Webpage tampering monitoring method, computer program product, equipment and storage medium

Abstract

The embodiment of the invention provides a webpage tampering monitoring method, a computer program product, equipment and a storage medium. The method comprises the following steps: acquiring a page snapshot of a predetermined webpage according to a predetermined period; determining the page similarity between the current page snapshot and the historical page snapshot; detecting whether the page similarity reaches a preset similarity threshold value or not; under the condition that the page similarity does not reach a preset similarity threshold value, text content of a preset webpage is extracted; detecting whether sensitive words in a preset sensitive word library exist in the text content or not; under the condition that the sensitive words do not exist in the text content, whether the sensitive words exist in the text content or not is detected again through the preset semantic analysis model; under the condition that the sensitive words exist in the text content, it is determined that the preset webpage is tampered, and an alarm is given out. According to the embodiment of the invention, the unnecessary text analysis process is reduced, the accuracy of sensitive word matching is guaranteed, the detection efficiency is improved, the detection accuracy is improved, and the missing report condition is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, computer program product, device and storage medium for monitoring web page tampering. Background Art

[0002] Web page tampering refers to the event that a website's web pages are tampered with. By default, it means that the website is tampered with by an external attacker (hackers, etc.) without authorization and through illegal means, the page content is modified to achieve the purpose of the tamperer.

[0003] In website tampering monitoring, the existing technology usually crawls the page to obtain the text content of the page, segment the text content, detect whether there are sensitive words in the segmented words, and then determine whether the web page has been tampered with. However, this method requires text extraction, segmentation and sensitive word comparison operations for each detection, which is a large workload and low detection efficiency. Summary of the invention

[0004] In view of this, the embodiments of the present invention propose a web page tampering monitoring method, computer program product, device and storage medium to solve the following problems in the prior art: when the prior art monitors web page tampering, each detection process requires text extraction, word segmentation and sensitive word comparison operations, which has a large workload and low detection efficiency.

[0005] On the one hand, an embodiment of the present invention proposes a method for monitoring web page tampering, including: obtaining page snapshots of a predetermined web page according to a predetermined period; matching the obtained current page snapshot with the historical page snapshots obtained before the predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot; detecting whether the page similarity reaches a predetermined similarity threshold; if the page similarity does not reach the predetermined similarity threshold, extracting the text content of the predetermined web page; detecting whether there are sensitive words in a predetermined sensitive word library in the text content; if the sensitive words do not exist in the text content, detecting again whether there are sensitive words in the text content through a predetermined semantic analysis model, wherein the predetermined semantic analysis model is a model trained using synonyms or near-synonyms of each sensitive word in the predetermined sensitive word library; if the sensitive words exist in the text content, determining that the predetermined web page has been tampered with, and issuing an alarm.

[0006] In some embodiments, detecting whether a sensitive word in a predetermined sensitive word library exists in the text content includes: performing word segmentation processing on the text content to obtain multiple word segments; and matching the multiple word segments with the sensitive words in the predetermined sensitive word library respectively to determine whether the sensitive word exists in the multiple word segments.

[0007] In some embodiments, the re-detecting whether the sensitive word exists in the text content through a predetermined semantic analysis model includes: inputting multiple participles into the predetermined semantic analysis model respectively to re-determine whether the sensitive word exists in the multiple participles.

[0008] In some embodiments, after the alarm is issued, the method further includes: adding the segmented words corresponding to the alarm to the predetermined sensitive word library.

[0009] In some embodiments, the predetermined semantic analysis model is a model trained using the Word2Vec model.

[0010] In some embodiments, after detecting whether the page similarity reaches a predetermined similarity threshold, the method further includes: if the page similarity reaches the predetermined similarity threshold, determining that the predetermined web page has not been tampered with, and recording the detection result of the page similarity.

[0011] In some embodiments, after detecting again whether the sensitive word exists in the text content through a predetermined semantic analysis model, the method further includes: if the sensitive word does not exist in the text content, saving the analysis result of semantic analysis using the predetermined semantic analysis model.

