Automated front-end website user network behavior security detection system

Abstract

An automated front-end website user network behavior security detection system includes: a website automated testing module, a front-end code analysis module, a dynamic instrumentation analysis module, and a user behavior analysis module. The website automated testing module interacts with the website code analysis module based on the results obtained from the analysis by the front-end code analysis module and the dynamic instrumentation analysis module. It executes page operations according to the instructions of the website code analysis module and continuously collects newly loaded code, outputting it to the website code analysis module. The front-end code analysis module performs static analysis on the collected front-end code, identifying key elements and network operation-related elements to obtain JavaScript functions related to network operations. The dynamic instrumentation analysis module modifies the browser-loaded front-end code according to the JavaScript functions, inserting logging code into the JavaScript functions and replacing the original front-end webpage code with the instrumented JavaScript code. The website automated testing module simulates user interaction with the website, collecting log information from the instrumented code output, and combining this with the key network behavior-related elements obtained from the front-end code analysis to obtain all potential user network behaviors. This invention achieves comprehensive and real-time monitoring of user behavior through automation technology, and automatically detects and responds to potential security threats.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically an automated front-end website user network behavior security detection system. Background Technology

[0002] With the rapid development of internet technology, front-end websites play a crucial role in various fields such as e-commerce, financial services, social media, and online education. As the interface through which users directly interact with the system, the performance, user experience (UX), and security of the front-end directly impact the success of a website. To improve user experience and ensure system security, front-end user behavior monitoring and security testing have become essential components of modern web applications. User behavior monitoring aims to collect and analyze user action data on the front-end interface, such as clicks, scrolling, form input, and page dwell time, to optimize interface design and improve conversion rates. Meanwhile, security testing focuses on detecting and protecting against potential security threats, preventing data breaches, malicious attacks, and other security incidents, ensuring the security of user data and the system.

[0003] Current front-end user behavior monitoring primarily relies on methods such as logging, third-party monitoring tools (e.g., Google Analytics, Hotjar), and page event listening. While these methods meet the needs of data collection and analysis to some extent, they have several shortcomings in terms of comprehensiveness, real-time performance, performance impact, and flexibility. For example, logging requires manual insertion of monitoring points, resulting in high maintenance costs and difficulty in covering all user behaviors; third-party tools, while feature-rich, may raise data privacy and security concerns and lack flexibility in highly customized application scenarios; and page event listening can easily lead to performance degradation in complex applications and struggles to dynamically adapt to changes in page structure. Existing technologies for obtaining JavaScript function call paths have low scalability and are difficult to adapt to diverse application needs; they only focus on function call paths and fail to capture actual user network behavior; they lack consistency in call paths when handling asynchronous operations and dynamic elements; and the instrumentation process has a significant impact on performance. Summary of the Invention

[0004] To address the aforementioned shortcomings of existing technologies, this invention proposes an automated front-end website user network behavior security detection system. Through automation technology, it achieves comprehensive and real-time monitoring of user behavior and automatically detects and responds to potential security threats.

[0005] This invention is achieved through the following technical solution:

[0006] This invention relates to an automated front-end website user network behavior security detection system, comprising: a website automated testing module, a front-end code analysis module, a dynamic instrumentation analysis module, and a user behavior analysis module. Specifically: the website automated testing module interacts with the website code analysis module based on the results obtained from the analysis by the front-end code analysis module and the dynamic instrumentation analysis module, executing page operations according to the instructions of the website code analysis module and continuously collecting newly loaded code, outputting it to the website code analysis module; the front-end code analysis module performs static analysis on the collected front-end code, identifying key elements and network operation-related elements, and obtaining JavaScript functions related to network operations; the dynamic instrumentation analysis module modifies the browser-loaded front-end code according to the JavaScript functions, inserting logging code into the JavaScript functions, and replacing the original front-end webpage code with the instrumented JavaScript code; the website automated testing module simulates user interaction with the website, collecting log information from the instrumented code output, and combining this with the key network behavior-related elements obtained from the front-end code analysis to obtain all potential user network behaviors.

