Information detection method and device and computer equipment

Abstract

The embodiment of the invention provides an information detection method and device and computer equipment, and the method comprises the steps: obtaining a to-be-detected static page in response to a static page publishing request; querying a static detection rule which is pre-stored in a database and corresponds to the type of the static page; performing static detection on the static page according to the static detection rule; judging whether the static detection is passed or not; if yes, releasing the static page and monitoring dynamic operation information of a user on the static page; querying a dynamic detection rule which is pre-stored in a database and corresponds to the dynamic operation information; and dynamically detecting the dynamic operation information according to the dynamic detection rule. According to the method, static and dynamic comprehensive detection can be performed on the information, so that the detection strength is improved; and static or dynamic detection rules matched with the information are extracted from the database in real time according to actual needs, so that the efficiency and the reliability of information detection are both considered, and security vulnerabilities are avoided.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of data security processing technology, and in particular to an information detection method, device and computer equipment. Background Art

[0002] With the development of the information age, data has become a new production factor in the digital economy. Data has brought considerable value in driving business decisions and comprehensive social governance. If there is a large amount of sensitive data such as personnel information, disclosure information, and system information in the current business system, external attackers will have the opportunity to obtain sensitive privacy information by exploiting application component vulnerabilities, system return information vulnerabilities, etc., causing sensitive data leakage incidents. Therefore, data security testing is required.

[0003] However, the existing data detection methods mainly use non-real-time detection methods for static detection, such as timed polling scanning, which makes the detection of static pages published in real time insufficient; and dynamic detection cannot achieve coordinated detection of the network layer and the application layer, so there are major shortcomings.

[0004] The embodiments of this specification are intended to provide an information detection method, apparatus and computer equipment. Summary of the invention

[0005] In view of the above-mentioned problems in the prior art, the purpose of the embodiments of this specification is to provide an information detection method, apparatus and computer equipment to solve the problem that the information detection in the prior art is insufficient and prone to security vulnerabilities.

[0006] In order to solve the above technical problems, the specific technical solutions of the embodiments of this specification are as follows:

[0007] In a first aspect, an embodiment of the present specification provides an information detection method, including:

[0008] In response to the static page publishing request, obtaining the static page to be detected;

[0009] Querying a static detection rule pre-stored in a database corresponding to the type of the static page;

[0010] According to the static detection rule, static detection is performed on the static page;

[0011] Determining whether the static detection is passed;

[0012] If yes, publish the static page and monitor the user's dynamic operation information on the static page;

[0013] querying a dynamic detection rule corresponding to the dynamic operation information pre-stored in a database;

[0014] According to the dynamic detection rule, the dynamic operation information is dynamically detected.

[0015] Specifically, according to the static detection rule, static detection is performed on the static page, including:

[0016] Detecting the static page line by line to identify text information in the static page;

[0017] Segmenting the text information to obtain multiple phrases;

[0018] Comparing the multiple phrases with the sensitive word library in the static detection rule respectively;

[0019] Determining whether there is a sensitive word corresponding to any one of the multiple word groups in the sensitive word library;

[0020] If so, it is determined that the static page fails the static detection.

[0021] Furthermore, static detection is performed on the static page, including:

[0022] Get the characters whose data type is integer in the text information;

[0023] Determining whether an IP address exists in the static page according to the size of the characters and the connecting character between two adjacent characters;

[0024] If so, it is determined that the static page fails the static detection.

[0025] Specifically, according to the dynamic detection rule, dynamically detecting the dynamic operation information includes:

[0026] Responding to the user's dynamic operation information, obtaining the user's dynamic input information;

[0027] Encrypting the dynamic input information to obtain encrypted ciphertext input information;

[0028] Sending the ciphertext input information to a server so that the server verifies the ciphertext input information;

[0029] Receive verification results fed back by the server;

[0030] When the verification result is failure, it is determined that the dynamic detection has not been passed.

[0031] Furthermore, the method further comprises:

[0032] If the static detection fails, the publishing of the static page is intercepted and the generated static detection log is fed back to the relevant development and operation personnel;

[0033] If the dynamic detection fails, the user's dynamic operation is rejected and the generated dynamic detection log is fed back to the relevant development and operation personnel.