[0012] On the other hand, an embodiment of the present invention provides a computer program product storing a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0013] On the other hand, an embodiment of the present invention provides a computer device, which includes at least a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above method when executing the computer program in the memory.

[0014] On the other hand, an embodiment of the present invention provides a storage medium, wherein the storage medium carries one or more computer programs, and the one or more computer programs implement the steps of the above method when executed by a processor.

[0015] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 A flowchart of a method for monitoring webpage tampering provided by a first embodiment of the present invention;

[0018] Figure 2 An exemplary flow chart of a method for monitoring webpage tampering provided by a first embodiment of the present invention;

[0019] Figure 3 A schematic diagram of the structure of a device for monitoring webpage tampering provided by a second embodiment of the present invention;

[0020] Figure 4 A schematic diagram of the structure of a computer device provided in a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0023] In order to keep the following description of the embodiments of the present invention clear and concise, detailed descriptions of well-known functions and well-known components are omitted.

[0024] The first embodiment of the present invention provides a method for monitoring webpage tampering, the process of which is as follows: Figure 1 As shown, steps S101 to S107 are included:

[0025] S101, obtaining a page snapshot of a predetermined web page according to a predetermined period.

[0026] The above-mentioned predetermined period can be set according to experience.

[0027] S102: Match the acquired current page snapshot with the historical page snapshot acquired before a predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot.

[0028] S103: Detect whether the page similarity reaches a predetermined similarity threshold.

[0029] The purpose of the above process is to detect whether the similarity between the current page snapshot and the historical page snapshot reaches a predetermined similarity threshold. For example, the predetermined similarity threshold can be set to 95%. As long as the predetermined similarity threshold reaches 95%, it can be determined that the predetermined web page has not been tampered with, and the detection result of the page similarity can be recorded; if the predetermined similarity threshold does not reach 95%, it can be determined that the predetermined web page has been tampered with, and further analysis of the tampered content is required, that is, the step S104 is executed. Preliminary determination of whether the predetermined web page has been tampered with by page similarity can reduce unnecessary analysis, that is, reduce the unnecessary detailed sensitive word analysis of the text content of the page snapshot, and greatly improve the detection efficiency.

[0030] S104: When the page similarity does not reach a predetermined similarity threshold, extract the text content of the predetermined web page.

[0031] This process can parse the page content, such as removing the DOM structure of the page, and then obtain the text content of the predetermined web page.

[0032] S105: Detect whether there are sensitive words in a predetermined sensitive word library in the text content.

[0033] In specific implementation, the text content is segmented to obtain a plurality of segmented words; and then the plurality of segmented words are matched with sensitive words in a predetermined sensitive word library to determine whether a sensitive word exists in the plurality of segmented words.

[0034] The technology of word segmentation for text content is relatively mature. For example, when the word segmentation tool is used to segment the text content of "I want to buy bananas and apples", multiple word segments of "I want to buy bananas and apples" will be obtained. The word segmentation is then matched with sensitive words in the predetermined sensitive word library to determine whether there are sensitive words in the word segmentation.

[0035] S106: When there are no sensitive words in the text content, a predetermined semantic analysis model is used to detect again whether there are sensitive words in the text content, wherein the predetermined semantic analysis model is a model trained by using synonyms or near synonyms of each sensitive word in a predetermined sensitive word library.

[0036] In specific implementation, multiple word segments can be input into a predetermined semantic analysis model to determine again whether there are sensitive words in the multiple word segments. The predetermined semantic analysis model can be a model trained using the Word2Vec model, and the predetermined semantic analysis model can identify synonyms and near-synonyms of sensitive words. By performing semantic similarity analysis between the word segment and the sensitive words in the predetermined sensitive word library, it is possible to further confirm whether the page contains sensitive words, thereby improving detection accuracy and reducing underreporting.

[0037] S107: When there are sensitive words in the text content, it is determined that the predetermined web page has been tampered with, and an alarm is issued.

