Method, device, equipment, system and medium for defending phishing attack

Abstract

The embodiment of the invention discloses a method, a device, equipment and a system for defending a phishing attack, and a medium, so as to solve the problem of security vulnerabilities in the prior art for defending the phishing attack. The system for defending the phishing attack comprises a zero-trust gateway used for receiving a service access request sent by a zero-trust client, redirecting the service access request to a remote browser service device, receiving a modified HTTP response returned by the remote browser service device, and forwarding the modified HTTP response to the zero-trust client; the remote browser service device is used for starting a remote browser container instance according to a service access request, sending an HTTP request to a target website through the remote browser container instance, receiving an HTTP response returned by the target website, inserting a security defense interceptor code into an HTML document of the HTTP response, obtaining a modified HTTP response and sending the modified HTTP response to the target website. And the modified HTTP response is sent to the zero trust gateway.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and specifically to a method, apparatus, device, system and medium for defending against phishing attacks. Background Art

[0002] Phishing is an attack that attempts to trick users into revealing personal information such as usernames, passwords, and credit card details by disguising yourself as a trusted entity. Attackers usually send emails or text messages that appear to be from a trusted entity (such as a bank), directing users to click on links to visit fake websites, thereby stealing users' login credentials and other sensitive data.

[0003] In this context, the concept of zero-trust security came into being. The core of the zero-trust concept is "continuous authentication, never trust", which requires that users or devices should not be trusted under any circumstances, even if they are already in the internal network.

[0004] Existing technologies for defending against phishing attacks based on the zero-trust framework include:

[0005] Based on the Indicators of Compromise (IOC) intelligence library, blacklist domain names and IP addresses for reputation detection to detect and block access to known malicious domains.

[0006] Detect and block malicious files, links and attachments on endpoints such as laptops, desktops and mobile devices based on the antivirus, anti-malware and anti-phishing capabilities provided by Endpoint Detection and Response (EDR) (endpoint security protection software).

[0007] However, the above methods still have many security risks when defending against phishing. For example, the IOC intelligence library can only intercept known malicious domain names and IP addresses, but cannot intercept new types of phishing attacks. Summary of the invention

[0008] The embodiments of the present application provide a method, apparatus, device, system and medium for defending against phishing attacks to solve the problem of security loopholes in the prior art for defending against phishing attacks.

[0009] In a first aspect, an embodiment of the present application provides a system for defending against phishing attacks, the system comprising:

[0010] A zero-trust gateway, configured to receive a service access request sent by a zero-trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero-trust client;

[0011] The remote browser service device is used to start a remote browser container instance according to the business access request, send a Hypertext Transfer Protocol HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert a security defense interceptor code into an HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway, wherein the target website is the website to be visited indicated by the business access request.

[0012] In a second aspect, an embodiment of the present application provides a method for defending against phishing attacks, which is applied to a remote browser service device, and the method includes:

[0013] Receive a business access request sent by a zero-trust client redirected by a zero-trust gateway;

[0014] Starting a remote browser container instance according to the service access request;

[0015] Sending a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receiving an HTTP response returned by the target website, wherein the target website is a website to be visited indicated by the service access request;

[0016] Inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response;

[0017] The modified HTTP response is sent to the zero trust gateway through the remote browser container instance.

[0018] In a third aspect, an embodiment of the present application provides a device for defending against phishing attacks, which is applied to a remote browser service device, and the device includes:

[0019] A receiving module, used to receive a service access request sent by a zero-trust client redirected by a zero-trust gateway;

[0020] A startup module, used to start a remote browser container instance according to the service access request;

[0021] A target website access module, used to send a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be visited indicated by the service access request;

[0022] An interception code insertion module, used to insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance, and obtain the modified HTTP response;

[0023] A sending module is used to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0024] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any embodiment of the second aspect.

[0025] In a fifth aspect, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any embodiment of the second aspect.

[0026] The method, device, equipment, system and medium for defending against phishing attacks provided by the embodiments of the present application, the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device, the remote browser service device is physically isolated from the zero-trust client, and the operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, thereby ensuring the security of the zero-trust client accessing the target website; and, since the remote browser container instance can add a security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against the attack behavior of deceptive phishing scenarios, enrich the detection means in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent the occurrence of various situations such as pass-by downloads, deceptive induced leaks, and malicious advertisements. The problem of security vulnerabilities in the existing technology for defending against phishing attacks is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0028] Figure 1 It is a structural diagram of an embodiment of a system for defending against phishing attacks of the present application;

[0029] Figure 2 yes Figure 1 The schematic diagram of the structure of the remote browser service device in the system for defending against phishing attacks of the present application is shown;

[0030] Figure 3 is a structural schematic diagram of another embodiment of the system for defending against phishing attacks of the present application;

[0031] Figure 4 is a flow chart of an embodiment of a method for defending against phishing attacks of the present application;

[0032] Figure 5 It is a structural schematic diagram of an embodiment of a device for defending against phishing attacks of the present application;

[0033] Figure 6 It is a schematic diagram of the structure of an electronic device used to implement an embodiment of the present application. DETAILED DESCRIPTION

[0034] All actions to obtain signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located, and with the authorization given by the owner of the corresponding device.