[0034] Preferably, the method further comprises:

[0035] updating the static detection rules in the database according to the static detection log, and

[0036] The dynamic detection rules in the database are updated according to the dynamic detection log.

[0037] Preferably, after the static page is published, the method further comprises:

[0038] Monitoring the static pages;

[0039] When the static page is updated, obtaining incremental update data of the static page;

[0040] Static detection and dynamic detection are performed on the incremental update data.

[0041] In a second aspect, an embodiment of the present specification provides an information detection device, including:

[0042] A response module, used for responding to a static page publishing request and obtaining a static page to be detected;

[0043] A first query module, used for querying a static detection rule corresponding to the type of the static page pre-stored in a database;

[0044] A static detection module, used for performing static detection on the static page according to the static detection rule;

[0045] A judging module, used to judge whether the static test is passed;

[0046] A monitoring module, for publishing the static page and monitoring the user's dynamic operation information on the static page if yes;

[0047] A second query module, used for querying the dynamic detection rules corresponding to the dynamic operation information pre-stored in the database;

[0048] A dynamic detection module is used to dynamically detect the dynamic operation information according to the dynamic detection rule.

[0049] In a third aspect, an embodiment of the present specification provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method provided by the above technical solution when executing the computer program.

[0050] In a fourth aspect, an embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method provided by the above technical solution is implemented.

[0051] In a fifth aspect, an embodiment of the present specification provides a computer program product, comprising at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method provided by the above technical solution.

[0052] By adopting the above-mentioned technical scheme, an information detection method, device and computer equipment provided in the embodiments of this specification can perform comprehensive static and dynamic detection of information, thereby improving the detection strength; and according to actual needs, the static detection rules and dynamic detection rules stored in the database are updated in real time, so that when there is a need for information detection, the static or dynamic detection rules that are adapted to it are extracted from the database in real time, thereby taking into account both the efficiency and reliability of information detection and avoiding security vulnerabilities.

[0053] In order to make the above and other purposes, features and advantages of the embodiments of this specification more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 A schematic diagram showing the steps of an information detection method provided by an embodiment of this specification is shown;

[0056] Figure 2 A schematic diagram showing the steps of performing static detection on a static page according to static detection rules in an embodiment of this specification;

[0057] Figure 3 A schematic diagram showing another step of performing static detection on a static page in an embodiment of this specification;

[0058] Figure 4A schematic diagram showing the steps of dynamically detecting dynamic operation information according to dynamic detection rules in an embodiment of this specification is shown;

[0059] Figure 5 A schematic diagram of the structure of an information detection device provided in an embodiment of this specification is shown;

[0060] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of this specification is shown.

[0061] Description of the accompanying symbols:

[0062] 501, response module;

[0063] 502. First query module;

[0064] 503. Static detection module;

[0065] 504, judgment module;

[0066] 505. Monitoring module;

[0067] 506. Second query module;

[0068] 507. Dynamic detection module;

[0069] 602. Computer equipment;

[0070] 604, processor;

[0071] 606. Memory;

[0072] 608, driving mechanism;

[0073] 610, input / output module;

[0074] 612. Input devices;

[0075] 614. Output device;

[0076] 616. Presentation equipment;

[0077] 618. Graphical user interface;

[0078] 620, network interface;

[0079] 622, communication link;

[0080] 624. Communication bus. DETAILED DESCRIPTION

[0081] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0082] It should be noted that the terms "first", "second", etc. in this specification and claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this specification described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0083] In order to solve the above problems, the embodiments of this specification provide an information detection method, apparatus and computer equipment, which can solve the problem of security vulnerabilities that are prone to occur due to insufficient information detection in the prior art. Figure 1 This is a schematic diagram of the steps of an information detection method provided in an embodiment of this specification. This specification provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or device product is executed, it can be executed in the order of the method shown in the embodiment or the drawings or in parallel. Specifically, Figure 1 As shown, the method may include:

[0084] S101: In response to a static page publishing request, a static page to be detected is obtained.

[0085] The static page is a page that is to be published to the client. Taking the transaction system as an example, the static page may include its homepage / startup page, login / registration page, detailed content page (such as detailed introduction of the product), payment / settlement page, etc. That is, in the embodiment of this specification, each static page is first subjected to static detection before it is published, so as to avoid the distribution of non-compliant static pages.

