Website security monitoring methods, computer program products, devices and storage media

Abstract

This invention provides a webpage security monitoring method, computer program product, device, and storage medium. The method includes: acquiring dynamic content data and user behavior data of a webpage; inputting the data into a pre-trained predetermined analysis model to obtain analysis results; and, if the analysis results indicate a security problem, executing predetermined response measures according to a predetermined security policy. The predetermined analysis model includes the following training process: acquiring dynamic content data and user behavior data of a webpage within a predetermined time period; performing a first predetermined analysis on the dynamic content data to obtain a first analysis result dataset; performing a second predetermined analysis on the user behavior data based on a predetermined pattern recognition algorithm to obtain a second analysis result dataset; and inputting the first and second analysis result datasets into the predetermined analysis model for machine learning to obtain a pre-trained predetermined analysis model.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a webpage security monitoring method, computer program product, device, and storage medium. Background Technology

[0002] With the widespread use of the internet, web pages have become the primary means for users to obtain information and interact. However, malicious content injection and unauthorized access have become serious security threats. Traditional web page security protection mechanisms are often unable to cope with constantly evolving attack methods. For example, cross-site scripting (XSS) attacks and SQL (Structured Query Language) injection attacks can exploit web page security vulnerabilities to steal data and intrude into systems.

[0003] Existing page security protection methods cannot effectively protect against the above-mentioned attack methods, and the false alarm rate is high. False alarms often occur when user behavior is similar to abnormal patterns, resulting in a poor user experience. Summary of the Invention

[0004] In view of this, embodiments of the present invention propose a webpage security monitoring method, computer program product, device and storage medium to solve the following problems of the prior art: existing page security protection methods cannot effectively protect against the above-mentioned attack methods, have a high false alarm rate, and often cause false alarms when user behavior is similar to abnormal patterns, resulting in a poor user experience.

[0005] On one hand, this invention proposes a webpage security monitoring method, comprising: acquiring dynamic content data and user behavior data of a webpage; inputting the dynamic content data and user behavior data into a pre-trained predetermined analysis model to obtain analysis results; and executing predetermined response measures according to a predetermined security strategy when the analysis results indicate the existence of a security problem. The predetermined analysis model includes the following training process: acquiring dynamic content data and user behavior data of a webpage within a predetermined time period, wherein the dynamic content data includes at least: webpage source code, user operation records, traffic logs, scripts, text, and forms; and the user-reported behavior data includes at least: abnormal behavior, code, attack methods, and abnormal patterns; performing a first predetermined analysis on the dynamic content data to obtain a second predetermined analysis. An analysis result dataset is provided, wherein the predetermined analysis includes at least: text analysis, script analysis, and form data analysis; a second predetermined analysis is performed on user behavior data based on a predetermined pattern recognition algorithm to obtain a second analysis result dataset, wherein the predetermined pattern recognition algorithm includes: operation frequency recognition and input length recognition; the first and second analysis result datasets are input into a predetermined analysis model for machine learning to obtain a trained predetermined analysis model; wherein the algorithms used in the predetermined analysis model include at least: clustering analysis, association rule learning, and anomaly detection; the association rule learning method includes: Apriori algorithm and FP-Growth algorithm; the anomaly detection method includes: Isolation Forest algorithm and a type of Support Vector Machine.

[0006] In some embodiments, the text analysis of the acquired dynamic content data includes: using regular expressions to detect malicious patterns in the text and marking the detected malicious patterns; using a predefined malicious dictionary to match sensitive words in the text and marking the matched sensitive words; using natural language processing technology to perform semantic analysis on the text and marking the analyzed sensitive words; and using a predefined static analysis tool to analyze the data stream of the traffic log and marking the code corresponding to the tampered data stream obtained from the analysis.

[0007] In some embodiments, the script analysis of the acquired dynamic content data includes: using static analysis tools to detect webpage source code and marking detected code security vulnerabilities and dangerous functions; executing scripts in a sandbox and marking scripts that attempt to access or modify predetermined sensitive data.

[0008] In some embodiments, the step of performing form data analysis on the acquired dynamic content data includes: performing pre-defined input validation on user input data in user operation records and marking data that fails validation, wherein the pre-defined input validation includes at least: whitelist validation, SQL injection detection, and CSRF (Cross-site request forgery) token; verifying whether the CSRF token submitted when submitting the form is a valid token and marking invalid tokens.

[0009] In some embodiments, a second predetermined analysis of user behavior data is performed based on a predetermined pattern recognition algorithm, including: detecting whether the frequency of user access operations is greater than a predetermined frequency threshold, and detecting whether the input length of user input data is greater than a predetermined length threshold; and marking the user behavior data when the operation frequency is greater than the predetermined frequency threshold and / or the input length is greater than the predetermined length threshold.

[0010] In some embodiments, after tagging user behavior data, the method further includes: determining the user's access permissions based on operation frequency and / or input length.

