Browser data collection method and device, data collector and storage medium

Abstract

The invention provides a browser data collection method and device, a data collector and a storage medium. The browser data collection method comprises the steps that S101, browser starting operation is captured; s102, browser starting parameters are set, and remote debugging is started; s103, according to the definition of the operation object, executing S104 to S105 by the browser object; executing S106 to S107 by the page object; s104, sending a request to a browser to obtain a remote debugging URL (Uniform Resource Locator) of the browser object; s105, establishing a connection with the obtained browser object URL, and sending a method to obtain data of the browser object; s106, sending a request to a browser to obtain a remote debugging URL of the page object; and S107, establishing connection with the obtained page object URL, and registering an event to obtain page object data. The browser data can be efficiently obtained in real time based on the remote debugging protocol of the browser.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a browser data collection method, device, data collector and storage medium. Background Art

[0002] The advent of the Internet era has broken the time and space barriers of information dissemination. Users can easily communicate with the outside world through the Internet, and browsers, as windows to access the Internet, undoubtedly play an important role in this. Therefore, research on browser data acquisition in the field of electronic data forensics and evidence storage is particularly critical.

[0003] At present, the more mature solutions in the industry include obtaining relevant data by parsing the database files in the browser installation directory. However, since some database contents are not stored in plain text, researchers need to further analyze the specific decryption algorithm. In addition, some solutions obtain relevant data by installing customized browser plug-ins. In addition, there are some solutions that capture browser data by setting up local proxy services. Of course, in order to capture https traffic, it is often necessary to import specific certificates, so as to use the principle of man-in-the-middle attack to decrypt https traffic.

[0004] In general, existing browser data collection technologies have great limitations, mainly including the following problems:

[0005] (1) The method of parsing the browser database file lacks integrity. If the user sets the browser to automatically clear data after exiting or accesses the Internet through the browser incognito mode, the relevant data will not be saved in the database. In addition, as the browser version changes, the database encryption algorithm may also change, requiring regular tracking and maintenance.

[0006] (2) Both the browser plug-in method and the local proxy server method require additional configuration operations and there is a possibility of conflict. For example, if the user's browser environment requires a proxy to access the network, then there will be a conflict with the local proxy service. Summary of the invention

[0007] In order to solve the above technical problems, the present invention provides a browser data collection method, device, data collector and storage medium, which are based on the browser's remote debugging protocol and can directly and efficiently obtain browser data in real time without complicated configuration operations.

[0008] The present invention adopts the following technical solution:

[0009] In a first aspect, a browser data collection method includes:

[0010] S101, capturing a browser startup operation;

[0011] S102, after capturing the browser startup, opening the browser's remote debugging port by setting the browser's startup command option parameters;

[0012] S103, obtaining the type of the operation object, if the type of the operation object is a browser object, executing S104 to S105; if the type of the operation object is a page object, executing S106 to S107;

[0013] S104, sending a corresponding message to the remote debugging port to obtain the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened;

[0014] S105, establishing a first WebSocket connection with the URL address of the acquired browser object; using the established first WebSocket connection, sending a corresponding message based on the browser remote debugging protocol to acquire relevant data under the browser object;

[0015] S106, sending a corresponding message to the remote debugging port to obtain the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened;

[0016] S107, establishing a second WebSocket connection with the URL address of the acquired page object; using the established second WebSocket connection, sending a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

[0017] Preferably, capturing the browser startup operation specifically includes:

[0018] Perform a hook operation on the process creation function. If the expected browser process name appears in the application name parameter, it means that the browser startup operation is captured.

[0019] Preferably, opening the remote debugging port of the browser based on the browser remote debugging specification specifically includes:

[0020] Based on the browser remote debugging specification, add a startup command option parameter to the startup parameters of the browser process corresponding to the started browser process name to open the browser's remote debugging port.

[0021] Preferably, in S106, if after sending the corresponding message request based on the browser remote debugging specification, the returned result includes the URL address of the page object and the URL address of the non-page object, the URL address of the page object is filtered out according to the type field.