[0038] After the alarm is issued, the segmented words corresponding to the alarm can be added to the predetermined sensitive word library. Since the segmented words with similar semantics to the sensitive words exist in the predetermined web page, once the segmented words are determined to be equivalent to the sensitive words, the segmented words can be included in the predetermined sensitive word library, which is conducive to the collection of sensitive words.

[0039] When there are no sensitive words in the text content, the analysis results of semantic analysis using a predetermined semantic analysis model are saved for subsequent manual review. The accuracy of the analysis results can be used to adjust the predetermined similarity threshold to further reduce unnecessary analysis processes and improve detection efficiency.

[0040] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy.

[0041] The above method of the embodiment of the present invention can be applied to a website monitoring system. Figure 2 The above process is exemplified and specifically includes the following process:

[0042] (1) The crawler crawls the web page links to capture content and web page snapshots.

[0043] (2) Determine whether it is the first detection. If it is the first detection, execute (3); if not, execute (4).

[0044] (3) No similarity matching detection is performed. Then the process returns to (1) to wait for the next cycle polling.

[0045] (4) Calculate the page similarity between the last page snapshot and the current page snapshot.

[0046] (5) Determine whether the two snapshots are consistent based on the page similarity and the predetermined similarity threshold. If they are consistent, execute (6); if they are inconsistent, execute (7).

[0047] (6) If the two pages are consistent, it is determined that the page has not been tampered with. Then the process returns to (1) to wait for the next periodic polling.

[0048] (7) In case of inconsistency, the content of the current page is parsed to extract the text content of the page.

[0049] (8) Perform word segmentation on the text content to obtain multiple word segments.

[0050] (9) Match the segmented word with the sensitive word library in the predetermined sensitive word library to determine whether the sensitive word exists. If the segmented word is in the predetermined sensitive word library, execute (10); if the segmented word is not in the predetermined sensitive word library, execute (11).

[0051] (10) Determine if the page has been tampered with, issue an alarm, and wait for manual confirmation.

[0052] (11) Perform semantic similarity analysis on the word segmentation and the sensitive words in the sensitive word library through a predetermined semantic analysis model.

[0053] (12) Determine whether the segmented word is a sensitive word based on the similarity. If the segmented word is a sensitive word, execute (13); if the segmented word is not a sensitive word, execute (14).

[0054] (13) Add the segmented words to the sensitive word library, confirm that the page has been tampered with, issue an alarm, and wait for manual confirmation.

[0055] (14) After confirming that the webpage has not been tampered with, the detection ends. Then the process returns to (1) to wait for the next polling cycle.

[0056] The embodiment of the present invention obtains two page snapshots of a predetermined web page, compares the two snapshots for similarity, and if the snapshots are consistent, no subsequent tampering detection is performed, thereby improving detection efficiency; if the snapshots are inconsistent, the text content is segmented, the segmented words are matched with sensitive words, semantic similarity analysis is performed, and other operations are performed to analyze whether the predetermined web page contains sensitive words, and then determine whether the predetermined web page has been tampered with. This method improves detection accuracy and reduces underreporting.

[0057] The second embodiment of the present invention provides a device for monitoring webpage tampering, the structure of which is shown in FIG. Figure 3 As shown, including:

[0058] The acquisition module 10 is used to acquire a page snapshot of a predetermined web page according to a predetermined period; the matching module 20 is coupled with the acquisition module 10 and is used to match the acquired current page snapshot with the historical page snapshot acquired before the predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot; the similarity detection module 30 is coupled with the matching module 20 and is used to detect whether the page similarity reaches a predetermined similarity threshold; the extraction module 40 is coupled with the similarity detection module 30 and is used to extract the text content of the predetermined web page when the page similarity does not reach the predetermined similarity threshold; the sensitive word detection module 30 is used to detect whether the page similarity reaches a ... Module 50 is coupled with the extraction module 40 and is used to detect whether there are sensitive words in a predetermined sensitive word library in the text content; the semantic analysis module 60 is coupled with the sensitive word detection module 50 and is used to detect whether there are sensitive words in the text content again through a predetermined semantic analysis model when there are no sensitive words in the text content, wherein the predetermined semantic analysis model is a model trained using synonyms or near-synonyms of each sensitive word in the predetermined sensitive word library; the alarm module 70 is coupled with the semantic analysis module 60 and is used to determine that a predetermined web page has been tampered with and issue an alarm when there are sensitive words in the text content.