[0011] In some embodiments, the predetermined response measures include at least one of the following: isolating the attack source, blocking the malicious process, issuing a security alert, and cleaning up malicious content.

[0012] On the other hand, embodiments of the present invention provide a computer program product that stores a computer program, which, when executed by a processor, implements the steps of the above-described method.

[0013] On the other hand, embodiments of the present invention provide a computer device, including at least a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program in the memory.

[0014] On the other hand, embodiments of the present invention provide a storage medium carrying one or more computer programs, which, when executed by a processor, implement the steps of the above-described method.

[0015] This invention employs a pre-defined analysis model obtained through machine learning to monitor web pages. The pre-defined analysis model is trained on a large amount of user behavior data and dynamic content data of the web pages. The training data is extensive, not limited to dynamic content data of the web pages, but also analyzes user behavior and receives abnormal behavior data reported by users. This diversity of training data avoids the situation where user behavior is judged as abnormal during web page monitoring, and improves the accuracy of monitoring results. Furthermore, the entire monitoring process is real-time, which greatly improves work efficiency and provides a safer network experience. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of a webpage security monitoring method provided in the first embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of the webpage security monitoring device provided in the second embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0022] To keep the following description of the embodiments of the present invention clear and concise, detailed descriptions of known functions and known components are omitted.

[0023] Existing page security protection methods may generate false alarms due to excessive sensitivity when analyzing dynamic content, especially when user behavior is similar to abnormal patterns, which can lead to a decline in user experience. The process of dynamic content analysis involves repeated crawling and calculation without forming memories or classifications, resulting in low work efficiency. Furthermore, it has poor scalability and lacks extension interfaces for some abnormal operations actively reported by users.

[0024] Based on the above considerations, the first embodiment of the present invention provides a webpage security monitoring method, the process of which is as follows: Figure 1 As shown, steps S101 to S103 are included:

[0025] S101, obtain dynamic content data and user behavior data of the webpage.

[0026] S102, input dynamic content data and user behavior data into the pre-trained analysis model to obtain analysis results.

[0027] S103, if the analysis results indicate that a security problem exists, execute the predetermined response measures according to the predetermined security strategy.

[0028] The aforementioned predetermined analysis model includes the following training processes S201 to S204:

[0029] S201, Obtain dynamic content data and user behavior data of the webpage within a predetermined time period. The dynamic content data includes at least: webpage source code, user operation records, traffic logs, scripts, text, and forms. The user-reported behavior data includes at least: abnormal behavior, code, attack methods, and abnormal patterns.

[0030] S202, perform a first predetermined analysis on the dynamic content data to obtain a first analysis result dataset, wherein the predetermined analysis includes at least: text analysis, script analysis, and form data analysis.

[0031] During the initial pre-defined analysis, text analysis can be performed on the acquired dynamic content data. Specifically, this includes: using regular expressions to detect malicious patterns in the text and marking the detected malicious patterns; using a pre-defined malicious dictionary to match sensitive words in the text and marking the matched sensitive words; using natural language processing techniques to perform semantic analysis on the text and marking the sensitive words obtained from the analysis; and using pre-defined static analysis tools to analyze the data stream of the traffic logs and marking the code corresponding to the tampered data stream obtained from the analysis.

[0032] Then, the acquired dynamic content data can be analyzed using scripts, specifically including: using static analysis tools to detect webpage source code and marking detected code security vulnerabilities and dangerous functions; executing scripts in a sandbox and marking scripts that attempt to access or modify pre-defined sensitive data.

[0033] Finally, the acquired dynamic content data can be analyzed using form data, specifically including: performing pre-defined input validation on user input data in user operation records and marking data that fails validation. Pre-defined input validation includes at least: whitelist validation, Structured Query Language (SQL) injection detection, and Cross-Site Request Forgery (CSRF) token detection; verifying whether the CSRF token submitted when the form is submitted is a valid token and marking invalid tokens.

[0034] This invention collects and analyzes large amounts of network traffic and user behavior data in real time. This data includes webpage source code, traffic logs, user operation records, scripts, text, forms, and other dynamic elements on the page. It is compatible with abnormal behaviors, code, and attack methods actively reported by users to identify potential malicious code and abnormal patterns. Through in-depth analysis of webpage content, it detects and prevents malicious content injection.

[0035] During real-time monitoring, the pre-defined analysis model also needs to perform preliminary analysis on the acquired dynamic content through text analysis, script analysis, form data analysis, etc. However, all of the above analyses are performed within the pre-defined analysis model. The only difference between the training process of the pre-defined analysis model and the usage process after training is that the input data is labeled. The input data during training is labeled, while the input data during usage after training is unlabeled. However, after analysis by the pre-defined analysis model, the output data can be determined to be dangerous data. Dangerous data can be identified and used as training data for further training of the pre-defined analysis model.