[0022] Preferably, after S105, the method further includes: starting a first timer to periodically acquire data under the browser object.

[0023] Preferably, after S107, the process further includes: starting a second timer to periodically update the life cycle of each page object.

[0024] Preferably, after S105 and / or S107, the following steps are further included:

[0025] The collected browser data is reported to the background data analysis module through the socket using the defined json format, so that the background data analysis module can perform report statistics, web page evidence storage and data correlation information mining.

[0026] In a second aspect, a browser data collection device includes:

[0027] The browser startup capture module is used to capture the browser startup operation;

[0028] A remote debugging port opening module is used to open the remote debugging port of the browser based on the browser remote debugging specification after capturing the browser startup;

[0029] The operation object category judgment module, according to the object category defined in the browser source code, if the operation object category is a browser object, executes the browser object URL acquisition module and the browser object data acquisition module; if the operation object category is a page object, executes the page object URL acquisition module and the page object data acquisition module;

[0030] The browser object URL acquisition module sends the corresponding message to the remote debugging port to obtain the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened;

[0031] The browser object data acquisition module is used to establish a first WebSocket connection with the URL address of the acquired browser object; use the established first WebSocket connection to send a corresponding message based on the browser remote debugging protocol to obtain relevant data under the browser object;

[0032] The page object URL acquisition module sends the corresponding message to the remote debugging port to obtain the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened;

[0033] The page object data acquisition module is used to establish a second WebSocket connection with the URL address of the acquired page object; use the established second WebSocket connection to send a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

[0034] In a third aspect, a data collector includes: a memory, a processor, and a data collection program stored in the memory and executable on the processor, wherein the data collection program is configured to implement the browser data collection method.

[0035] In a fourth aspect, a storage medium stores a data collection program, and when the data collection program is executed by a processor, the browser data collection method is implemented.

[0036] The present invention has the following beneficial effects:

[0037] (1) The present invention is based on the remote debugging protocol provided by the browser, and uses the method and event interface provided by the browser remote debugging protocol to achieve real-time capture and timed capture of browser data;

[0038] (2) Compared with the method of parsing the browser database, the present invention has a better effect on data integrity and can achieve real-time collection without worrying about data being deleted afterwards;

[0039] (3) Compared with the browser plug-in and local proxy service methods, the present invention does not require complicated configuration operations and is simpler and more convenient to implement;

[0040] (4) The background data processing module of the present invention can perform report statistics, data mining analysis and data storage to intuitively display the data for easy observation;

[0041] (5) The present invention can efficiently and comprehensively obtain transparent message data, browsing records, download records, cookies and other operational behavior data sent and received by the browser, and perform report statistics, data mining and analysis, and data storage through the background data processing module, thereby realizing real-time dynamic display and storage.

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is an application scenario diagram of the browser data collection method according to an embodiment of the present invention;

[0044] Figure 2 A basic flow chart of the browser data collection method according to an embodiment of the present invention;

[0045] Figure 3 is an example flow chart of a browser data collection method according to an embodiment of the present invention;

[0046] Figure 4 It is a structural block diagram of a browser data acquisition device according to an embodiment of the present invention;

[0047] Figure 5 A schematic diagram of the structure of a browser data collection and evidence storage system according to an embodiment of the present invention;

[0048] Figure 6 Schematic diagram of the structure of a data collector according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention; it is obvious that the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments, and all other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making creative work are within the scope of protection of the present invention.

[0050] In the description of the present invention, it should be noted that the terms "comprises", "includes" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0051] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, step identifiers S101, S102, S103, etc. are only used for convenient expression and do not represent the execution order. The corresponding execution order can be adjusted as needed.

