Webpage tampering detection method and device, equipment and storage medium

Abstract

The invention discloses a webpage tampering detection method, device and equipment and a storage medium, and the method comprises the steps: obtaining label information in an HTML code, obtaining class name information, color information and CSS selector information in a CSS code, constructing a JavaScript syntax tree, and obtaining a JavaScript syntax tree; parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body and occurrence frequency information of a preset global variable are obtained; constructing a first feature vector of the webpage; first feature vectors are obtained once every preset time in the time range, and a dynamic threshold range of corresponding features is determined according to the multiple first feature vectors; and accessing the webpage and acquiring a second feature vector, and judging whether the webpage is tampered or not according to whether the proportion of the feature of the second feature vector beyond the corresponding dynamic threshold range exceeds a preset threshold or not. By using the method disclosed by the invention, the accuracy and the real-time performance of detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a web page tampering detection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, web pages have become an important platform for people to obtain information, communicate and conduct business. At the same time, the security of web pages is also facing severe challenges. Web page tampering incidents occur frequently, which may lead to a series of serious consequences, such as the leakage of users' personal information, which puts users at risk of privacy infringement; malicious tampering of web page content may mislead users and cause them to make wrong decisions; for enterprises and brands, web page tampering will damage their reputation and image and cause immeasurable economic losses. At present, although there are some web page tampering detection methods, these methods have many shortcomings in practical applications. On the one hand, the detection accuracy is not high, and it is difficult to accurately detect signs of web page tampering, resulting in some tampering behaviors not being detected and prevented in time. On the other hand, poor real-time performance is also a prominent problem. It is impossible to detect the tampering of web pages in time, so that users may be misled or suffer losses when visiting tampered web pages. Summary of the invention

[0003] The embodiments of the present invention provide a webpage tampering detection method, device, equipment and storage medium to solve the technical problems of low accuracy and poor real-time performance of webpage tampering detection in the prior art.

[0004] The technical solution of the present invention is as follows: a method for detecting webpage tampering is provided, the method comprising:

[0005] Get the HTML code, CSS code and JavaScript code of the web page;

[0006] Obtain tag information in the HTML code, obtain class name information, color information and CSS selector information in the CSS code, build a JavaScript syntax tree, obtain parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body and occurrence count information of preset global variables;

[0007] Constructing a first feature vector of the webpage according to the tag information, the class name information, the color information, the CSS selector information, the parameter information, the statement information, and the occurrence number information of the preset global variable;

[0008] Acquire the first feature vector once at a preset time interval within a time range to obtain a plurality of first feature vectors, and determine a dynamic threshold range of a corresponding feature according to the plurality of first feature vectors;

[0009] Access a web page and obtain a second feature vector, and determine whether the web page has been tampered with based on whether the proportion of the features of the second feature vector that are outside the corresponding dynamic threshold range exceeds a preset threshold.

[0010] Furthermore, obtaining tag information in the HTML code includes:

[0011] Obtain the number of times a tag appears, and obtain the average depth of the tag in the HTML code according to the number of times the tag appears and the average depth calculation formula, wherein the average depth calculation formula includes in, is the average depth of tags in the HTML code, m is the number of tags, is the i-th label t i The number of occurrences of is the i-th label t i Depth.

[0012] Furthermore, obtaining the class name information and color information in the CSS code includes:

[0013] The occurrence number of each class name in the CSS code is counted, the color attribute in the CSS code is obtained, and the color value corresponding to the color attribute is converted into the HSL space to determine the usage frequency of the color value in different hue intervals.

[0014] Furthermore, obtain CSS selector information, including:

[0015] The average complexity calculation formula is used to obtain the average complexity of the CSS selector. The average complexity calculation formula includes: in, is the average complexity of CSS selectors, q is the number of CSS selectors, For the lth CSS selector s l complexity.

[0016] Furthermore, parameter information is obtained, including:

[0017] Obtain the number of parameters of the JavaScript function, and obtain the mean value of the number of parameters in the JavaScript syntax tree according to the number of parameters and the mean value calculation formula of the number of parameters, wherein the mean value calculation formula of the number of parameters includes is the mean number of parameters, r is the number of JavaScript functions, For the nth JavaScript function f n The number of parameters.