[0086] S102: Query the static detection rules pre-stored in the database corresponding to the type of the static page.

[0087] S103: Performing static detection on the static page according to the static detection rule.

[0088] S104: Determine whether the static detection is passed.

[0089] S105: If yes, publish the static page and monitor the user's dynamic operation information on the static page.

[0090] S106: Query the dynamic detection rules pre-stored in the database corresponding to the dynamic operation information.

[0091] That is, the database pre-stores a variety of static detection rules and a variety of dynamic detection rules, so that according to the type of static page, a static detection rule that is adapted to it is selected, and a dynamic detection rule that is adapted to the dynamic operation information is selected, so that static detection and dynamic detection are performed in a targeted manner, which is conducive to improving the efficiency of static detection and dynamic detection.

[0092] S107: Perform dynamic detection on the dynamic operation information according to the dynamic detection rule.

[0093] An information detection method provided in an embodiment of the present specification can combine static and dynamic detection to comprehensively detect information, thereby improving the detection strength; and the static detection rules and dynamic detection rules stored in the database can be updated in real time according to actual needs. When there is a detection demand, the adapted static or dynamic detection rules are extracted from the database in real time, thereby taking into account the efficiency and reliability of information detection and avoiding the occurrence of security vulnerabilities.

[0094] Specifically, Figure 2 As shown, in the embodiment of this specification, step S103: performing static detection on the static page according to the static detection rule may include the following steps:

[0095] S201: Detect the static page line by line, and identify text information in the static page.

[0096] In some feasible embodiments, the text information in the static page may be recognized using OCR (Optical Character Recognition) technology.

[0097] S202: Segment the text information to obtain multiple phrases.

[0098] In some feasible embodiments, NLP (Natural Language Processing) technology can be used to perform word segmentation on the text information to obtain each phrase. In some specific embodiments, the development requirements can be segmented based on a string matching method and a statistical method.

[0099] For example, the reverse maximum matching method is often combined with the subtraction matching method. Assuming that the length of the longest word in the dictionary is N, N is used as the length standard for starting with subtraction. The word segmentation method may include the following steps:

[0100] The text information to be scanned (for example, a text string of length S) is intercepted from right to left to obtain a character string W1 of length N, and a dictionary is searched for an entry of the character string W1;

[0101] If it exists, W1 is marked as the segmented phrase, the length of the text string to be scanned is updated to SN, and the updated text string to be scanned is scanned and intercepted from right to left;

[0102] If it does not exist, the truncation length is reduced by 1 (i.e., N-1), and a character string W1' with a length of N-1 is truncated from the text string S to be scanned again, and the dictionary is searched for an entry of the character string W';

[0103] If it exists, W1' is marked as the segmented phrase, the length of the text string to be scanned is updated to S-N+1, and the updated text string to be scanned is scanned and intercepted from right to left;

[0104] If it does not exist, the truncation length is reduced by 1 again (i.e. N-2) and the entry is matched against the search dictionary until the truncation length is reduced to 1;

[0105] Repeat the above steps until the entire text information is scanned and the word segmentation is completed. After this process, the original text string of length S will be segmented into multiple phrases W1, W2, ..., Wn, and each Wi (Wi is the i-th phrase segmented from the text string) is an entry in the dictionary.

[0106] Since the central word of Chinese language is relatively backward, the reverse maximum matching word segmentation method is more suitable for the word segmentation processing of Chinese text, which is conducive to improving the accuracy of the word segmentation results.

[0107] S203: Compare the multiple word groups with the sensitive word library in the static detection rule respectively.

[0108] It should be noted that when the types of the static pages are different, the sensitive words in the sensitive word library in the static detection rules are also different. For example, for transaction-type static pages, the sensitive words in the sensitive word library may include user name, ID number, transaction serial number, etc.; for portal-type static pages, the sensitive words in the sensitive word library may include product number, net value, etc. In addition, for different types of static pages, their sensitive word libraries may also include common parts, such as phrases that violate social public order and public order and morality and affect social stability. The sensitive words in the sensitive word library are collected and stored in the database in advance and updated in a timely manner when used later.