[0052] like Figure 1As shown, it is the basic framework of the browser data collection of the present invention. This is a typical C / S architecture, in which the browser with remote debugging function turned on acts as the server, and the data collector acts as the client. The two interact through the remote debugging protocol. This framework is applicable to common browsers such as Chrome, Edge, Firefox, Opera, etc. Among them, Chrome, Edge, Opera and other browsers based on the Chromium kernel support the Chrome DevTools Protocol (CDP) remote debugging protocol. Since the protocol is the same, the data collector will uniformly process these browsers, and the Firefox browser based on the Gecko kernel originally also supports the CDP remote protocol, but the Firefox remote debugging protocol supported in the latest version is different from CDP. The data collector will call the corresponding interaction protocol according to the different browser process names.

[0053] Specifically, you can learn how to enable the remote debugging function according to the document of the browser remote debugging protocol. Taking the browser based on the Chromium kernel as an example, you only need to add "--remote-debugging-port=9222" in the startup parameters of the browser program (such as chrome.exe, msedge.exe, etc.). In this way, the browser object and each page object in the browser will be assigned the corresponding webSocketDebuggerUrl. By connecting these uniform resource locators URLs, that is, WebSocket connections, you can send protocol packets in a specific format according to the protocol document to obtain the desired browser data. For example, the protocol packet for obtaining version data is {"id":1,"method":"Browser.getVersion"}.

[0054] See also Figure 2 As shown, based on the above framework, the present invention discloses a browser data collection method, which is applied to a data collector and includes:

[0055] S101, capturing a browser startup operation;

[0056] S102, after capturing the browser startup, opening the browser's remote debugging port by setting the browser's startup command option parameters;

[0057] S103, obtaining the type of the operation object, if the type of the operation object is a browser object, executing S104 to S105; if the type of the operation object is a page object, executing S106 to S107;

[0058] S104, sending a corresponding message to the remote debugging port to obtain the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened;

[0059] S105, establishing a first WebSocket connection with the URL address of the acquired browser object; using the established first WebSocket connection, sending a corresponding message based on the browser remote debugging protocol to acquire relevant data under the browser object;

[0060] S106, sending a corresponding message to the remote debugging port to obtain the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened;

[0061] S107, establishing a second WebSocket connection with the URL address of the acquired page object; using the established second WebSocket connection, sending a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

[0062] Furthermore, the browser startup operation is captured, including:

[0063] Perform a hook operation on the process creation function. If the expected browser process name appears in the application name parameter, it means that the browser startup operation is captured.

[0064] Open the browser's remote debugging port based on the browser remote debugging specification, including:

[0065] Based on the browser remote debugging specification, add a startup command option parameter to the startup parameters of the browser process corresponding to the started browser process name to open the browser's remote debugging port.

[0066] In S106, if after sending the corresponding message request based on the browser remote debugging specification, the returned result includes the URL address of the page object and the URL address of the non-page object, the URL address of the page object is filtered out according to the type field.

[0067] After S105, the method further includes: starting a first timer to periodically acquire data under the browser object.

[0068] After S107, the process further includes: starting a second timer to periodically update the life cycle of each page object.

[0069] It should be noted that the first timer and the second timer can be the same timer or different timers, and can be set according to specific needs, which is not limited in this embodiment.

[0070] After S105 and / or S107, the following steps may be further included:

[0071] The collected browser data is reported to the background data analysis module through the socket using the defined json format, so that the background data analysis module can perform report statistics, web page evidence storage and data correlation information mining.

[0072] See also Figure 3 As shown, the working principle of the browser data collection method in the present invention is described in detail below using the Chrome DevTools Protocol (CDP) remote debugging protocol as an example. These operation steps are all in Figure 1 is executed in the data logger.

[0073] (1) In this step, it is necessary to capture the startup behavior of the browser on the operating system. For Windows systems, a hook operation can be performed on the process creation function CreateProcess. If the expected browser process name (such as chrome.exe, msedge.exe, etc.) appears in the application name parameter, it means a hit, and proceed to the next step.

[0074] (2) In this step, based on the hook in the previous step, add "--remote-debugging-port = 9222" to the startup parameters to enable the remote debugging function of the browser.

[0075] (3) In this step, the processing branch of the browser object or the page object is entered according to the type of the operation object. According to the specific demand scenario, the processing branch can further expand the object support, such as iframe object, webview object, etc.