[0036] When performing text analysis, semantic analysis is performed on the text content of web pages to identify potential malicious code (such as script injection and XSS attacks). Regular expressions are used to detect common malicious patterns. <script>...< / script> , <iframe>...< / iframe> The process involves matching using a predefined malicious dictionary (containing known malicious code snippets). For example, it detects specific dangerous keywords (such as `eval`, `document.co.uk`, etc.). Then, semantic analysis is performed, based on natural language processing (NLP) techniques, to analyze potential dangerous behaviors and malicious operations in the text, or static analysis tools (such as Fortify) are used to analyze data flow within the program, detecting data leaks or tampering.

[0037] XSS attacks typically execute untrusted code by injecting malicious script code. Their characteristics usually include: (1) Tag closure: such as... <script>标签。(2)事件处理器：如onload＝，onerror＝等。(3)JavaScript函数调用：如alert()，eval()，document.cookie。(4)URL编码和转义字符：如％3Cscript％3E。(5)混淆技术：攻击者可能使用字符混淆来绕过过滤器。

[0038] 本发明实施例除了利用传统的正则表达式或特征规则来匹配常见的XSS攻击模式以外，采用机器学习的方法可以从数据中自动学习攻击模式，尤其适用于识别未知攻击或经过变形的攻击。从日志中收集包含XSS攻击和正常请求的样本，标签化数据，进行训练模型、模型验证、模型调优。通过结合规则匹配、机器学习模型，可以显著提高XSS攻击检测的准确率。集成到使用环境中，通过大量的行为日志信息，可以进一步优化模型和特征选择。

[0039] 当进行脚本分析时，检查网页中的JavaScript和其他脚本，检测并阻止可疑的代码片段，防止恶意脚本注入。首先使用静态分析工具(如ESLint)检查代码中的安全漏洞，检测脚本中是否使用了危险函数(如eval()、setTimeout()、document.write())。然后进行动态分析，主要采用沙盒执行和行为分析，在受限环境中执行脚本，监控其行为，检测脚本是否尝试访问或修改敏感数据，例如通过XMLHttpRequest进行未授权的网络请求。

[0040] 当进行表单数据分析时，实时审查用户输入的数据，检测并过滤恶意内容(如SQL注入尝试)，保护表单免受SQL注入、跨站请求伪造(CSRF)等攻击。首先进行输入验证，包括白名单验证、SQL注入检测、CSRF令牌，只允许合法的输入格式，检测特殊字符，如’、--、 / *等，这些字符常用于SQL注入。提交表单时，验证提交的CSRF令牌是否有效。

[0041] S203，基于预定模式识别算法对用户行为数据进行第二预定分析，以得到第二分析结果数据集，其中，预定模式识别算法包括：操作频率识别和输入长度识别。

[0042] 在基于预定模式识别算法对用户行为数据进行第二预定分析时，具体包括：检测用户访问的操作频率是否大于预定频率阈值，并检测用户输入数据的输入长度是否大于预定长度阈值；在操作频率大于预定频率阈值和 / 或输入长度大于预定长度阈值的情况下，对用户行为数据进行标记。其中，在对用户行为数据进行标记之后，还可以根据操作频率和 / 或输入长度确定用户的访问权限。

[0043] 在进行行为模式分析时，实时跟踪用户的操作行为，分析访问模式和操作频率，根据行为分析结果自动调整访问权限。例如，检测到异常行为时自动限制该用户的访问权限。包含的检测算法为阈值设置和模式识别，设定访问频率和输入长度等阈值，超出阈值时触发警报，通过模式识别算法分析用户的访问行为，检测异常模式(如异常的请求频率)，监控用户请求频率，检测是否有异常高频的请求(例如DoS攻击)。

[0044] 本发明实施例异常行为的检测识别和响应异常用户行为是为了防止潜在的攻击或滥用行为，因此，为了提升检测的精确度，会接收用户主动上报的异常行为，对重复的逻辑进行学习，形成记忆分类，进而大幅度提升工作效率。本发明实施例监控用户的访问模式，识别异常行为(如频繁请求、异常输入等)，并可以采取对应的响应措施(如限制访问、记录日志)。

[0045] S204，将第一分析结果数据集和第二分析结果数据集输入至预定分析模型中进行机器学习，以得到训练完成的预定分析模型；其中，预定分析模型采用的算法至少包括：聚类分析法、关联规则学习法、异常检测法；关联规则学习法包括：Apriori算法和FP-Growth算法；异常检测法包括：孤立森林算法、一类支持向量机。

[0046] 在进行异常模式检测时，本发明实施例使用机器学习模型检测用户行为中的异常模式，使用机器学习模型(如异常检测算法)分析用户行为模式，识别异常行为。主要算法技术包括：

[0047] (1)聚类分析法：对用户行为进行聚类分析，识别与正常行为模式显著不同的行为，采用K均值聚类、DBSCAN技术。

[0048] (2)关联规则学习法：发现用户行为之间的关联规则，识别异常行为，采用Apriori算法、FP-Growth算法。

[0049] (3)异常检测法：如孤立森林(Isolation Forest)，通过孤立数据点来识别异常；一类支持向量机(One-Class SVM)，通过学习正常行为模式来检测异常。