[0109] S204: Determine whether there is a sensitive word corresponding to any one of the multiple word groups in the sensitive word library.

[0110] S205: If so, determine that the static page fails the static detection.

[0111] That is, when there is a sensitive word corresponding to any one of the multiple phrases in the sensitive word library, the static page is determined to have failed the static detection; and only when there is no corresponding sensitive word in multiple phrases, the static page is determined to have passed the static detection.

[0112] Furthermore, when there is a sensitive word corresponding to any one of the multiple word groups in the sensitive word library, the method further includes:

[0113] Recording the position of the phrase corresponding to the sensitive word in the static page and continuing the detection until the static page detection is completed;

[0114] The position of the phrase in the static page is recorded in a static detection log.

[0115] Furthermore, if Figure 3 As shown, in the embodiment of this specification, the static detection of the static page further includes:

[0116] S301: Acquire characters whose data type is integer in text information.

[0117] S302: judging whether an IP address exists in the static page according to the size of the characters and the connecting character between two adjacent characters.

[0118] An IP address usually consists of four fields separated by dots, and the size of each field is between 0 and 255. You can determine whether it is an IP address based on whether there is one and only one floating-point character (corresponding to the dot that separates the fields) between two adjacent integer characters, and whether the character size is greater than or equal to 0 and less than or equal to 255.

[0119] S303: If so, determine that the static page fails the static detection.

[0120] Since the IP address exposed in the page may bring risks such as network attacks (such as DDoS attacks, SQL injections, etc.) and privacy leaks (such as geographic location, network activities, etc.), in the embodiments of this specification, when an IP address is detected in a static page, it will be determined that the static page has failed the static detection.

[0121] Specifically, Figure 4 As shown, in the embodiment of this specification, step S107: dynamically detecting the dynamic operation information according to the dynamic detection rule may include the following steps:

[0122] S401: In response to the user's dynamic operation information, obtain the user's dynamic input information.

[0123] Taking a transaction system as an example, its static page may be a payment / settlement page, on which users can purchase products. The dynamic input information may be the purchase quantity, purchase amount, and the payment password entered when paying the purchase amount. In addition, it may also include the user name and login password entered when logging into the payment / settlement page before purchase.

[0124] S402: Encrypt the dynamic input information to obtain encrypted ciphertext input information.

[0125] In some feasible embodiments, the dynamic input information may be encrypted using an encryption algorithm pre-agreed with the server.

[0126] S403: Send the ciphertext input information to a server, so that the server verifies the ciphertext input information.

[0127] In contrast, the server can use a pre-agreed decryption algorithm to decrypt the received ciphertext input information;

[0128] If the server decryption fails, the verification result is failure;

[0129] If the server decrypts successfully, it compares the decrypted user input information with the pre-stored information;

[0130] If the comparison result is inconsistent, the verification result is failed.

[0131] For example, if the user's dynamic input information is a payment password, the payment password is encrypted and sent to the server for verification. The server decrypts the encrypted payment password using a pre-agreed decryption algorithm. If the decryption fails, the verification result of failure is fed back. When the decryption is successful, the decrypted payment password is compared with the pre-stored payment password of the user. If the comparison result is consistent, the successful verification result is fed back; if the comparison result is inconsistent, the verification result of failure is fed back.

[0132] S404: Receive the verification result fed back by the server.

[0133] S404: When the verification result is a failure, it is determined that the dynamic detection has not been passed.

[0134] On the contrary, when the verification result fed back by the server is successful, it is determined that the dynamic detection has passed.

[0135] Therefore, the information detection method provided in the embodiments of this specification can realize dynamic detection of information. Furthermore, in the embodiments of this specification, dynamic detection includes dynamic detection of the network layer and dynamic detection of the application layer. The dynamic detection of the network layer uses a plain text detection method to detect the data of the network layer; the dynamic detection of the application layer uses a cipher text detection method to generate a jar package suitable for the Java platform and root it in the background, so that it can be loaded by the application in real time, take effect in real time, and respond quickly.

[0136] Furthermore, in the embodiments of this specification, the method further includes:

[0137] If the static detection fails, the publishing of the static page is intercepted and the generated static detection log is fed back to the relevant development and operation personnel.