[0076] It should be noted that the operation object category is defined in the browser source code.

[0077] (4) In this step, an http request of GET / json / version message is sent to the remote debugging port 9222 to obtain the webSocketDebuggerUrl of the browser object.

[0078] (5) In this step, it is necessary to establish a WebSocket connection with the URL obtained in (4), and then send protocol messages for interaction. The remote debugging protocol interface provides many methods for obtaining browser data, such as the Storage.getCookies method for obtaining cookies and the Browser.getVersion method for obtaining browser version information. By specifying such method interfaces in the message, some specific data can be collected.

[0079] (6) In this step, since the browser data will be continuously increased and changed with the user's operation, a timer is set to re-collect the changed data at regular intervals.

[0080] (7) In this step, an http request of GET / json / list message is sent to the remote debugging port 9222 to obtain the webSocketDebuggerUrl of the page object. Since the returned result also includes the webSocketDebuggerUrl of non-page objects, the page object is filtered out according to the returned type field.

[0081] (8) In this step, it is necessary to collect some interesting data on the web page, so event callback processing is performed. When a specific browser behavior is triggered, the written processing function can be entered to collect data. The remote debugging protocol provides strong support in this regard. For example, by registering the Network.requestWillBeSent event and the Network.responseReceived event, all network traffic data on the browser can be collected. Of course, before registering the event, it is also necessary to establish a WebSocket connection with the URL obtained in (7) before protocol interaction can be performed.

[0082] (9) In this step, since the opened browser page, i.e., the page object, is constantly changing with the user's operation, it is necessary to set a timer to ensure that the currently processed browser page object remains up to date.

[0083] The above is the principle of data collection by means of the CDP remote debugging protocol. The remote (debugging) protocols of other browser kernels also collect data on the browser through the methods and event interfaces provided by the protocols. This embodiment will not give examples one by one.

[0084] See also Figure 4 As shown, this embodiment also discloses a browser data collection system, including:

[0085] The browser startup capture module 401 is used to capture the browser startup operation;

[0086] A remote debugging port opening module 402 is used to open the remote debugging port of the browser based on the browser remote debugging specification after capturing the browser startup;

[0087] The operation object category determination module 403 executes the browser object URL acquisition module and the browser object data acquisition module according to the object category defined in the browser source code if the operation object category is a browser object; if the operation object category is a page object, executes the page object URL acquisition module and the page object data acquisition module;

[0088] The browser object URL acquisition module 404 sends a corresponding message to the remote debugging port to acquire the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened;

[0089] The browser object data acquisition module 405 is used to establish a first WebSocket connection with the URL address of the acquired browser object; use the established first WebSocket connection to send a corresponding message based on the browser remote debugging protocol to acquire relevant data under the browser object;

[0090] The page object URL acquisition module 406 sends a corresponding message to the remote debugging port to acquire the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened;

[0091] The page object data acquisition module 407 is used to establish a second WebSocket connection with the URL address of the acquired page object; use the established second WebSocket connection to send a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

[0092] A specific implementation of a browser data collection system and a browser data collection method are described in detail in this embodiment.

[0093] Based on the above browser data collection, see Figure 5 As shown, this embodiment also constructs a browser data collection and evidence storage system.

[0094] During the 501 stage, users perform various operations on the browser.

[0095] In stage 502, Figure 1The data collector captures the user's browser operation data and page printing and saving in the 501 stage based on the remote debugging protocol.

[0096] In the 503 stage, the data collector reports the data collected in the 502 stage to the background data analysis module through the socket in the pre-defined JSON format.

[0097] In the 504 stage, the background data analysis module receives the browser data in the 503 stage for report statistics, web page evidence storage, etc., and further mines the correlation information between the data.

[0098] and Figure 2 The embodiment shown is consistent with that shown in FIG. Figure 6 , which is a schematic diagram of the structure of a data collector provided in an embodiment. The data collector 600 includes a processor 610, a memory 620 and a communication interface 630. The processor 610, the memory 620 and the communication interface 630 are interconnected via a bus 650.