[0050] 异常检测法，采用的孤立森林通过随机切割数据来识别异常，从而递归地构建二叉树结构的孤立树，并计算数据点的异常分数，能够有效识别数据集中的异常值。这种方法因其线性时间复杂度和高精准度，在网络安全领域得到了广泛应用。

[0051]

[0052] 以上公式中，x为识别的异常行为孤立点数，其异常分数s(x，n)可以通过以上公式算出，其中E(h(x))表示异常行为数据点数x在所有树中的路径长度的平均值，c(n)是树的平均路径长度，用于标准化，计算如下：

[0053]

[0054] 其中，H(i)是调和数，近似为ln(i)+0.5772156649，n为抓取异常样本个数。

[0055] 本发明实施例能够持续学习和优化，以适应不断变化的网络威胁和新的攻击手段，极大地提高了检测准确性和高效性。

[0056] 当确认存在异常后，系统根据预定安全策略自动采取预定响应措施，预定响应措施至少包括以下之一：隔离攻击源、阻断恶意进程、发出安全警报、清理恶意内容等。例如，自动清理内容时，可以对检测到的恶意内容进行自动清理，保护页面不被破坏，并启动恢复机制恢复到安全状态；发出安全警报时，可以向系统管理员生成警报通知，提示有异常内容或行为需要进一步处理。当进一步实施保护措施时，可以根据检测结果等级采取相应的保护措施，例如屏蔽用户、阻断恶意进程、重新生成安全令牌、加强内容审核等。

[0057] 上述S201至S204的训练过程在监测过程S101至S103之前。

[0058] 本发明实施例采用机器学习方式得到的预定分析模型对网页进行监测，预定分析模型基于大量的用户行为数据和网页的动态内容数据进行训练，训练数据较为广泛，不仅局限于网页的动态内容数据，也会对用户行为进行分析，也接收用户上报的异常行为数据，训练数据多元化，避免了监测网页过程中将用户行为判定为异常模式的情况，也提升了监测结果的准确度，且整个监测过程实时响应，大幅度提升工作效率，提供更安全的网络体验。

[0059] 本发明第二实施例提供了一种网页的安全监测装置，该装置的结构示意如图2所示，包括：

[0060] 获取模块10，用于获取网页的动态内容数据和用户行为数据；

[0061] 输入模块20，与获取模块10耦合，用于将动态内容数据和用户行为数据输入至训练完成的预定分析模型中，以得到分析结果；

[0062] 响应模块30，与输入模块20耦合，用于在分析结果指示存在安全问题的情况下，根据预定安全策略执行预定响应措施；

[0063] 其中，预定分析模型通过如下与输入模块20耦合的训练模块40执行如下训练过程：

[0064] 获取预定时间段内网页的动态内容数据和用户行为数据，其中，动态内容数据至少包括：网页源代码、用户操作记录、流量日志、脚本、文本、表单；用户上报的行为数据至少包括：异常行为、代码、攻击手段、异常模式；将动态内容数据进行第一预定分析，以得到第一分析结果数据集，其中，预定分析至少包括：文本分析、脚本分析、表单数据分析；基于预定模式识别算法对用户行为数据进行第二预定分析，以得到第二分析结果数据集，其中，预定模式识别算法包括：操作频率识别和输入长度识别；将第一分析结果数据集和第二分析结果数据集输入至预定分析模型中进行机器学习，以得到训练完成的预定分析模型；其中，预定分析模型采用的算法至少包括：聚类分析法、关联规则学习法、异常检测法；关联规则学习法包括：Apriori算法和FP-Growth算法；异常检测法包括：孤立森林算法、一类支持向量机。

[0065] 上述预定响应措施至少包括以下之一：隔离攻击源、阻断恶意进程、发出安全警报、清理恶意内容。

[0066] 训练模块在将获取到的动态内容数据进行文本分析时，具体用于：使用正则表达式对文本进行恶意模式检测，并对检测到的恶意模式进行标记；使用预定恶意词典对文本进行敏感词匹配，并对匹配到的敏感词进行标记；使用自然语言处理技术对文本进行语义分析，并对分析得到的敏感词进行标记；使用预定静态分析工具对流量日志的数据流进行分析，并对分析得到的篡改数据流对应的代码进行标记。

[0067] 训练模块在将获取到的动态内容数据进行脚本分析时，具体用于：使用静态分析工具对网页源代码进行检测，并对检测到的代码安全漏洞和危险函数进行标记；使用沙盒中执行脚本，并对脚本中尝试访问或修改预定敏感数据的脚本进行标记。

[0068] 训练模块在将获取到的动态内容数据进行表单数据分析时，具体用于：对用户操作记录中用户输入数据进行预定输入验证，并对未通过验证的数据进行标记，其中，预定输入验证至少包括：白名单验证、结构化查询语言SQL注入检测、跨站请求伪造CSRF令牌；验证表单提交时提交的CSRF令牌是否为有效令牌，并对无效令牌进行标记。