[0059] The similarity detection module 30 can detect whether the similarity between the current page snapshot and the historical page snapshot reaches a predetermined similarity threshold. For example, the predetermined similarity threshold can be set to 95%. As long as the predetermined similarity threshold reaches 95%, it can be determined that the predetermined web page has not been tampered with, and the detection result of the page similarity can be recorded. Therefore, the above-mentioned device of the embodiment of the present invention can also apply a recording module to determine that the predetermined web page has not been tampered with when the page similarity reaches the predetermined similarity threshold, and record the detection result of the page similarity.

[0060] If the predetermined similarity threshold does not reach 95%, it can be determined that the predetermined webpage has been tampered with, and further analysis of the tampered content is required, that is, step S104 is executed. Preliminary determination of whether the predetermined webpage has been tampered with by page similarity can reduce unnecessary analysis, that is, reduce the unnecessary detailed sensitive word analysis of the page snapshot text content, greatly improving the detection efficiency.

[0061] When implemented, the sensitive word detection module 50 is specifically used to: perform word segmentation processing on the text content to obtain multiple word segments; match the multiple word segments with the sensitive words in the predetermined sensitive word library respectively to determine whether there are sensitive words in the multiple word segments. The technology of word segmentation of text content is relatively mature. For example, when the text content of "I want to buy bananas and apples" is segmented using a word segmentation tool, multiple word segments of "I want to buy bananas and apples" will be obtained. The word segments are then matched with the sensitive words in the predetermined sensitive word library to determine whether there are sensitive words in the word segments.

[0062] In the implementation process, the semantic analysis module 60 is specifically used to: input multiple word segments into a predetermined semantic analysis model respectively to determine again whether there are sensitive words in the multiple word segments. The above-mentioned predetermined semantic analysis model can be a model trained using the Word2Vec model, and the predetermined semantic analysis model can identify synonyms, near-synonyms, etc. of sensitive words. By performing semantic similarity analysis between the word segmentation and the sensitive words in the predetermined sensitive word library, it is possible to further confirm whether the page contains sensitive words, which can improve the detection accuracy and reduce the underreporting situation.

[0063] The embodiment of the present invention may also include an adding module for adding the segmentation corresponding to the alarm to the predetermined sensitive word library when an alarm is issued. Since the segmentation with similar semantics to the sensitive word exists in the predetermined web page, once the segmentation is determined to be equivalent to the sensitive word, the segmentation can be included in the predetermined sensitive word library, which is conducive to the collection of sensitive words.

[0064] The above-mentioned device of the embodiment of the present invention also includes a storage module, which is used to save the analysis results of semantic analysis using a predetermined semantic analysis model when there are no sensitive words in the text content. This analysis structure can be easily viewed during subsequent manual re-inspection, and the increase or decrease of the predetermined similarity threshold can be adjusted by whether the analysis result is accurate, further reducing unnecessary analysis processes and improving detection efficiency.

[0065] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy.

[0066] A third embodiment of the present invention provides a computer program product, which stores a computer program. When the computer program is executed by a processor, the method provided by any embodiment of the present invention is implemented, including the following steps S11 to S17:

[0067] S11, obtaining a page snapshot of a predetermined web page according to a predetermined period.

[0068] S12, matching the acquired current page snapshot with the historical page snapshot acquired before a predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot.

[0069] S13, detecting whether the page similarity reaches a predetermined similarity threshold.

[0070] S14: When the page similarity does not reach a predetermined similarity threshold, extract the text content of the predetermined web page.

[0071] S15, detecting whether there are sensitive words in a predetermined sensitive word library in the text content.

