a network-related element result; the JavaScript analysis unit performs a data flow and call graph analysis process based on JavaScript source code information to obtain a network interaction function result; the dependency analysis unit performs a cross-module dependency analysis process based on the front-end code comprehensive information to obtain an interaction relationship result between modules.

4. The automated front-end website user network behavior security detection system according to claim 1 is characterized in that: The dynamic instrumentation analysis module comprises: a log insertion unit, a code replacement unit, a log collection unit and a call analysis unit, wherein: the log insertion unit performs log code insertion processing according to JavaScript function information to obtain the function code result after instrumentation; the code replacement unit performs source code replacement processing according to the JavaScript code after instrumentation to obtain the complete front-end code result after instrumentation; the log collection unit performs log data collection processing according to the instrumentation code running information to obtain the function call record result; the call analysis unit performs call relationship analysis processing according to the function call record information to obtain the network interaction behavior log result.

5. The automated front-end website user network behavior security detection system according to claim 1 is characterized in that: The user behavior analysis module includes: a behavior simulation unit, a parameter extraction unit, a behavior pattern mining unit and a report generation unit, wherein: the behavior pattern mining unit performs behavior pattern mining processing based on user interaction path information to obtain user behavior feature results; the report generation unit performs behavior analysis report generation processing based on user behavior comprehensive information to obtain user network behavior summary results.

6. An automated front-end website user network behavior security detection method based on the system described in any one of claims 1-5, characterized in that: include: Step 1: Load the website automation control module, open the website and simulate the user's automatic browsing of the web page; Step 2: Obtain the website source code through the website code analysis module and the website automation control interaction, analyze the website source code, and send the analysis results to the dynamic instrumentation analysis module. The specific operations include: 2.1 Automatically download the front-end source code of the website; 2.2 Perform program analysis on the HTML in the front-end source code of the website, convert the HTML source code into the form of an abstract syntax tree (AST), traverse the abstract syntax tree, find the key elements and tags related to the network, and send the found results to the user behavior analysis module for user network behavior collection and analysis; 2.3 Perform program analysis on the HTML in the front-end source code of the website, convert the HTML source code into the form of an abstract syntax tree (AST), traverse the abstract syntax tree, find the key elements and tags related to the network, and send the found results to the website automated testing module to guide the website automated testing module to continue exploring the website resources; 2.4 Perform program analysis on the front-end JavaScript source code of the website, use data flow analysis and call graph analysis to find potential network sending and receiving related functions in the code, and send the location of network-related JavaScript functions in the source code and the JavaScript source code to the dynamic instrumentation analysis module; Step 3: The user behavior analysis module interacts with the front-end code analysis module to perform code instrumentation on the network function; Step 4: Interact with website automation control through the user behavior analysis module to obtain key network elements and log records and generate results.

7. The automated front-end website user network behavior security detection method according to claim 6 is characterized in that: The step 3 specifically includes: 3.1 For the JavaScript function and JavaScript source code sent by the front-end code analysis module, insert the log code in the function body. This part of the log code records the parameter information when the current function is called; 3.2 For the inserted code, replace the JavaScript code of the current front-end website with the inserted JavaScript code; after the front-end source code of the website is replaced with the inserted code, the website automation control module repeats the user behavior simulation test.

8. The automated front-end website user network behavior security detection method according to claim 6 is characterized in that: The step 4 specifically includes: 4.1 Collect the results of the front-end code analysis module website front-end code analysis and summarize the key elements of user-clickable network behavior; 4.2 Collect the diaries generated by the logging code of the dynamic instrumentation, analyze the diaries, and collect the key parameters used by users to interact with the backend information; 4.3 Based on the above collected results, all potential user network behaviors are summarized.

Images