[0035] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0036] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0037] Please refer to Figure 1 , which shows a schematic diagram of the structure of an embodiment of a system for defending against phishing attacks according to the present application. The device in the system for defending against phishing attacks may be various electronic devices with data processing functions. For example, the above electronic devices may include but are not limited to cloud servers, physical servers, etc. The execution subject of the device in the system for defending against phishing attacks may be a processor in the above electronic device.

[0038] like Figure 1 As shown, the system for defending against phishing attacks may include: a zero-trust gateway 101 and a remote browser service device 102, wherein the structural diagram of the remote browser service device 102 can be seen in FIG. Figure 2 shown.

[0039] The zero trust gateway 101 is used to receive a business access request sent by a zero trust client, redirect the business access request to the remote browser service device 102, receive a modified HTTP response returned by the remote browser service device 102, and forward the modified HTTP response to the zero trust client.

[0040] In this embodiment, the user first uses a zero-trust client to log in, accesses the zero-trust network after the identity authentication is passed, and then uses a browser or other application to access the Internet application, which is specifically manifested as: a business access request sent by the zero-trust client; the Domain Name System (DNS) agent of the internal network where the zero-trust client is located will first obtain the domain name of the target website, and then filter it through the Internet web application whitelist issued by the zero-trust dynamic policy center to determine whether it is within the authorized list of the zero-trust Internet behavior control policy. If it is not within this range, a non-control identifier is added to the business access request. Specifically, the non-control identifier can be added to the 7-layer protocol header field of the business access request, and the business access request with the non-control identifier is sent to the zero-trust gateway. If it is not within this range, public network access is performed according to other routing decision methods.

[0041] At this time, the zero-trust gateway 101 is also used to redirect the service access request to the remote browser service device 102 when the service access request carries a non-control identifier; when the service access request does not carry a non-control identifier, obtain an Internet behavior control list, and redirect the service access request to the remote browser service device 102 according to the Internet behavior control list. In this embodiment, the control list can be a white list and / or a black list.

[0042] Through the above methods, the number of business access requests sent to the zero-trust gateway can be effectively reduced, thereby reducing the load on the remote browser service device. For the entire zero-trust network, normal network access accounts for the vast majority of cases, and network attack behaviors are only a small part of the cases hidden in it. Therefore, in addition to considering security defense functions, the solution design also considers means of eliminating noise, and filters out access requests without attack behaviors as much as possible through the whitelist configuration of Internet domain name assets. It helps to reduce the false alarm rate, cache the pressure on operators, and reversely improve the accuracy of suspicious resource identification.

[0043] The remote browser service device 102 is used to start the remote browser container instance 201 according to the business access request, send a HyperText Transfer Protocol (HTTP) request to the target website through the remote browser container instance 201, receive the HTTP response returned by the target website, insert the security defense interceptor code into the HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway 101, wherein the target website is the website to be visited indicated by the business access request.

[0044] In this embodiment, the remote browser service device 102 can also be used to receive a business access request through the service adaptation layer 202, forward the business access request to the service management layer 203, parse the business access request through the service management layer 203, obtain the security defense control policy, and send the security defense control policy to the remote browser container instance 201. The remote browser container instance 201 generates a security defense interceptor code according to the security defense control policy.

[0045] In this embodiment, the remote browser service device 102 can specifically pass the security defense control policy to the container session management module 204, and then the container session management module 204 sends it to the remote browser container instance 201. Among them, the container session management module 204 is mainly responsible for status query, instance management and resource recovery of the remote browser container instance 201.

[0046] In this embodiment, after the remote browser service device 102 receives the service access request, the container session management module 204 first performs a status query to determine whether there is an idle browser container instance 201 currently available. If so, the browser container instance 201 is directly reused to access the target website. If not, a new browser container instance 201 is established and started, and the new browser container instance 201 is used to access the target website.