[0007] Technical effect

[0008] This invention utilizes automated control and dynamic instrumentation technologies to automatically inject monitoring and detection logic without requiring extensive manual modification of front-end code, significantly reducing development and maintenance costs. It achieves automated control of the target website, performs dynamic and static analysis on the loaded front-end code, extracts user network behavior, and performs security checks. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the system of the present invention;

[0010] Figure 2 This is a flowchart of an implementation example;

[0011] Figures 3-7 This is a schematic diagram illustrating the effect of an example. Detailed Implementation

[0012] like Figure 1 As shown in the figure, this embodiment relates to an automated front-end website user network behavior security detection system, which includes: a website automated testing module, a front-end code analysis module, a dynamic instrumentation analysis module, and a user behavior analysis module.

[0013] The website automated testing module includes: a page analysis unit, a resource crawling unit, an interaction simulation unit, and a performance evaluation unit. Specifically: the page analysis unit analyzes the page loading order based on the website structure information to obtain the page loading dependency results; the resource crawling unit performs resource crawling processing based on the network request information in the page to obtain the complete page resource data results; and the interaction simulation unit performs click event simulation processing based on the page element interaction information to obtain the user interaction path results.

[0014] The aforementioned front-end code analysis module includes: an HTML parsing unit, a key element extraction unit, a JavaScript analysis unit, and a dependency analysis unit. Specifically: the HTML parsing unit performs Abstract Syntax Tree (AST) generation based on the HTML source code information to obtain the HTML structure result; the key element extraction unit performs key tag and element extraction based on the HTML structure information to obtain network-related element results; the JavaScript analysis unit performs data flow and call graph analysis based on the JavaScript source code information to obtain network interaction function results; and the dependency analysis unit performs cross-module dependency analysis based on comprehensive front-end code information to obtain inter-module interaction relationship results.

[0015] The dynamic instrumentation analysis module includes: a log insertion unit, a code replacement unit, a log collection unit, and a call analysis unit. Specifically: the log insertion unit inserts log code based on JavaScript function information to obtain the instrumented function code; the code replacement unit replaces the source code based on the instrumented JavaScript code to obtain the complete instrumented front-end code; the log collection unit collects and processes log data based on the instrumented code's execution information to obtain function call record results; and the call analysis unit analyzes call relationships based on the function call record information to obtain network interaction behavior log results.

[0016] The user behavior analysis module includes: a behavior simulation unit, a parameter extraction unit, a behavior pattern mining unit, and a report generation unit. The behavior pattern mining unit performs behavior pattern mining processing based on user interaction path information to obtain user behavior feature results. The report generation unit performs behavior analysis report generation processing based on comprehensive user behavior information to obtain user network behavior summary results.

[0017] like Figure 2 As shown, this embodiment illustrates a security detection method based on the aforementioned system, comprising:

[0018] Step 1: Load the website automation control module, open the website, and simulate a user automatically browsing web pages;

[0019] Step 2: Obtain the website source code through the website code analysis module and the website automation control, analyze the website source code, and send the analysis results to the dynamic instrumentation analysis module. Specific operations include:

[0020] 2.1 Automated download website front-end source code.

[0021] 2.2 Perform program analysis on the HTML in the website's front-end source code, convert the HTML source code into an abstract syntax tree (AST), traverse the AST to discover key network-related elements and tags, and send the discovered results to the user behavior analysis module for user network behavior collection and analysis.

[0022] 2.3 Perform program analysis on the HTML in the website's front-end source code, convert the HTML source code into an abstract syntax tree (AST), traverse the AST to discover key network-related elements and tags, and send the findings to the website automation testing module to guide the module in further exploring website resources.

[0023] 2.4 Perform program analysis on the website's front-end JavaScript source code, use data flow analysis and call graph analysis to discover potential network sending and receiving functions in the code, and send the location of network-related JavaScript functions in the source code and the JavaScript source code to the dynamic instrumentation analysis module.