[0018] Furthermore, statement information is obtained, including:

[0019] The number of statements in the JavaScript function body is obtained, and the mean number of statements in the JavaScript syntax tree is obtained according to the number of statements and the mean calculation formula of the number of statements. The mean calculation formula of the number of statements includes is the mean number of sentences, is the nth JavaScript function f n The number of statements within the function body.

[0020] Further, determining a dynamic threshold range of a corresponding feature according to the plurality of first feature vectors includes:

[0021] According to the multiple first feature vectors and the k-sigma principle of normal distribution, a dynamic threshold lower limit and a dynamic threshold upper limit of the corresponding feature are obtained to determine the dynamic threshold range of the corresponding feature.

[0022] Another technical solution of the present invention is as follows, providing a webpage tampering detection device, including a code acquisition module, a code information acquisition module, a feature vector construction module, a dynamic threshold range determination module and a tampering judgment module;

[0023] The code acquisition module is used to acquire the HTML code, CSS code and JavaScript code of the web page;

[0024] The code information acquisition module is used to acquire tag information in the HTML code, acquire class name information, color information and CSS selector information in the CSS code, construct a JavaScript syntax tree, and acquire parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body and occurrence number information of preset global variables;

[0025] The feature vector construction module is used to construct a first feature vector of a web page according to the tag information, the class name information, the color information, the CSS selector information, the parameter information, the statement information and the occurrence number information of the preset global variable;

[0026] The dynamic threshold range determination module is used to obtain the first feature vector once at a preset time interval to obtain multiple first feature vectors, and determine the dynamic threshold range of the corresponding feature according to the multiple first feature vectors;

[0027] The tampering judgment module is used to access the web page and obtain the second feature vector, and judge whether the web page has been tampered with according to whether the proportion of the features of the second feature vector being outside the corresponding dynamic threshold range exceeds a preset threshold.

[0028] Another technical solution of the present invention is as follows: a computer device is provided, the device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0029] Memory, used to store computer programs;

[0030] The processor is used to implement the steps of the web page tampering detection method described in any of the above technical solutions when executing the program stored in the memory.

[0031] Another technical solution of the present invention is as follows: a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the web page tampering detection method as described in any of the above technical solutions are implemented.

[0032] The beneficial effects of the present invention are as follows: obtaining HTML code, CSS code and JavaScript code of a web page; obtaining tag information in the HTML code, obtaining class name information, color information and CSS selector information in the CSS code, constructing a JavaScript syntax tree, obtaining parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body and occurrence number information of preset global variables; constructing a first feature vector of a web page according to the tag information, the class name information, the color information, the CSS selector information, the parameter information, the statement information and the occurrence number information of the preset global variables; obtaining the first feature vector once at a preset time interval within a time range to obtain multiple first feature vectors, and determining corresponding feature vectors according to the multiple first feature vectors The invention provides a method for detecting tampering of a web page by detecting a dynamic threshold range of a characteristic; accessing a web page and obtaining a second characteristic vector, and judging whether the web page has been tampered with according to whether the proportion of the characteristic of the second characteristic vector being outside the corresponding dynamic threshold range exceeds a preset threshold; taking into account a variety of characteristics of HTML, CSS and JavaScript, and more comprehensively describing the essential characteristics of a web page, and more accurately distinguishing between legitimate changes and malicious tampering through comprehensive feature extraction, and adjusting the detection threshold according to the characteristic changes of the web page during normal operation through the dynamic threshold range, and taking into account the distribution of characteristic values, effectively reducing false alarms caused by normal updates of the web page, and improving the accuracy of web page tampering detection; by accessing a web page and obtaining a second characteristic vector, and judging whether the web page has been tampered with according to whether the proportion of the characteristic of the second characteristic vector being outside the corresponding dynamic threshold range exceeds a preset threshold, it is possible to detect whether the web page has been tampered with in real time, and improve the real-time performance of web page tampering detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0034] Figure 1 A schematic diagram of a process flow of a webpage tampering detection method provided by an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of the structure of a web page tampering detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] In the description of this application, the words "first", "second", etc. are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order. In this specification, the terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0038] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] Figure 1 FIG. 1 is a flow chart of a webpage tampering detection method according to an embodiment of the present invention. It should be noted that the webpage tampering detection method according to the present invention is not limited to the webpage tampering detection method according to the embodiment of the present invention if the results are substantially the same. Figure 1 The process sequence shown is limited. Figure 1 As shown, the webpage tampering detection method mainly includes the following steps:

[0040] S101, obtaining HTML code, CSS code and JavaScript code of a web page;

[0041] In a specific embodiment, a normal web page may be accessed to obtain the HTML, CSS, and JavaScript codes of the web page.

[0042] S102, obtaining tag information in the HTML code, obtaining class name information, color information, and CSS selector information in the CSS code, constructing a JavaScript syntax tree, and obtaining parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body, and occurrence count information of preset global variables;

[0043] In an optional implementation, obtaining tag information in the HTML code includes:

[0044] Obtain the number of times a tag appears, and obtain the average depth of the tag in the HTML code according to the number of times the tag appears and the average depth calculation formula, wherein the average depth calculation formula includes in, is the average depth of tags in the HTML code, m is the number of tags, is the i-th label t i The number of occurrences of is the i-th label t i Depth.

[0045] In a specific embodiment, a stack-based HTML parsing algorithm can be used to start from the above HTML code stream and create an empty stack for storing tag information. When a start tag (such as ), push the tag name and related attributes (such as id, class, etc.) into the stack, and when the end tag (such as ), the corresponding start tag information is popped from the stack. During this process, the number of occurrences of the preset tag is counted, for example <script>标签、标签，得到标签集合为T＝{t1，t2，...，tm}，对于第i个标签ti，其出现次数记为

[0046] 一个具体实施例中，在解析HTML代码时，对于每个标签，记录其在文档树中的深度，例如，标签<body>下的直接子标签深度为1，<body>下标签内的标签深度根据其在内的层次计算，设第i个标签ti的深度为计算平均深度

[0047] 在一个可选的实施方式中，获取所述CSS代码中的类名信息、颜色信息，包括：

[0048] 统计所述CSS代码中每个类名的出现次数，获取所述CSS代码中的颜色属性，将所述颜色属性对应的颜色值转换到HSL空间内，以确定不同色相区间内颜色值的使用频率。

[0049] 一个具体实施例中，解析CSS代码，提取类名和选择器信息，对于第一j个类名cj，统计其在CSS代码中的出现次数同时，分析CSS属性值的分布，具体的，对于颜色属性，可以将对应的颜色值转换为HSL(色相、饱和度、亮度)空间，统计不同色相区间内颜色值的使用频率。设颜色属性的色相区间集合为H＝{h1，h2，...，hp}，区间hk内颜色使用频率为

[0050] 在一个可选的实施方式中，获取CSS选择器信息，包括：

[0051] 利用平均复杂度计算公式获取CSS选择器的平均复杂度，所述平均复杂度计算公式包括其中，为CSS选择器的平均复杂度，q为CSS选择器的个数，为第l个CSS选择器sl的复杂度。

[0052] 一个具体实施例中，对于每个CSS选择器，根据其包含的标签、类名、ID和伪类等元素的数量计算复杂度，不失一般性，设CSS选择器集合为S＝{s1，s2，...，sq}，第l个CSS选择器sl的复杂度记为通过加权计算CSS选择器的平均复杂度其中，权重可以根据元素类型的重要性设定，上述公式中元素的权重相等。

[0053] 在一个可选的实施方式中，获取参数信息，包括：

[0054] 获取JavaScript函数的参数个数，根据所述参数个数以及参数个数的均值计算公式获取所述JavaScript语法树中参数个数均值，所述参数个数的均值计算公式包括为参数个数均值，r为JavaScript函数的数量，为第n个JavaScript函数fn的参数个数。