[0069] 训练模块在基于预定模式识别算法对用户行为数据进行第二预定分析时，具体用于：检测用户访问的操作频率是否大于预定频率阈值，并检测用户输入数据的输入长度是否大于预定长度阈值；在操作频率大于预定频率阈值和 / 或输入长度大于预定长度阈值的情况下，对用户行为数据进行标记。

[0070] 在对用户行为数据进行标记之后，还可以根据操作频率和 / 或输入长度确定用户的访问权限。

[0071] 本发明实施例采用机器学习方式得到的预定分析模型对网页进行监测，预定分析模型基于大量的用户行为数据和网页的动态内容数据进行训练，训练数据较为广泛，不仅局限于网页的动态内容数据，也会对用户行为进行分析，也接收用户上报的异常行为数据，训练数据多元化，避免了监测网页过程中将用户行为判定为异常模式的情况，也提升了监测结果的准确度，且整个监测过程实时响应，大幅度提升工作效率，提供更安全的网络体验。

[0072] 本发明第三实施例提供了一种计算机程序产品，该计算机程序产品存储有计算机程序，该计算机程序被处理器执行时实现本发明任意实施例提供的方法，包括如下步骤S11至S13：

[0073] S11，获取网页的动态内容数据和用户行为数据；

[0074] S12，将动态内容数据和用户行为数据输入至训练完成的预定分析模型中，以得到分析结果；

[0075] S13，在分析结果指示存在安全问题的情况下，根据预定安全策略执行预定响应措施；

[0076] 其中，预定分析模型包括如下训练过程S21至S24：

[0077] S21，获取预定时间段内网页的动态内容数据和用户行为数据，其中，动态内容数据至少包括：网页源代码、用户操作记录、流量日志、脚本、文本、表单；用户上报的行为数据至少包括：异常行为、代码、攻击手段、异常模式；

[0078] S22，将动态内容数据进行第一预定分析，以得到第一分析结果数据集，其中，预定分析至少包括：文本分析、脚本分析、表单数据分析；

[0079] S23，基于预定模式识别算法对用户行为数据进行第二预定分析，以得到第二分析结果数据集，其中，预定模式识别算法包括：操作频率识别和输入长度识别；

[0080] S24，将第一分析结果数据集和第二分析结果数据集输入至预定分析模型中进行机器学习，以得到训练完成的预定分析模型；其中，预定分析模型采用的算法至少包括：聚类分析法、关联规则学习法、异常检测法；关联规则学习法包括：Apriori算法和FP-Growth算法；异常检测法包括：孤立森林算法、一类支持向量机。

[0081] 计算机程序被处理器执行将获取到的动态内容数据进行文本分析时，具体被处理器执行如下步骤：使用正则表达式对文本进行恶意模式检测，并对检测到的恶意模式进行标记；使用预定恶意词典对文本进行敏感词匹配，并对匹配到的敏感词进行标记；使用自然语言处理技术对文本进行语义分析，并对分析得到的敏感词进行标记；使用预定静态分析工具对流量日志的数据流进行分析，并对分析得到的篡改数据流对应的代码进行标记。

[0082] 计算机程序被处理器执行将获取到的动态内容数据进行脚本分析时，具体被处理器执行如下步骤：使用静态分析工具对网页源代码进行检测，并对检测到的代码安全漏洞和危险函数进行标记；使用沙盒中执行脚本，并对脚本中尝试访问或修改预定敏感数据的脚本进行标记。

[0083] 计算机程序被处理器执行将获取到的动态内容数据进行表单数据分析时，具体被处理器执行如下步骤：对用户操作记录中用户输入数据进行预定输入验证，并对未通过验证的数据进行标记，其中，预定输入验证至少包括：白名单验证、结构化查询语言SQL注入检测、跨站请求伪造CSRF令牌；验证表单提交时提交的CSRF令牌是否为有效令牌，并对无效令牌进行标记。

[0084] 计算机程序被处理器执行基于预定模式识别算法对用户行为数据进行第二预定分析时，具体被处理器执行如下步骤：检测用户访问的操作频率是否大于预定频率阈值，并检测用户输入数据的输入长度是否大于预定长度阈值；在操作频率大于预定频率阈值和 / 或输入长度大于预定长度阈值的情况下，对用户行为数据进行标记。

[0085] 计算机程序被处理器执行对用户行为数据进行标记之后，还被处理器执行如下步骤：根据操作频率和 / 或输入长度确定用户的访问权限。

[0086] 上述预定响应措施至少包括以下之一：隔离攻击源、阻断恶意进程、发出安全警报、清理恶意内容。

[0087] 本发明实施例采用机器学习方式得到的预定分析模型对网页进行监测，预定分析模型基于大量的用户行为数据和网页的动态内容数据进行训练，训练数据较为广泛，不仅局限于网页的动态内容数据，也会对用户行为进行分析，也接收用户上报的异常行为数据，训练数据多元化，避免了监测网页过程中将用户行为判定为异常模式的情况，也提升了监测结果的准确度，且整个监测过程实时响应，大幅度提升工作效率，提供更安全的网络体验。