[0024] Step 3: Interact with the front-end code analysis module through the user behavior analysis module to instrument network functions. Specific operations include:

[0025] 3.1 For the JavaScript functions and JavaScript source code sent by the front-end code analysis module, log code is inserted into the function body. This log code records the parameter information when the current function is called.

[0026] 3.2 For the instrumented code, replace the current front-end JavaScript code with the instrumented JavaScript code. After the website's front-end source code is replaced with the instrumented code, the website's automation control module repeatedly performs user behavior simulation tests.

[0027] Step 4: Interact with the website's automation control through the user behavior analysis module to obtain key network elements and log records, and generate results. Specific operations include:

[0028] 4.1 Collect the results of the front-end code analysis of the website and summarize the key elements of user-clickable network behavior.

[0029] 4.2 Collect logs generated by the dynamic instrumentation code, analyze the logs, and collect key parameters used by users to interact with the backend.

[0030] 4.3 Based on the results collected above, all potential user network behaviors are summarized.

[0031] Through practical experiments, under a specific Linux environment setting, the method was launched via command line, combined with Python 3.8 and the Selenium automation tool, and the runtime results of each module were obtained during the operation. During the experiment, through simulated automated website access, dynamic instrumentation, and code analysis, a JSON file containing detailed results was generated. Specific data is as follows: Key element extraction: Network-related element tags and their hyperlinks were extracted from the page, including cross-domain links and internal resource links. Form information collection: User login forms were discovered, including username, password, and related parameter fields, automatically marked with encryption status, and stored as structured data. Dynamic instrumentation logs: The instrumented JavaScript file successfully recorded network request logs, including function calls and parameter information. Final output: A comprehensive JSON file was generated, containing the following: Key hyperlinks in the website and their corresponding URLs. Form elements and attribute fields (such as encryption type and field name). Dynamically called JavaScript functions and related parameter information. Experimental results show that this invention can efficiently extract key elements and dynamic behaviors of a website, providing comprehensive and reliable data support for subsequent security analysis and behavioral research.

[0032] Compared to existing technologies, this invention supports diverse web application scenarios and optimizes real-time adaptability to complex dynamic pages. Combining front-end user behavior analysis and security detection modules, this invention can record user interaction behaviors and critical network security events, generating behavioral paths and interaction data through dynamic log analysis, and guiding the automated testing module to achieve more comprehensive coverage. Furthermore, adopting a modular architecture design, it organically combines automated testing, front-end code analysis, dynamic instrumentation analysis, and user behavior analysis modules, with each module working collaboratively to further enhance the system's flexibility and monitoring depth. By comprehensively integrating the interaction details between the user end and the server end, this invention achieves accurate identification and rapid location of security threats, providing an efficient and real-time security monitoring solution for modern web applications.

[0033] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principles and purpose of the present invention. The scope of protection of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. All implementation schemes within its scope shall be subject to the constraints of the present invention.

Claims

1. An automated method for detecting user network behavior security on a front-end website, characterized in that, include: Step 1: Load the website automation control module, open the website, and simulate a user automatically browsing web pages; Step 2: Obtain the website source code through the website code analysis module and the website automation control, analyze the website source code, and send the analysis results to the dynamic instrumentation analysis module. Specific operations include: 2.1 Automated download website front-end source code; 2.2 Perform program analysis on the HTML in the website front-end source code, convert the HTML source code into an abstract syntax tree (AST), traverse the abstract syntax tree to discover key network-related elements and tags, and send the discovered results to the user behavior analysis module for user network behavior collection and analysis; 2.3 Perform program analysis on the HTML in the website's front-end source code, convert the HTML source code into an abstract syntax tree (AST), traverse the AST to discover key network-related elements and tags, and send the findings to the website automation testing module to guide the module in further exploring website resources; 2.4 Perform program analysis on the website front-end JavaScript source code, use data flow analysis and call graph analysis to discover potential network sending and receiving functions in the code, and send the location of network-related JavaScript functions in the source code and the JavaScript source code to the dynamic instrumentation analysis module; Step 3: Interact with the front-end code analysis module through the user behavior analysis module to perform code instrumentation on network functions, specifically including: 3.1 For the JavaScript functions and JavaScript source code sent by the front-end code analysis module, log code is inserted into the function body. This part of the log code records the parameter information when the current function is called. 3.2 For the instrumented code, replace the current front-end website's JavaScript code with the instrumented JavaScript code; after the website's front-end source code is replaced with the instrumented code, the website's automation control module repeats the user behavior simulation test; Step 4: Interact with the website's automation control through the user behavior analysis module to obtain key network elements and log records, and generate results, specifically including: 4.1 Collect the results of the website front-end code analysis module and summarize the key elements of user-clickable web behavior; 4.2 Collect logs generated by the dynamic instrumentation code, analyze the logs, and collect key parameters used by users to interact with the backend. 4.3 Based on the results collected above, all potential user network behaviors are summarized.