[0047] In this embodiment, the security defense control strategy may include but is not limited to: disabling the text input box function of the web page and prohibiting the download of files of preset types in the page. It should be noted that this embodiment does not specifically limit the preset type, and in actual use, the preset type can be set according to security protection requirements.

[0048] In this embodiment, the specific implementation logic of the remote browser service device 102 inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance 201 may include:

[0049] When the security defense control policy prohibits downloading files of a preset type in a page, the remote browser container instance 201 traverses and determines whether there is a downloadable file of a preset type in the HTML document (specifically, an H5 document). If so, its download link is set to empty ("about:blank").

[0050] When the security defense control policy is to disable the text input box function of the web page, the remote browser container instance 201 will set the properties of the form and text box controls in the h5 document to a disabled state.

[0051] In order to further improve the security of website browsing and avoid phishing attacks, in this embodiment, the remote browser service device 102 can also be used to send the modified HTTP response to the zero-trust gateway in a pixel stream transmission manner.

[0052] By sending the modified HTTP response to the zero-trust gateway in pixel streaming mode, the local does not need to process complex Web functions, but focuses on displaying pixels and transmitting user input, and uses full-duplex mode for collaborative work, where one channel receives and displays the screenshot video of the remote page, and sends user interactive control operations and data on another channel, thus achieving a more simplified and easy-to-manage process. In addition, the zero-trust client will not receive any Web application code, and the user only interacts with image or video rendering, which greatly improves security.

[0053] In the system for defending against phishing attacks provided by the embodiment of the present application, the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device. The remote browser service device is physically isolated from the zero-trust client. The operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, which ensures the security of the zero-trust client accessing the target website; and, because the remote browser container instance can add security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against the attack behavior of deceptive phishing scenarios, enrich the detection means in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent the occurrence of various situations such as pass-by downloads, deceptive induced leaks, and malicious advertisements. The problem of security vulnerabilities in the existing technology for defending against phishing attacks is solved.

[0054] Please refer to Figure 3, which shows a schematic diagram of the structure of an embodiment of a system for defending against phishing attacks according to the present application. The device in the system for defending against phishing attacks may be various electronic devices with data processing functions. For example, the above electronic devices may include but are not limited to cloud servers, physical servers, etc. The execution subject of the device in the system for defending against phishing attacks may be a processor in the above electronic device.

[0055] like Figure 3 As shown in the figure, the system for defending against phishing attacks is Figure 1 The system is basically the same as shown, except that the system may further include:

[0056] Zero Trust Dynamic Policy Center 103, used to dynamically generate and maintain Internet behavior control lists and security defense control policies;

[0057] The zero trust console 104 is used to send the Internet behavior control list to the zero trust gateway 101 and send the security defense control policy to the remote browser service device 102.

[0058] The system for defending against phishing attacks provided in this embodiment can achieve Figure 1 Based on the beneficial effects brought by the technical solution shown, the zero-trust dynamic policy center and the zero-trust console can perform zero-trust management and provide dynamically updated security defense control policies for the remote browser service device 102, further improving network security.

[0059] Please refer to Figure 4 , which shows a process 400 of an embodiment of a method for defending against phishing attacks according to the present application. The method for defending against phishing attacks can be applied to the remote browser service device 102 described above, and the remote browser service device 102 can be various electronic devices with data processing functions. For example, the above electronic devices can include but are not limited to cloud servers, physical servers, etc. The execution subject of the method for defending against phishing attacks can be a processor in the above electronic devices.

[0060] like Figure 4 As shown, the method for defending against phishing attacks includes the following steps:

[0061] Step 401: Receive a service access request sent by a zero trust client redirected by a zero trust gateway.

[0062] In this embodiment, the user first uses a zero-trust client to log in, accesses the zero-trust network after the identity authentication is passed, and then uses a browser or other application to access the Internet application, which is specifically manifested as: a business access request sent through a zero-trust client; the internal network DNS proxy where the zero-trust client is located will first obtain the domain name of the target website, and then filter it through the Internet web application whitelist issued by the zero-trust dynamic policy center to determine whether it is within the authorized list of the zero-trust Internet behavior control policy. If it is not within this range, a non-control identifier is added to the business access request. Specifically, the non-control identifier can be added to the 7-layer protocol header field of the business access request, and the business access request with the non-control identifier is sent to the zero-trust gateway. If it is not within this range, public network access is performed according to other routing decision methods.

[0063] At this time, the zero-trust gateway can redirect the service access request to the remote browser service device if the service access request carries a non-control identifier; if the service access request does not carry a non-control identifier, obtain the Internet behavior control list, and redirect the service access request to the remote browser service device according to the Internet behavior control list. In this embodiment, the control list can be a whitelist and / or a blacklist.