[0088] 可选地，在本实施例中，上述计算机程序产品可以包括但不限于：U盘、只读存储器(ROM，Read-only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。可选地，在本实施例中，处理器根据计算机程序产品中已存储的程序代码执行上述实施例记载的方法步骤。可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。

[0089] 本发明第四实施例提供了一种计算机设备，该计算机设备的结构示意图可以如图3所示，至少包括存储器901和处理器902，存储器901上存储有计算机程序，处理器902在执行存储器901上的计算机程序时实现本发明任意实施例提供的方法。示例性的，计算机设备计算机程序步骤如下S31至S33：

[0090] S31，获取网页的动态内容数据和用户行为数据；

[0091] S32，将动态内容数据和用户行为数据输入至训练完成的预定分析模型中，以得到分析结果；

[0092] S33，在分析结果指示存在安全问题的情况下，根据预定安全策略执行预定响应措施；

[0093] 其中，预定分析模型包括如下训练过程S41至S44：

[0094] S41，获取预定时间段内网页的动态内容数据和用户行为数据，其中，动态内容数据至少包括：网页源代码、用户操作记录、流量日志、脚本、文本、表单；用户上报的行为数据至少包括：异常行为、代码、攻击手段、异常模式；

[0095] S42，将动态内容数据进行第一预定分析，以得到第一分析结果数据集，其中，预定分析至少包括：文本分析、脚本分析、表单数据分析；

[0096] S43，基于预定模式识别算法对用户行为数据进行第二预定分析，以得到第二分析结果数据集，其中，预定模式识别算法包括：操作频率识别和输入长度识别；

[0097] S44，将第一分析结果数据集和第二分析结果数据集输入至预定分析模型中进行机器学习，以得到训练完成的预定分析模型；其中，预定分析模型采用的算法至少包括：聚类分析法、关联规则学习法、异常检测法；关联规则学习法包括：Apriori算法和FP-Growth算法；异常检测法包括：孤立森林算法、一类支持向量机。

[0098] 处理器在执行存储器上存储的将获取到的动态内容数据进行文本分析的计算机程序时，具体执行如下计算机程序：使用正则表达式对文本进行恶意模式检测，并对检测到的恶意模式进行标记；使用预定恶意词典对文本进行敏感词匹配，并对匹配到的敏感词进行标记；使用自然语言处理技术对文本进行语义分析，并对分析得到的敏感词进行标记；使用预定静态分析工具对流量日志的数据流进行分析，并对分析得到的篡改数据流对应的代码进行标记。

[0099] 处理器在执行存储器上存储的将获取到的动态内容数据进行脚本分析的计算机程序时，具体执行如下计算机程序：使用静态分析工具对网页源代码进行检测，并对检测到的代码安全漏洞和危险函数进行标记；使用沙盒中执行脚本，并对脚本中尝试访问或修改预定敏感数据的脚本进行标记。

[0100] 处理器在执行存储器上存储的将获取到的动态内容数据进行表单数据分析的计算机程序时，具体执行如下计算机程序：对用户操作记录中用户输入数据进行预定输入验证，并对未通过验证的数据进行标记，其中，预定输入验证至少包括：白名单验证、结构化查询语言SQL注入检测、跨站请求伪造CSRF令牌；验证表单提交时提交的CSRF令牌是否为有效令牌，并对无效令牌进行标记。

[0101] 处理器在执行存储器上存储的基于预定模式识别算法对用户行为数据进行第二预定分析的计算机程序时，具体执行如下计算机程序：检测用户访问的操作频率是否大于预定频率阈值，并检测用户输入数据的输入长度是否大于预定长度阈值；在操作频率大于预定频率阈值和 / 或输入长度大于预定长度阈值的情况下，对用户行为数据进行标记。

[0102] 处理器在执行存储器上存储的对用户行为数据进行标记的计算机程序之后，还执行如下计算机程序：根据操作频率和 / 或输入长度确定用户的访问权限。

[0103] 上述预定响应措施至少包括以下之一：隔离攻击源、阻断恶意进程、发出安全警报、清理恶意内容。

[0104] 本发明实施例采用机器学习方式得到的预定分析模型对网页进行监测，预定分析模型基于大量的用户行为数据和网页的动态内容数据进行训练，训练数据较为广泛，不仅局限于网页的动态内容数据，也会对用户行为进行分析，也接收用户上报的异常行为数据，训练数据多元化，避免了监测网页过程中将用户行为判定为异常模式的情况，也提升了监测结果的准确度，且整个监测过程实时响应，大幅度提升工作效率，提供更安全的网络体验。