[0055] 一个具体实施例中，构建JavaScript语法树，遍历JavaScript语法树来提取函数相关信息，对于第n个JavaScript函数fn，记录其名称、参数个数和函数体内的语句数量分析函数调用关系，构建函数调用图，不失一般性，设函数集合为F＝{f1，f2，…，fr}，计算函数参数个数的均值

[0056] 在一个可选的实施方式中，获取语句信息，包括：

[0057] 获取JavaScript函数体内的语句数量，根据所述语句数量以及语句数量的均值计算公式获取所述JavaScript语法树中语句数量的均值，所述语句数量的均值计算公式包括为语句数量的均值，为第n个JavaScript函数fn函数体内的语句数量。

[0058] 一个具体实施例中，可以统计JavaScript代码中预设全局变量的使用情况，例如，对于常用的window对象的属性访问次数进行统计，设全局变量集合为G＝{g1，g2，...，gs}，全局变量的使用次数记为上述预设全局变量可以为JavaScript代码中全部全局变量也可以为部分全局变量。

[0059] S103，根据所述标签信息、所述类名信息、所述颜色信息、所述CSS选择器信息、所述参数信息、所述语句信息以及所述预设全局变量的出现次数信息，构建网页的第一特征向量；

[0060] 一个具体实施例中，根据每个标签的出现次数所述标签的深度特征CSS代码中每个类名的出现次数不同色相区间内颜色值的使用频率CSS选择器的平均复杂度参数个数参数个数均值A、语句数量语句数量的均值以及预设全局变量的出现次数信息构建网页的第一特征向量

[0061] S104，在时间范围内每间隔预设时间获取一次所述第一特征向量，得到多个第一特征向量，根据所述多个第一特征向量确定对应特征的动态阈值范围；

[0062] 一个具体实施例中，每间隔预设时间获取一次第一特征向量，作为历史特征向量，例如，在一周内，每间隔24小时，获取一次所述第一特征向量，以得到多个第一特征向量，不同的第一特征向量中元素(特征)相同，具体数值可以不同，可以得到多个第一特征向量V1,V2,…,Vn，对于第一特征向量中的每个元素(特征)，计算其均值和标准差。具体的，以第一特征向量中的某个元素xi(例如标签ti的出现次数)为例，其均值μx的计算公式为其中，n为第一特征向量的个数，xi是第i次采样(第i个)特征的特征值；标准差的计算公式为

[0063] S105，访问网页并获取第二特征向量，根据所述第二特征向量的特征处在对应的所述动态阈值范围之外的比例是否超过预设阈值，判断网页是否被篡改。

[0064] 在一个可选的实施方式中，根据所述多个第一特征向量确定对应特征的动态阈值范围，包括：

[0065] 根据所述多个第一特征向量及正态分布的k-sigma原则，获取对应特征的动态阈值下限和动态阈值上限，以确定对应特征的动态阈值范围。

[0066] 一个具体实施例中，根据正态分布的k-sigma原则，动态阈值下限Lx＝μ-kσ，动态阈值上限Ux＝μ+kσ，其中k可以根据实际确定的系数(例如k＝3)，对于多个第一特征向量的每个元素都进行这样的计算，得到每个特征的动态阈值范围。

[0067] 一个具体实施例中，对网页篡改检测进行实时检测时，可以访问网页并提取第二特征向量Vcurrent(其可以称之为当前特征向量，其特征与第一特征向量的特征相对应)时，可以将Vcurrent中的元素y，与对应的动态阈值范围[Ly，Uy]进行比较。设异常特征的集合为E，如果y<Ly或y>Uy，则将对应特征加入集合E。计算异常特征的数量占总特征数量的比例其中，|E|是异常特征集合的元素个数，|V|是特征向量(第一特征向量和第二特征向量)的元素个数，如果超过预设阈值(例如30％)，则判定网页被篡改。当检测到网页篡改时，可以生成告警信息，包括篡改时间、可能被篡改的内容特征等，将检测结果和相关数据记录到日志文件中，以便后续分析和审计。