[0072] S16, when there are no sensitive words in the text content, a predetermined semantic analysis model is used to detect again whether there are sensitive words in the text content, wherein the predetermined semantic analysis model is a model trained using synonyms or near synonyms of each sensitive word in a predetermined sensitive word library.

[0073] S17, when there are sensitive words in the text content, it is determined that the predetermined web page has been tampered with, and an alarm is issued.

[0074] When the computer program is executed by the processor to detect whether there are sensitive words in a predetermined sensitive word library in the text content, the processor specifically executes the following steps: segmenting the text content to obtain multiple segmented words; matching the multiple segmented words with the sensitive words in the predetermined sensitive word library respectively to determine whether there are sensitive words in the multiple segmented words.

[0075] When the computer program is executed by the processor to detect again whether there are sensitive words in the text content through a predetermined semantic analysis model, the processor specifically executes the following steps: input multiple word segments into the predetermined semantic analysis model respectively to determine again whether there are sensitive words in the multiple word segments.

[0076] The computer program is executed by the processor, and after the alarm is issued, the processor also executes the following steps: adding the segmented words corresponding to the alarm to the predetermined sensitive word library.

[0077] The predetermined semantic analysis model is a model trained using the Word2Vec model.

[0078] After the computer program is executed by the processor to detect whether the page similarity reaches a predetermined similarity threshold, the processor also executes the following steps: if the page similarity reaches the predetermined similarity threshold, determining that the predetermined web page has not been tampered with, and recording the detection result of the page similarity.

[0079] After the computer program is executed by the processor to detect again whether there are sensitive words in the text content through a predetermined semantic analysis model, the processor also executes the following steps: if there are no sensitive words in the text content, save the analysis results of the semantic analysis using the predetermined semantic analysis model.

[0080] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy.

[0081] Optionally, in this embodiment, the above-mentioned computer program product may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk. Optionally, in this embodiment, the processor executes the method steps recorded in the above-mentioned embodiment according to the program code stored in the computer program product. Optionally, the specific examples in this embodiment can refer to the examples described in the above-mentioned embodiment and the optional implementation mode, and this embodiment will not be repeated here. Obviously, it should be understood by those skilled in the art that the above-mentioned modules or steps of the present invention can be implemented with a general computing device, which can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices. Optionally, they can be implemented with executable program codes of computing devices, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules respectively, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present invention is not limited to any specific combination of hardware and software.

[0082] A fourth embodiment of the present invention provides a computer device, the structural diagram of which can be as follows: Figure 4 As shown, at least a memory 901 and a processor 902 are included, the memory 901 stores a computer program, and the processor 902 implements the method provided by any embodiment of the present invention when executing the computer program on the memory 901. Exemplarily, the computer program steps of the computer device are as follows S21 to S27:

[0083] S21, obtaining a page snapshot of a predetermined web page according to a predetermined period.

[0084] S22, matching the acquired current page snapshot with the historical page snapshot acquired before a predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot.

[0085] S23, detecting whether the page similarity reaches a predetermined similarity threshold.

[0086] S24: When the page similarity does not reach a predetermined similarity threshold, extract the text content of the predetermined web page.

[0087] S25, detecting whether there are sensitive words in a predetermined sensitive word library in the text content.

[0088] S26, when there are no sensitive words in the text content, a predetermined semantic analysis model is used to detect again whether there are sensitive words in the text content, wherein the predetermined semantic analysis model is a model trained using synonyms or near-synonyms of each sensitive word in a predetermined sensitive word library.

[0089] S27, when there are sensitive words in the text content, it is determined that the predetermined web page has been tampered with, and an alarm is issued.

[0090] When the processor executes a computer program stored in the memory for detecting whether there are sensitive words in a predetermined sensitive word library in the text content, the processor specifically executes the following computer program: performing word segmentation processing on the text content to obtain multiple word segments; matching the multiple word segments with the sensitive words in the predetermined sensitive word library respectively to determine whether there are sensitive words in the multiple word segments.