2. An automated front-end website user network behavior security detection system implementing the method of claim 1, characterized in that, include: The system includes a website automation testing module, a front-end code analysis module, a dynamic instrumentation analysis module, and a user behavior analysis module. The website automation testing module interacts with the website code analysis module based on the results obtained from the analysis by the front-end code analysis module and the dynamic instrumentation analysis module. It executes page operations according to the instructions of the website code analysis module and continuously collects newly loaded code and outputs it to the website code analysis module. The front-end code analysis module performs static analysis on the collected front-end code, identifying key elements and network operation-related elements to obtain the JavaScript functions related to network operations. The dynamic instrumentation analysis module modifies the front-end code loaded by the browser based on the JavaScript functions, inserting logging code into the JavaScript functions and replacing the original webpage code with the instrumented JavaScript code. The website automation testing module simulates user interaction with the website, collects log information from the instrumented code output, and combines the key network behavior-related elements obtained from the front-end code analysis to obtain all potential user network behaviors.

3. The automated front-end website user network behavior security detection system according to claim 2, characterized in that, The website automated testing module includes: a page analysis unit, a resource crawling unit, an interaction simulation unit, and a performance evaluation unit. Specifically: the page analysis unit analyzes the page loading order based on the website structure information to obtain the page loading dependency results; the resource crawling unit performs resource crawling processing based on the network request information in the page to obtain the complete page resource data results; and the interaction simulation unit performs click event simulation processing based on the page element interaction information to obtain the user interaction path results.

4. The automated front-end website user network behavior security detection system according to claim 2, characterized in that, The aforementioned front-end code analysis module includes: an HTML parsing unit, a key element extraction unit, a JavaScript analysis unit, and a dependency analysis unit. Specifically: the HTML parsing unit performs Abstract Syntax Tree (AST) generation based on the HTML source code information to obtain the HTML structure result; the key element extraction unit performs key tag and element extraction based on the HTML structure information to obtain network-related element results; the JavaScript analysis unit performs data flow and call graph analysis based on the JavaScript source code information to obtain network interaction function results; and the dependency analysis unit performs cross-module dependency analysis based on comprehensive front-end code information to obtain inter-module interaction relationship results.

5. The automated front-end website user network behavior security detection system according to claim 2, characterized in that, The dynamic instrumentation analysis module includes: a log insertion unit, a code replacement unit, a log collection unit, and a call analysis unit. Specifically: the log insertion unit inserts log code based on JavaScript function information to obtain the instrumented function code; the code replacement unit replaces the source code based on the instrumented JavaScript code to obtain the complete instrumented front-end code; the log collection unit collects and processes log data based on the instrumented code's execution information to obtain function call record results; and the call analysis unit analyzes call relationships based on the function call record information to obtain network interaction behavior log results.

6. The automated front-end website user network behavior security detection system according to claim 2, characterized in that, The user behavior analysis module includes: a behavior simulation unit, a parameter extraction unit, a behavior pattern mining unit, and a report generation unit. The behavior pattern mining unit performs behavior pattern mining processing based on user interaction path information to obtain user behavior feature results. The report generation unit performs behavior analysis report generation processing based on comprehensive user behavior information to obtain user network behavior summary results.

Images