[0064] Step 402: Start a remote browser container instance according to the service access request.

[0065] In this embodiment, step 402 can specifically perform a status query through the container session management module to determine whether there is an idle browser container instance currently available. If so, directly start the browser container instance to access the target website. If not, create and start a new browser container instance, and use the new browser container instance to access the target website.

[0066] Step 403: Send an HTTP request to a target website through a remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is a website to be visited indicated by the service access request.

[0067] Step 404: insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response.

[0068] Step 405: Send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0069] In this embodiment, step 405 can specifically send the modified HTTP response to the zero trust gateway in a pixel stream transmission manner.

[0070] In this embodiment, step 401 may specifically receive a service access request through a service adaptation layer. Optionally, step 401 may also include: forwarding the service access request to a service management layer, parsing the service access request through the service management layer, obtaining a security defense control policy, sending the security defense control policy to a remote browser container instance, and generating a security defense interceptor code through the remote browser container instance according to the security defense control policy.

[0071] In this embodiment, the security defense control strategy includes but is not limited to: disabling the text input box function of the web page and prohibiting the download of files of preset types in the page, etc. It should be noted that this embodiment does not specifically limit the preset type, and in actual use, the preset type can be set according to security protection requirements.

[0072] In this embodiment, the specific implementation logic of step 404 of inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance may include:

[0073] When the security defense control policy prohibits downloading files of a preset type in a page, the remote browser container instance 201 traverses and determines whether there is a downloadable file of a preset type in the HTML document (specifically, an H5 document). If so, its download link is set to empty ("about:blank").

[0074] When the security defense control policy is to disable the text input box function of the web page, the remote browser container instance 201 will set the properties of the form and text box controls in the h5 document to a disabled state.

[0075] In the method for defending against phishing attacks provided in the embodiment of the present application, the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device. The remote browser service device is physically isolated from the zero-trust client. The operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, which ensures the security of the zero-trust client accessing the target website; and, because the remote browser container instance can add security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against attack behaviors in deceptive phishing scenarios, enrich the detection means in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent various situations such as pass-by downloads, deceptive induced leaks, and malicious advertisements. The problem of security vulnerabilities in the existing technology for defending against phishing attacks is solved.

[0076] Please refer to Figure 5, which shows a schematic diagram 500 of a structure of an embodiment of a device for defending against phishing attacks according to the present application. The device for defending against phishing attacks can be applied to the remote browser service device described above, and the remote browser service device can be various electronic devices with data processing functions. For example, the above electronic devices can include but are not limited to cloud servers, physical servers, etc. The execution subject of the device for defending against phishing attacks can be a processor in the above electronic devices.

[0077] like Figure 5 As shown, the device for defending against phishing attacks provided in this embodiment may include:

[0078] The receiving module 501 is used to receive a service access request sent by a zero trust client redirected by a zero trust gateway.

[0079] In this embodiment, the zero-trust gateway can redirect the business access request to the remote browser service device if the business access request carries a non-control identifier; if the business access request does not carry a non-control identifier, it obtains the Internet behavior control list and redirects the business access request to the remote browser service device based on the Internet behavior control list.

[0080] The starting module 502 is used to start the remote browser container instance according to the service access request.

[0081] The target website access module 503 is used to send a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be visited indicated by the service access request.

[0082] The interception code insertion module 504 is used to insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response.

[0083] The sending module 505 is used to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

[0084] Optionally, the sending module 505 is specifically used to send the modified HTTP response to the zero trust gateway in a pixel stream transmission manner.

[0085] Optionally, the receiving module 501 is specifically configured to receive a service access request through a service adaptation layer, and forward the service access request to a service management layer.

[0086] The target website access module 503 is specifically used to parse the business access request through the service management layer, obtain the security defense control policy, send the security defense control policy to the remote browser container instance, and generate the security defense interceptor code according to the security defense control policy through the remote browser container instance.

[0087] The specific implementation method of the device for defending against phishing attacks provided in this embodiment can refer to the system and method for defending against phishing attacks provided in the above embodiments, which will not be repeated here.

[0088] In the device for defending against phishing attacks provided by the embodiment of the present application, the zero-trust gateway can redirect the service access request sent by the zero-trust client to the remote browser service device. The remote browser service device is physically isolated from the zero-trust client. The operation of the zero-trust client accessing the target website is completed by the remote browser service device through the remote browser container instance, which ensures the security of the zero-trust client accessing the target website; and, because the remote browser container instance can add a security defense interceptor code to the HTML document of the HTTP response returned by the target website, the technical solution provided by this embodiment can defend against the attack behavior of deceptive phishing scenarios, enrich the detection means in different scenarios, realize all-round and multi-functional detection capabilities, and effectively prevent the occurrence of various situations such as pass-by downloads, deceptive induced leaks, and malicious advertisements. The problem of security vulnerabilities in the existing technology for defending against phishing attacks is solved.