[0138] Exemplarily, the static detection log may record the location of sensitive phrases in the static page, and / or IP address information, so that after the static detection log is fed back to relevant development or operation and maintenance personnel, the development or operation and maintenance personnel can effectively solve the problems existing in the static page according to the static detection log; and after solving the problems, perform static detection again until the static detection passes and is released.

[0139] Similarly, if the dynamic detection fails, the user's dynamic operation is rejected and the generated dynamic detection log is fed back to the relevant development and operation personnel.

[0140] Exemplarily, the dynamic detection log may record the reasons for the dynamic verification failure, for example, the user's dynamic input information is incorrect, etc. When the dynamic operation is abnormal, for example, the user passes the dynamic verification but fails to perform the dynamic operation successfully due to the response timeout, the dynamic detection log can be used to determine whether the server is faulty, so that development and operation and maintenance personnel can find and locate the cause of the fault.

[0141] Furthermore, the embodiments of this specification further include:

[0142] Collect static detection logs and dynamic detection logs;

[0143] updating the static detection rules in the database according to the static detection log, and

[0144] The dynamic detection rules in the database are updated according to the dynamic detection log.

[0145] In some feasible embodiments, in the dynamic detection rules, specifically when the network layer uses a plain text detection method to detect data at the network layer, there may be some overlapping parts with static detection. By updating the static detection rules and the dynamic detection rules, not only can the static detection rules and the dynamic detection rules be more in line with the actual development needs, but also the duplication between the static detection rules and the dynamic detection rules can be reduced, thereby reducing the redundancy of detection.

[0146] In some preferred embodiments, after the static page is published, the method may further include:

[0147] Monitoring the static pages;

[0148] When the static page is updated, obtaining incremental update data of the static page;

[0149] Static detection and dynamic detection are performed on the incremental update data.

[0150] That is, when a new version of a static page is released, the incremental update data can be extracted, such as new sections, new functions, etc., so that only the incremental update part can be statically and dynamically detected, which is conducive to improving detection efficiency and facilitating continuous integration and agile development.

[0151] It should be noted that in the embodiments of this specification, the user dynamic input information is information that has been authorized and agreed by the user in the past. And the acquisition, storage, use, and processing of dynamic input information in the technical solutions described in the embodiments of this specification are in compliance with relevant provisions of national laws and regulations.

[0152] Based on the above-described information detection method, the embodiments of this specification also provide an information detection device. The device may include a system (including a distributed system), software (application), module, component, server, client, etc. using the method described in the embodiments of this specification and a device in combination with necessary implementation hardware. Based on the same innovative concept, the device in one or more embodiments provided in the embodiments of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the device are similar, the implementation of the specific device in the embodiments of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. As used below, the term "unit" or "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0153] like Figure 5 As shown, the embodiment of this specification also provides an information detection device, the device comprising:

[0154] A response module 501 is used to respond to a static page publishing request and obtain a static page to be detected;

[0155] A first query module 502, used to query the static detection rules corresponding to the type of the static page pre-stored in the database;

[0156] A static detection module 503, configured to perform static detection on the static page according to the static detection rule;

[0157] A judging module 504 is used to judge whether the static test is passed;

[0158] Monitoring module 505, for publishing the static page and monitoring the user's dynamic operation information on the static page if yes;

[0159] A second query module 506, configured to query a dynamic detection rule corresponding to the dynamic operation information pre-stored in a database;

[0160] The dynamic detection module 507 is used to perform dynamic detection on the dynamic operation information according to the dynamic detection rule.

[0161] The beneficial effects obtained by the device provided in the embodiments of this specification are consistent with the beneficial effects obtained by the above method and will not be repeated here.

[0162] like Figure 6As shown, a computer device provided by an embodiment of this specification, the information detection device in this specification can be a computer device in this embodiment, and the above method of this specification is executed. The computer device 602 may include one or more processors 604, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 602 may also include any memory 606, which is used to store any kind of information such as code, settings, data, etc. Non-restrictive, for example, the memory 606 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 602. In one case, when the processor 604 executes an associated instruction stored in any memory or a combination of memories, the computer device 602 can perform any operation of the associated instruction. The computer device 602 also includes one or more drive mechanisms 608 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0163] The computer device 602 may also include an input / output module 610 (I / O) for receiving various inputs (via input devices 612) and for providing various outputs (via output devices 614). A specific output mechanism may include a presentation device 616 and an associated graphical user interface (GUI) 618. In other embodiments, the input / output module 610 (I / O), input device 612, and output device 614 may not be included, and the computer device 602 may be used as a computer device in a network. The computer device 602 may also include one or more network interfaces 620 for exchanging data with other devices via one or more communication links 622. One or more communication buses 624 couple the components described above together.