[0068] 本发明实施例提供的网页篡改检测方法，获取网页的HTML代码、CSS代码以及JavaScript代码；获取所述HTML代码中标签信息，获取所述CSS代码中的类名信息、颜色信息以及CSS选择器信息，构建JavaScript语法树，获取所述JavaScript语法树中每个JavaScript函数的参数信息、每个JavaScript函数体内的语句信息以及预设全局变量的出现次数信息；根据所述标签信息、所述类名信息、所述颜色信息、所述CSS选择器信息、所述参数信息、所述语句信息以及所述预设全局变量的出现次数信息，构建网页的第一特征向量；在时间范围内每间隔预设时间获取一次所述第一特征向量，得到多个第一特征向量，根据所述多个第一特征向量确定对应特征的动态阈值范围；访问网页并获取第二特征向量，根据所述第二特征向量的特征处在对应的所述动态阈值范围之外的比例是否超过预设阈值，判断网页是否被篡改；考虑了HTML、CSS和JavaScript的多种特征，这些特征涵盖了从标签结构、样式属性到函数逻辑等多个层面，更全面地描述了网页的本质特征，通过综合的特征提取，能够更准确地区分合法变化和恶意篡改，并且通过动态阈值范围能够根据网页在正常运行期间的特征变化调整检测阈值，考虑了特征值的分布情况，有效减少了因网页正常更新(如内容更新、样式调整等)导致的误报，提高了网页篡改检测的准确率，通过访问网页并获取第二特征向量，根据第二特征向量的特征处在对应的动态阈值范围之外的比例是否超过预设阈值，判断网页是否被篡改，可以实时检测网页是否被篡改，提高了网页篡改检测的实时性。

[0069] 图2是本发明实施例的网页篡改检测装置的结构示意图，如图2所示，该网页篡改检测装置20包括代码获取模块21、代码信息获取模块22、特征向量构建模块23、动态阈值范围确定模块24以及篡改判断模块25；

[0070] 所述代码获取模块21，用于获取网页的HTML代码、CSS代码以及JavaScript代码；

[0071] 所述代码信息获取模块22，用于获取所述HTML代码中标签信息，获取所述CSS代码中的类名信息、颜色信息以及CSS选择器信息，构建JavaScript语法树，获取所述JavaScript语法树中每个JavaScript函数的参数信息、每个JavaScript函数体内的语句信息以及预设全局变量的出现次数信息；

[0072] 所述特征向量构建模块23，用于根据所述标签信息、所述类名信息、所述颜色信息、所述CSS选择器信息、所述参数信息、所述语句信息以及所述预设全局变量的出现次数信息，构建网页的第一特征向量；

[0073] 所述动态阈值范围确定模块24，用于每间隔预设时间获取一次所述第一特征向量，得到多个第一特征向量，根据所述多个第一特征向量确定对应特征的动态阈值范围；

[0074] 所述篡改判断模块25，用于访问网页并获取第二特征向量，根据所述第二特征向量的特征处在对应的所述动态阈值范围之外的比例是否超过预设阈值，判断网页是否被篡改。

[0075] 在一个可选的实施方式中，该代码信息获取模块22，获取所述HTML代码中标签信息，包括：

[0076] 获取标签的出现次数，根据所述标签的出现次数以及平均深度计算公式获取所述HTML代码中标签的平均深度，所述平均深度计算公式包括其中，为所述HTML代码中标签的平均深度，m为标签个数，为第i个标签ti的出现次数，为第i个标签ti的深度。

[0077] 在一个可选的实施方式中，该代码信息获取模块22，获取所述CSS代码中的类名信息、颜色信息，包括：

[0078] 统计所述CSS代码中每个类名的出现次数，获取所述CSS代码中的颜色属性，将所述颜色属性对应的颜色值转换到HSL空间内，以确定不同色相区间内颜色值的使用频率。

[0079] 在一个可选的实施方式中，该代码信息获取模块22，获取CSS选择器信息，包括：

[0080] 利用平均复杂度计算公式获取CSS选择器的平均复杂度，所述平均复杂度计算公式包括其中，为CSS选择器的平均复杂度，q为CSS选择器的个数，为第l个CSS选择器sl的复杂度。