[0105] 本发明第五实施例提供了一种存储介质，存储介质承载有一个或多个计算机程序，一个或多个计算机程序被处理器执行时实现本发明任意实施例提供的方法，包括如下步骤S51至S53：

[0106] S51，获取网页的动态内容数据和用户行为数据；

[0107] S52，将动态内容数据和用户行为数据输入至训练完成的预定分析模型中，以得到分析结果；

[0108] S53，在分析结果指示存在安全问题的情况下，根据预定安全策略执行预定响应措施；

[0109] 其中，预定分析模型包括如下训练过程S 61至S64：

[0110] S 61，获取预定时间段内网页的动态内容数据和用户行为数据，其中，动态内容数据至少包括：网页源代码、用户操作记录、流量日志、脚本、文本、表单；用户上报的行为数据至少包括：异常行为、代码、攻击手段、异常模式；

[0111] S62，将动态内容数据进行第一预定分析，以得到第一分析结果数据集，其中，预定分析至少包括：文本分析、脚本分析、表单数据分析；

[0112] S63，基于预定模式识别算法对用户行为数据进行第二预定分析，以得到第二分析结果数据集，其中，预定模式识别算法包括：操作频率识别和输入长度识别；

[0113] S64，将第一分析结果数据集和第二分析结果数据集输入至预定分析模型中进行机器学习，以得到训练完成的预定分析模型；其中，预定分析模型采用的算法至少包括：聚类分析法、关联规则学习法、异常检测法；关联规则学习法包括：Apriori算法和FP-Growth算法；异常检测法包括：孤立森林算法、一类支持向量机。

[0114] 计算机程序被处理器执行将获取到的动态内容数据进行文本分析时，具体被处理器执行如下步骤：使用正则表达式对文本进行恶意模式检测，并对检测到的恶意模式进行标记；使用预定恶意词典对文本进行敏感词匹配，并对匹配到的敏感词进行标记；使用自然语言处理技术对文本进行语义分析，并对分析得到的敏感词进行标记；使用预定静态分析工具对流量日志的数据流进行分析，并对分析得到的篡改数据流对应的代码进行标记。

[0115] 计算机程序被处理器执行将获取到的动态内容数据进行脚本分析时，具体被处理器执行如下步骤：使用静态分析工具对网页源代码进行检测，并对检测到的代码安全漏洞和危险函数进行标记；使用沙盒中执行脚本，并对脚本中尝试访问或修改预定敏感数据的脚本进行标记。

[0116] 计算机程序被处理器执行将获取到的动态内容数据进行表单数据分析时，具体被处理器执行如下步骤：对用户操作记录中用户输入数据进行预定输入验证，并对未通过验证的数据进行标记，其中，预定输入验证至少包括：白名单验证、结构化查询语言SQL注入检测、跨站请求伪造CSRF令牌；验证表单提交时提交的CSRF令牌是否为有效令牌，并对无效令牌进行标记。

[0117] 计算机程序被处理器执行基于预定模式识别算法对用户行为数据进行第二预定分析时，具体被处理器执行如下步骤：检测用户访问的操作频率是否大于预定频率阈值，并检测用户输入数据的输入长度是否大于预定长度阈值；在操作频率大于预定频率阈值和 / 或输入长度大于预定长度阈值的情况下，对用户行为数据进行标记。

[0118] 计算机程序被处理器执行对用户行为数据进行标记之后，还被处理器执行如下步骤：根据操作频率和 / 或输入长度确定用户的访问权限。

[0119] 上述预定响应措施至少包括以下之一：隔离攻击源、阻断恶意进程、发出安全警报、清理恶意内容。

[0120] 本发明实施例通过动态内容分析、异常行为检测和响应机制，有效提升了网站的安全性，防止了各种网络攻击和数据泄露风险；不仅解决了传统安全防御方案中被动局面的问题，还为现代网络安全环境提供了更主动、高效的保护策略，在现代网络安全中具有广泛的应用前景和实际效益。

[0121] 本发明实施例建立终端安全态势感知能力，有效识别并拦截机器发起的自动化攻击；识别非人为的自动化行为，防止敏感数据被非法抓取和导出；结合防御策略，过滤POST请求中的非法行为，阻挡攻击于应用之前；通过训练机器学习模型和语义、脚本分析技术，不依赖规则更新即可防御未知漏洞，保护WEB应用业务及数据安全。

[0122] 此外，尽管已经在本文中描述了示例性实施例，其范围包括任何和所有基于本发明的具有等同元件、修改、省略、组合(例如，各种实施例交叉的方案)、改编或改变的实施例。权利要求书中的元件将被基于权利要求中采用的语言宽泛地解释，并不限于在本说明书中或本发明的实施期间所描述的示例，其示例将被解释为非排他性的。因此，本说明书和示例旨在仅被认为是示例，真正的范围和精神由以下权利要求以及其等同物的全部范围所指示。