[0089] Reference below Figure 6 , which shows a schematic structural diagram of an electronic device for implementing some embodiments of the present application. Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0090] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0091] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a disk, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0092] In particular, according to some embodiments of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of some embodiments of the present application are executed.

[0093] It should be noted that the computer-readable medium described in some embodiments of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0094] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0095] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: receives a business access request sent by a zero-trust client redirected by a zero-trust gateway; starts a remote browser container instance according to the business access request; sends a Hypertext Transfer Protocol HTTP request to a target website through the remote browser container instance, and receives an HTTP response returned by the target website, wherein the target website is the website to be visited indicated by the business access request; inserts the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance, and obtains the modified HTTP response; sends the modified HTTP response to the zero-trust gateway through the remote browser container instance.

[0096] Computer program code for performing the operations of some embodiments of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++; and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, or may be connected to an external computer (e.g., through the Internet using an Internet service provider), including a local area network (LAN) or a wide area network (WAN).

[0097] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0098] The units described in some embodiments of the present application may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a first determination unit, a second determination unit, a selection unit, and a third determination unit. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0099] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0100] The above description is only some preferred embodiments of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present application is not limited to the technical solutions formed by the specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with (but not limited to) the technical features with similar functions disclosed in the embodiments of the present application to form a technical solution.

Claims

1. A system for defending against phishing attacks, characterized in that: The system comprises: A zero-trust gateway, configured to receive a service access request sent by a zero-trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero-trust client; The remote browser service device is used to start a remote browser container instance according to the business access request, send a Hypertext Transfer Protocol HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert a security defense interceptor code into an HTML document of the HTTP response, obtain the modified HTTP response, and send the modified HTTP response to the zero trust gateway, wherein the target website is the website to be visited indicated by the business access request.

2. The system according to claim 1, characterized in that The remote browser service device is also used to receive the business access request through the service adaptation layer, forward the business access request to the service management layer, parse the business access request through the service management layer, obtain the security defense control policy, send the security defense control policy to the remote browser container instance, and the remote browser container instance generates the security defense interceptor code according to the security defense control policy.

3. The system according to claim 2, characterized in that The security defense control strategy includes: disabling the text input box function of the web page and / or prohibiting the download of files of a preset type in the page.

4. The system according to claim 1, characterized in that The remote browser service device is also used to send the modified HTTP response to the zero-trust gateway in a pixel stream transmission manner.

5. The system according to claim 1, characterized in that The zero-trust gateway is also used to redirect the business access request to a remote browser service device when the business access request carries a non-control identifier; and to obtain an Internet behavior control list when the business access request does not carry a non-control identifier, and redirect the business access request to a remote browser service device based on the Internet behavior control list.

6. The system according to claim 1, characterized in that The system further comprises: Zero Trust Dynamic Policy Center, which is used to dynamically generate and maintain Internet behavior control lists and security defense control strategies; The zero-trust console is used to send the Internet behavior control list to the zero-trust gateway and send the security defense control policy to the remote browser service device.

7. A method for defending against phishing attacks, characterized in that: Applied to a remote browser service device, the method comprises: Receive a business access request sent by a zero-trust client redirected by a zero-trust gateway; Starting a remote browser container instance according to the service access request; Sending a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receiving an HTTP response returned by the target website, wherein the target website is a website to be visited indicated by the service access request; Inserting the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance to obtain the modified HTTP response; The modified HTTP response is sent to the zero trust gateway through the remote browser container instance.

8. A device for defending against phishing attacks, characterized in that: Applied to a remote browser service device, the device comprising: A receiving module, used to receive a service access request sent by a zero-trust client redirected by a zero-trust gateway; A startup module, used to start a remote browser container instance according to the service access request; A target website access module, used to send a Hypertext Transfer Protocol (HTTP) request to a target website through the remote browser container instance, and receive an HTTP response returned by the target website, wherein the target website is the website to be visited indicated by the service access request; An interception code insertion module, used to insert the security defense interceptor code into the HTML document of the HTTP response through the remote browser container instance, and obtain the modified HTTP response; A sending module is used to send the modified HTTP response to the zero trust gateway through the remote browser container instance.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in claim 7.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 7 is implemented.

Images