[0091] When the processor executes a computer program stored in the memory that uses a predetermined semantic analysis model to re-detect whether there are sensitive words in the text content, it specifically executes the following computer program: multiple word segments are respectively input into the predetermined semantic analysis model to re-determine whether there are sensitive words in the multiple word segments.

[0092] After executing the computer program for issuing an alarm stored in the memory, the processor further executes the following computer program: adding the segmented words corresponding to the alarm to a predetermined sensitive word library.

[0093] The predetermined semantic analysis model is a model trained using the Word2Vec model.

[0094] After executing the computer program stored in the memory for detecting whether the page similarity reaches a predetermined similarity threshold, the processor further executes the following computer program: if the page similarity reaches the predetermined similarity threshold, determining that the predetermined web page has not been tampered with, and recording the detection result of the page similarity.

[0095] After executing the computer program stored in the memory for detecting again whether there are sensitive words in the text content using a predetermined semantic analysis model, the processor also executes the following computer program: if there are no sensitive words in the text content, save the analysis results of semantic analysis using the predetermined semantic analysis model.

[0096] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy.

[0097] A fifth embodiment of the present invention provides a storage medium, the storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor, the method provided by any embodiment of the present invention is implemented, including the following steps S31 to S37:

[0098] S31, obtaining a page snapshot of a predetermined web page according to a predetermined period.

[0099] S32, matching the acquired current page snapshot with the historical page snapshot acquired before a predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot.

[0100] S33, detecting whether the page similarity reaches a predetermined similarity threshold.

[0101] S34: When the page similarity does not reach a predetermined similarity threshold, extract the text content of the predetermined web page.

[0102] S35, detecting whether there are sensitive words in a predetermined sensitive word library in the text content.

[0103] S36, when there are no sensitive words in the text content, a predetermined semantic analysis model is used to detect again whether there are sensitive words in the text content, wherein the predetermined semantic analysis model is a model trained using synonyms or near-synonyms of each sensitive word in a predetermined sensitive word library.

[0104] S37, when there are sensitive words in the text content, it is determined that the predetermined web page has been tampered with, and an alarm is issued.

[0105] When the computer program is executed by the processor to detect whether there are sensitive words in a predetermined sensitive word library in the text content, the processor specifically executes the following steps: segmenting the text content to obtain multiple segmented words; matching the multiple segmented words with the sensitive words in the predetermined sensitive word library respectively to determine whether there are sensitive words in the multiple segmented words.

[0106] When the computer program is executed by the processor to detect again whether there are sensitive words in the text content through a predetermined semantic analysis model, the processor specifically executes the following steps: input multiple word segments into the predetermined semantic analysis model respectively to determine again whether there are sensitive words in the multiple word segments.

[0107] The computer program is executed by the processor, and after the alarm is issued, the processor also executes the following steps: adding the segmented words corresponding to the alarm to the predetermined sensitive word library.

[0108] The predetermined semantic analysis model is a model trained using the Word2Vec model.

[0109] After the computer program is executed by the processor to detect whether the page similarity reaches a predetermined similarity threshold, the processor also executes the following steps: if the page similarity reaches the predetermined similarity threshold, determining that the predetermined web page has not been tampered with, and recording the detection result of the page similarity.

[0110] After the computer program is executed by the processor to detect again whether there are sensitive words in the text content through a predetermined semantic analysis model, the processor also executes the following steps: if there are no sensitive words in the text content, save the analysis results of the semantic analysis using the predetermined semantic analysis model.

[0111] The embodiment of the present invention preliminarily determines whether a predetermined web page has been tampered with through page similarity, thereby reducing the unnecessary detailed sensitive word analysis of the text content of the page snapshot, greatly improving the detection efficiency; after initially determining that the predetermined web page does not contain sensitive words, the text content is further analyzed with the sensitive words in the predetermined sensitive word library for semantic similarity to further confirm whether the page contains sensitive words, thereby improving the detection accuracy and reducing the underreporting situation; the embodiment of the present invention performs page similarity matching before matching the text content with the sensitive words, and further performs semantic analysis after matching the text content with the sensitive words, thereby reducing unnecessary text analysis processes, further ensuring the accuracy of sensitive word matching, improving the detection efficiency, and improving the detection accuracy.