[0123] 以上描述旨在是说明性的而不是限制性的。例如，上述示例(或其一个或更多方案)可以彼此组合使用。例如本领域普通技术人员在阅读上述描述时可以使用其它实施例。另外，在上述具体实施方式中，各种特征可以被分组在一起以简单化本发明。这不应解释为一种不要求保护的公开的特征对于任一权利要求是必要的意图。相反，本发明的主题可以少于特定的公开的实施例的全部特征。从而，以下权利要求书作为示例或实施例在此并入具体实施方式中，其中每个权利要求独立地作为单独的实施例，并且考虑这些实施例可以以各种组合或排列彼此组合。本发明的范围应参照所附权利要求以及这些权利要求赋权的等同形式的全部范围来确定。

[0124] 以上对本发明多个实施例进行了详细说明，但本发明不限于这些具体的实施例，本领域技术人员在本发明构思的基础上，能够做出多种变型和修改实施例，这些变型和修改都应落入本发明所要求保护的范围之内。< / script>

Claims

1. A method of security monitoring of a web page, characterized by, The method comprises the following steps: acquiring dynamic content data and user behavior data of a webpage; inputting the dynamic content data and the user behavior data into a predetermined analysis model to obtain an analysis result; in a case where the analysis result indicates that there is a security problem, performing a predetermined response measure according to a predetermined security policy; wherein the predetermined analysis model comprises the following training process: acquiring dynamic content data and user behavior data of a webpage in a predetermined time period, wherein the dynamic content data at least comprises: webpage source code, user operation record, traffic log, script, text, form; and the user-reported behavior data at least comprises: abnormal behavior, code, attack means, abnormal mode; performing first predetermined analysis on the dynamic content data to obtain a first analysis result data set, wherein the predetermined analysis at least comprises: text analysis, script analysis, form data analysis; wherein: through text analysis, the codes corresponding to malicious patterns, sensitive words and tampered data streams are marked; through script analysis, the codes with security vulnerabilities and dangerous functions, and the scripts attempting to access or modify predetermined sensitive data are marked; through form data analysis, the unverified data and invalid tokens are marked, wherein the unverified data comprises user input data in the user operation record, and the invalid tokens comprise CSRF tokens submitted when verifying form submission; performing second predetermined analysis on the user behavior data based on a predetermined pattern recognition algorithm to obtain a second analysis result data set, wherein the predetermined pattern recognition algorithm comprises: detecting whether the operation frequency of user access is greater than a predetermined frequency threshold, and detecting whether the input length of user input data is greater than a predetermined length threshold; inputting the first analysis result data set and the second analysis result data set into the predetermined analysis model for machine learning to obtain a trained predetermined analysis model; wherein the algorithm used by the predetermined analysis model at least comprises: clustering analysis method, association rule learning method and anomaly detection method; the association rule learning method comprises: Apriori algorithm and FP-Growth algorithm; and the anomaly detection method comprises: Isolation Forest algorithm and one-class support vector machine.

2. The method of claim 1, wherein, The text analysis comprises: detecting malicious patterns in the text using regular expressions, and marking the detected malicious patterns; matching sensitive words in the text using a predetermined dictionary of malicious words, and marking the matched sensitive words; performing semantic analysis on the text using natural language processing technology, and marking the sensitive words obtained through the analysis; analyzing data streams of the traffic log using a predetermined static analysis tool, and marking the codes corresponding to the tampered data streams obtained through the analysis.

3. The method of claim 1, wherein, The script analysis comprises: detecting the codes of the webpage source code using a static analysis tool, and marking the codes with security vulnerabilities and dangerous functions detected; executing the script in a sandbox, and marking the scripts in the script that attempt to access or modify predetermined sensitive data.

4. The method of claim 1, wherein, The form data analysis comprises: predetermined input validation on user input data in the user operation record, and marking data that fails the validation, wherein the predetermined input validation at least includes: whitelist validation, structured query language (SQL) injection detection, cross-site request forgery (CSRF) token; verifying whether a CSRF token submitted when a form is submitted is a valid token, and marking invalid tokens.

5. The method of claim 1, wherein, performing a second predetermined analysis on the user behavior data based on a predetermined pattern recognition algorithm, including: in a case where the operation frequency is greater than a predetermined frequency threshold and / or the input length is greater than a predetermined length threshold, marking the user behavior data.

6. The method of claim 5, wherein, after marking the user behavior data, further including: determining access rights of the user according to the operation frequency and / or the input length.

7. The method of any one of claims 1 to 6, wherein, the predetermined response measure at least includes one of the following: isolating an attack source, blocking a malicious process, issuing a security alert, and cleaning malicious content.

8. A computer program product, storing a computer program, characterized in that, the computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 7. 9.A computer device, comprising at least a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that, the processor, when executing the computer program on the memory, implements the steps of the method of any one of claims 1 to 7.

10. A storage medium, characterized by the storage medium carries one or more computer programs, which, when executed by the processor, implement the steps of the method of any one of claims 1 to 7.

Images