[0081] 在一个可选的实施方式中，该代码信息获取模块22，获取参数信息，包括：

[0082] 获取JavaScript函数的参数个数，根据所述参数个数以及参数个数的均值计算公式获取所述JavaScript语法树中的参数个数均值，所述参数个数的均值计算公式包括为参数个数均值，r为JavaScript函数的数量，为第n个JavaScript函数fn的参数个数。

[0083] 在一个可选的实施方式中，该代码信息获取模块22，获取语句信息，包括：

[0084] 获取JavaScript函数体内的语句数量，根据所述语句数量以及语句数量的均值计算公式获取所述JavaScript语法树中语句数量的均值，所述语句数量的均值计算公式包括为语句数量的均值，为第n个JavaScript函数fn函数体内的语句数量。

[0085] 在一个可选的实施方式中，该动态阈值范围确定模块24，根据所述多个第一特征向量确定对应特征的动态阈值范围，包括：

[0086] 根据所述多个第一特征向量及正态分布的k-sigma原则，获取对应特征的动态阈值下限和动态阈值上限，以确定对应特征的动态阈值范围。

[0087] 基于上述网页篡改检测方法，本发明实施例还提供了一种计算机设备，该设备包括处理器、通信接口、存储器和通信总线，其中，处理器、通信接口、存储器通过通信总线完成相互间的通信；

[0088] 存储器，用于存放计算机程序；

[0089] 处理器，用于执行存储器上所存放的程序时，实现上述任一实施例所述的网页篡改检测方法的步骤。

[0090] 关于上述网页篡改检测设备中处理器实现上述技术方案的其他细节，可参见上述发明实施例中提供的网页篡改检测方法中的描述，此处不再赘述。

[0091] 其中，处理器还可以称为CPU(CentralProcessingUnit，中央处理单元)，处理器可能是一种集成电路芯片，具有信号的处理能力；处理器还可以是通用处理器、DSP(DigitalSignal Process，数字信号处理器)、ASIC(Application Specific Integrated Circuit，专用集成电路)、FPGA(Field Programmable GataArray，现场可编程门阵列)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，其中通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。

[0092] 本发明实施例还提供了一种计算机可读存储介质，该存储介质上存储有可读的计算机程序；其中，该计算机程序可以以软件产品的形式存储在上述存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施方式所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、磁碟或者光盘、ROM(Read-Only Memory，只读存储器)、RAM(RandomAccess Memory，随机存取存储器)等各种可以存储程序代码的介质，或者是计算机、服务器、手机、平板等终端设备。

[0093] 在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。

[0094] 所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。

[0095] 另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。

[0096] 在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。

[0097] 所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

[0098] 以上对本申请所提供的技术方案进行了详细介绍，本申请中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

[0099] 本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。

[0100] 本申请是参照根据本申请的方法、设备和计算机程序产品的流程图和 / 或方框图来描述的。应理解可由计算机程序指令实现流程图和 / 或方框图中的每一流程和 / 或方框、以及流程图和 / 或方框图中的流程和 / 或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和 / 或方框图一个方框或多个方框中指定的功能的装置。

[0101] 这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和 / 或方框图一个方框或多个方框中指定的功能。

[0102] 这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和 / 或方框图一个方框或多个方框中指定的功能的步骤。

[0103] 显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。< / script>

Claims

1. A webpage tampering detection method, characterized in that: The method comprises: Get the HTML code, CSS code and JavaScript code of the web page; Obtain tag information in the HTML code, obtain class name information, color information and CSS selector information in the CSS code, build a JavaScript syntax tree, and obtain parameter information of each JavaScript function in the JavaScript syntax tree, statement information in each JavaScript function body and occurrence count information of preset global variables; Constructing a first feature vector of the webpage according to the tag information, the class name information, the color information, the CSS selector information, the parameter information, the statement information, and the occurrence number information of the preset global variable; Acquire the first feature vector once at a preset time interval within a time range to obtain a plurality of first feature vectors, and determine a dynamic threshold range of a corresponding feature according to the plurality of first feature vectors; Access a web page and obtain a second feature vector, and determine whether the web page has been tampered with based on whether the proportion of the features of the second feature vector that are outside the corresponding dynamic threshold range exceeds a preset threshold.