[0112] In addition, although exemplary embodiments have been described herein, the scope includes any and all embodiments based on the present invention with equivalent elements, modifications, omissions, combinations (e.g., various embodiments intersecting schemes), adaptations or changes. The elements in the claims will be interpreted broadly based on the language adopted in the claims, and are not limited to the examples described in this specification or during the practice of the present invention, and the examples will be interpreted as non-exclusive. Therefore, this specification and examples are intended to be considered as examples only, and the true scope and spirit are indicated by the following claims and the full scope of their equivalents.

[0113] The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more of them) can be used in combination with each other. For example, a person of ordinary skill in the art can use other embodiments when reading the above description. In addition, in the above-mentioned specific embodiments, various features can be grouped together to simplify the present invention. This should not be interpreted as an intention that a disclosed feature that is not required to be protected is necessary for any claim. On the contrary, the subject matter of the present invention may be less than all the features of a specific disclosed embodiment. Thus, the following claims are incorporated into the specific embodiments as examples or embodiments, wherein each claim is independently used as a separate embodiment, and it is considered that these embodiments can be combined with each other in various combinations or arrangements. The scope of the present invention should be determined with reference to the attached claims and the full scope of equivalent forms granted by these claims.

[0114] A number of embodiments of the present invention have been described in detail above, but the present invention is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications to the embodiments based on the concept of the present invention, and these variations and modifications should all fall within the scope of protection claimed by the present invention.

Claims

1. A method for monitoring webpage tampering, characterized in that: include: Obtain page snapshots of a predetermined web page according to a predetermined period; Matching the acquired current page snapshot with the historical page snapshot acquired before a predetermined period to determine the page similarity between the current page snapshot and the historical page snapshot; Detecting whether the page similarity reaches a predetermined similarity threshold; If the page similarity does not reach the predetermined similarity threshold, extracting the text content of the predetermined web page; Detecting whether there are sensitive words in a predetermined sensitive word library in the text content; In the case that the sensitive word does not exist in the text content, detecting again whether the sensitive word exists in the text content by using a predetermined semantic analysis model, wherein the predetermined semantic analysis model is a model trained by using synonyms or near synonyms of each sensitive word in the predetermined sensitive word library; In the case where the sensitive word exists in the text content, it is determined that the predetermined webpage has been tampered with, and an alarm is issued.

2. The method according to claim 1, characterized in that The detecting whether there is a sensitive word in a predetermined sensitive word library in the text content includes: Performing word segmentation processing on the text content to obtain multiple word segments; The plurality of segmented words are matched respectively with sensitive words in the predetermined sensitive word library to determine whether the sensitive word exists in the plurality of segmented words.

3. The method according to claim 2, characterized in that The step of detecting again whether the text content contains the sensitive word by using a predetermined semantic analysis model includes: The plurality of segmented words are respectively input into the predetermined semantic analysis model to determine again whether the sensitive word exists in the plurality of segmented words.

4. The method according to claim 3, characterized in that After the alarm is issued, the method further includes: The segmented words corresponding to the alarm are added to the predetermined sensitive word library.

5. The method according to claim 1, characterized in that The predetermined semantic analysis model is a model trained using the Word2Vec model.

6. The method according to any one of claims 1 to 5, characterized in that After detecting whether the page similarity reaches a predetermined similarity threshold, the method further includes: When the page similarity reaches the predetermined similarity threshold, it is determined that the predetermined web page has not been tampered with, and the detection result of the page similarity is recorded.

7. The method according to any one of claims 1 to 5, characterized in that After the predetermined semantic analysis model is used to detect again whether the text content contains the sensitive word, the method further includes: When the sensitive word does not exist in the text content, the analysis result of the semantic analysis performed using the predetermined semantic analysis model is saved.

8. A computer program product storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer device, comprising at least a memory and a processor, wherein a computer program is stored in the memory, wherein: The processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program on the memory.

10. A storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images