[0099] The memory 620 stores a data collection program 640, which is configured to be executed by the processor 610. The data collection program 640 includes instructions for executing a browser data collection method.

[0100] In addition, an embodiment of the present application further provides a storage medium, on which a data collection program is stored, and when the data collection program is executed by a processor, the browser data collection method is implemented.

[0101] The above is only a preferred specific implementation of the present invention; however, the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical solution and its improved conception within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A browser data collection method, characterized in that: include: S101, capturing a browser startup operation; S102, after capturing the browser startup, opening the browser's remote debugging port by setting the browser's startup command option parameters; S103, obtaining the type of the operation object, if the type of the operation object is a browser object, executing S104 to S105; if the type of the operation object is a page object, executing S106 to S107; S104, sending a corresponding message to the remote debugging port to obtain the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened; S105, establishing a first WebSocket connection with the URL address of the acquired browser object; Using the first established WebSocket connection, sending a corresponding message based on the browser remote debugging protocol to obtain relevant data under the browser object; S106, sending a corresponding message to the remote debugging port to obtain the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened; S107, establishing a second WebSocket connection with the URL address of the acquired page object; using the established second WebSocket connection, sending a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

2. The browser data collection method according to claim 1, characterized in that: Capture browser startup operations, including: Perform a hook operation on the process creation function. If the expected browser process name appears in the application name parameter, it means that the browser startup operation is captured.

3. The browser data collection method according to claim 2, characterized in that: Open the browser's remote debugging port based on the browser remote debugging specification, including: Based on the browser remote debugging specification, add a startup command option parameter to the startup parameters of the browser process corresponding to the started browser process name to open the browser's remote debugging port.

4. The browser data collection method according to claim 1, characterized in that: In S106, if after sending the corresponding message request based on the browser remote debugging specification, the returned result includes the URL address of the page object and the URL address of the non-page object, the URL address of the page object is filtered out according to the type field.

5. The browser data collection method according to claim 1, characterized in that: After S105, the method further includes: starting a first timer to periodically acquire data under the browser object.

6. The browser data collection method according to claim 1, characterized in that: After S107, the process further includes: starting a second timer to periodically update the life cycle of each page object.

7. The browser data collection method according to claim 1, characterized in that: After S105 and / or S107, the following steps may be further included: The collected browser data is reported to the background data analysis module through the socket using the defined json format, so that the background data analysis module can perform report statistics, web page evidence storage and data correlation information mining.

8. A browser data collection device, characterized in that: include: The browser startup capture module is used to capture the browser startup operation; A remote debugging port opening module is used to open the remote debugging port of the browser based on the browser remote debugging specification after capturing the browser startup; The operation object category judgment module executes the browser object URL acquisition module and the browser object data acquisition module according to the object category defined in the browser source code if the operation object category is a browser object; If the operation object category is a page object, execute the page object URL acquisition module and the page object data acquisition module; The browser object URL acquisition module sends the corresponding message to the remote debugging port to obtain the URL address of the browser object based on the browser remote debugging specification; the URL address of the browser object is assigned when the browser is opened; The browser object data acquisition module is used to establish a first WebSocket connection with the URL address of the acquired browser object; use the established first WebSocket connection to send a corresponding message based on the browser remote debugging protocol to obtain relevant data under the browser object; The page object URL acquisition module sends the corresponding message to the remote debugging port to obtain the URL address of the page object based on the browser remote debugging specification; the URL address of each page object is assigned when the corresponding browser Tab page is opened; The page object data acquisition module is used to establish a second WebSocket connection with the URL address of the acquired page object; use the established second WebSocket connection to send a message based on the browser remote debugging protocol to register a corresponding callback event to obtain relevant data under the page object.

9. A data collector, characterized in that: include: A memory, a processor, and a data collection program stored in the memory and executable on the processor, wherein the data collection program is configured to implement the browser data collection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a data collection program, and when the data collection program is executed by the processor, the browser data collection method according to any one of claims 1 to 7 is implemented.

Images