2. The webpage tampering detection method according to claim 1, characterized in that: Get the tag information in the HTML code, including: Obtain the number of times a tag appears, and obtain the average depth of the tag in the HTML code according to the number of times the tag appears and the average depth calculation formula, wherein the average depth calculation formula includes in, is the average depth of tags in the HTML code, m is the number of tags, is the i-th label t i The number of occurrences of is the i-th label t i Depth.

3. The webpage tampering detection method according to claim 1, characterized in that: Obtain the class name information and color information in the CSS code, including: The occurrence number of each class name in the CSS code is counted, the color attribute in the CSS code is obtained, and the color value corresponding to the color attribute is converted into the HSL space to determine the usage frequency of the color value in different hue intervals.

4. The webpage tampering detection method according to claim 1, characterized in that: Get CSS selector information, including: The average complexity calculation formula is used to obtain the average complexity of the CSS selector. The average complexity calculation formula includes: in, is the average complexity of CSS selectors, q is the number of CSS selectors, For the lth CSS selector s l complexity.

5. The webpage tampering detection method according to claim 1, characterized in that: Get parameter information, including: Obtain the number of parameters of the JavaScript function, and obtain the mean value of the number of parameters in the JavaScript syntax tree according to the number of parameters and the mean value calculation formula of the number of parameters, wherein the mean value calculation formula of the number of parameters includes is the mean number of parameters, r is the number of JavaScript functions, For the nth JavaScript function f n The number of parameters.

6. The webpage tampering detection method according to claim 1, characterized in that: Get statement information, including: The number of statements in the JavaScript function body is obtained, and the mean number of statements in the JavaScript syntax tree is obtained according to the number of statements and the mean calculation formula of the number of statements. The mean calculation formula of the number of statements includes is the mean number of sentences, For the nth JavaScript function f n The number of statements within the function body.

7. The webpage tampering detection method according to claim 1, characterized in that: Determining a dynamic threshold range of a corresponding feature according to the plurality of first feature vectors includes: According to the multiple first feature vectors and the k-sigma principle of normal distribution, a dynamic threshold lower limit and a dynamic threshold upper limit of the corresponding feature are obtained to determine the dynamic threshold range of the corresponding feature.

8. A webpage tampering detection device, characterized in that: It includes a code acquisition module, a code information acquisition module, a feature vector construction module, a dynamic threshold range determination module and a tampering judgment module; The code acquisition module is used to acquire the HTML code, CSS code and JavaScript code of the web page; The code information acquisition module is used to obtain the number of occurrences of tags in the HTML code and the deep features of the tags in the HTML code, obtain the class name information, color information and the average complexity of the CSS selector in the CSS code, build a JavaScript syntax tree, and obtain the number of parameters of each JavaScript function in the JavaScript syntax tree, the average number of parameters, the number of statements in each JavaScript function body, the average number of statements, and the number of occurrences of preset global variables; The feature vector construction module is used to construct a first feature vector of the webpage according to the number of occurrences of the tag, the deep features of the tag, the class name information, the color information, the average complexity of the CSS selector, the number of parameters, the mean of the number of parameters, the number of statements, the mean of the number of statements, and the number of occurrences of the preset global variable; The dynamic threshold range determination module is used to obtain the first feature vector once at a preset time interval to obtain multiple first feature vectors, and determine the dynamic threshold range of the corresponding feature according to the multiple first feature vectors; The tampering judgment module is used to access the web page and obtain the second feature vector, and judge whether the web page has been tampered with according to whether the proportion of the features of the second feature vector being outside the corresponding dynamic threshold range exceeds a preset threshold.

9. A computer device, characterized in that: The device includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; The processor is used to implement the steps of the web page tampering detection method described in any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the web page tampering detection method according to any one of claims 1 to 7 are implemented.

Images