[0164] The communication link 622 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 622 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0165] Corresponding to Figures 1 to 4 In addition to the method shown, an embodiment of the specification also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are executed.

[0166] The embodiment of the present specification also provides a computer-readable instruction, wherein when the processor executes the instruction, the program therein causes the processor to execute the following Figures 1 to 4 The method shown.

[0167] The embodiments of the present specification also provide a computer program product, including at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the following Figures 1 to 4 The method shown.

[0168] It should be understood that in the various embodiments of this specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0169] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0170] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this specification.

[0171] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0172] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0173] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0174] In addition, each functional unit in each embodiment of this specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0175] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0176] Specific embodiments are used in this specification to illustrate the principles and implementation methods of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of this specification. At the same time, for those skilled in the art, according to the ideas of this specification, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this specification.

Claims

1. An information detection method, characterized in that: include: In response to the static page publishing request, obtaining the static page to be detected; Querying a static detection rule pre-stored in a database corresponding to the type of the static page; According to the static detection rule, static detection is performed on the static page; Determining whether the static detection is passed; If yes, publish the static page and monitor the user's dynamic operation information on the static page; querying a dynamic detection rule corresponding to the dynamic operation information pre-stored in a database; According to the dynamic detection rule, the dynamic operation information is dynamically detected.

2. The method according to claim 1, characterized in that According to the static detection rule, static detection is performed on the static page, including: Detecting the static page line by line to identify text information in the static page; Segmenting the text information to obtain multiple phrases; Comparing the multiple phrases with the sensitive word library in the static detection rule respectively; Determining whether there is a sensitive word corresponding to any one of the multiple word groups in the sensitive word library; If so, it is determined that the static page fails the static detection.

3. The method according to claim 2, characterized in that Performing static detection on the static page further includes: Get the characters whose data type is integer in the text information; Determining whether an IP address exists in the static page according to the size of the characters and the connecting character between two adjacent characters; If so, it is determined that the static page fails the static detection.

4. The method according to claim 1, characterized in that: According to the dynamic detection rule, dynamically detecting the dynamic operation information further includes: Responding to the user's dynamic operation information, obtaining the user's dynamic input information; Encrypting the dynamic input information to obtain encrypted ciphertext input information; Sending the ciphertext input information to a server so that the server verifies the ciphertext input information; Receive verification results fed back by the server; When the verification result is failure, it is determined that the dynamic detection has not been passed.

5. The method according to claim 1, characterized in that The method further comprises: If the static detection fails, the publishing of the static page is intercepted and the generated static detection log is fed back to the relevant development and operation personnel; If the dynamic detection fails, the user's dynamic operation is rejected and the generated dynamic detection log is fed back to the relevant development and operation personnel.

6. The method according to claim 5, characterized in that The method further comprises: updating the static detection rules in the database according to the static detection log, and The dynamic detection rules in the database are updated according to the dynamic detection log.

7. The method according to claim 1, characterized in that After the static page is published, the method further includes: Monitoring the static pages; When the static page is updated, obtaining incremental update data of the static page; Static detection and dynamic detection are performed on the incremental update data.

8. An information detection device, characterized in that: include: A response module, used for responding to a static page publishing request and obtaining a static page to be detected; A first query module, used for querying a static detection rule corresponding to the type of the static page pre-stored in a database; A static detection module, used for performing static detection on the static page according to the static detection rule; A judging module, used to judge whether the static test is passed; A monitoring module, for publishing the static page and monitoring the user's dynamic operation information on the static page if yes; A second query module, used for querying the dynamic detection rules corresponding to the dynamic operation information pre-stored in the database; The dynamic detection module is used to dynamically detect the dynamic operation information according to the dynamic detection rule.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The method comprises at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 7.

Images