Website operation method and device for containing zero-day attack, computer device and storage medium

Abstract

The application relates to a website operation method and device for containing zero-day attacks, computer equipment and a storage medium. The method comprises the following steps: after an operator publishes new website content, synchronizing website data of an internal version to an intermediate version; performing production environment adaptation processing on the website data synchronized to the intermediate version, wherein the production environment adaptation processing comprises one or more of database optimization processing, domain name search replacement processing and security reinforcement processing; synchronizing the website data of the intermediate version which has completed the production environment adaptation processing to a public version which is not currently used by users, and updating a user access portal so that the public version is used by users. The application can contain zero-day attacks (attacks based on zero-day vulnerabilities) against WordPress and minimize losses when security protection measures fail.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a website operation method, apparatus, computer equipment, and storage medium for curbing zero-day attacks. Background Technology

[0002] WordPress is a content management system based on the PHP (Hypertext Preprocessor) language and MySQL database. Its open-source nature and rich plugin ecosystem have attracted a large number of developers, but this has also led to inconsistent quality of third-party plugin code and frequent security vulnerabilities.

[0003] The main security protection measures for WordPress are: (1) “post-event remediation” for publicly disclosed vulnerabilities (such as 1-day vulnerabilities and n-day vulnerabilities), such as collecting, analyzing and reporting publicly disclosed vulnerabilities, and then patching newly disclosed vulnerabilities; (2) using some intrusion prevention systems (IPS) for defense, such as Web application firewalls (WAF). These intrusion prevention systems can use powerful threat intelligence, rule systems or some detection models empowered by AI to detect and block malicious traffic in real time.

[0004] However, these methods still have some shortcomings. Method (1) can effectively defend against attacks from subsequent attackers, but it will not work if attackers take advantage of the "protection vacuum" between vulnerability disclosure and patch release. Furthermore, this method is difficult to defend against APT (Advanced Persistent Threat) attacks. Some targeted APT groups will specifically study the target WordPress version and third-party plugins to find undisclosed zero-day vulnerabilities. Attacking with zero-day vulnerabilities can bypass existing detection methods and constitute a persistent threat. Method (2) relies on threat intelligence, rules, or AI models, and its defense effect is limited when facing well-designed customized APT attacks. Once bypassed, attackers may cause significant losses such as content tampering, especially for large commercial websites that rely on WordPress, the consequences of which are incalculable. Summary of the Invention

[0005] To address the aforementioned deficiencies or shortcomings, this application provides a website operation method, apparatus, computer equipment, and storage medium for curbing zero-day attacks. The embodiments of this application can curb zero-day attacks against WordPress (i.e., attacks based on zero-day vulnerabilities) and minimize losses when security protection measures fail.

[0006] This application provides a website operation method for curbing zero-day attacks according to a first aspect. In some embodiments, the website's content management system has multiple versions, including an internal version and an intermediate version deployed on an intranet server, and two public versions deployed on a public network server that are not simultaneously available to users. The internal version is used by website operators to edit and publish website content, while the public version is used by users to browse website content. The method includes:

[0007] After the operations staff publishes new website content, the website data from the internal version will be synchronized to the intermediate version.

[0008] Perform production environment adaptation processing on the website data synchronized to the intermediate version. Production environment adaptation processing includes one or more of the following: database optimization processing, domain name search and replacement processing, and security hardening processing.

[0009] The website data from the intermediate version that has been adapted for the production environment will be synchronized to the public version that is not currently available to users, and the user access portal will be updated to make the public version available to users.

[0010] In some embodiments, before synchronizing website data from the internal version to the intermediate version, the method further includes: detecting whether the new website content meets the expected effect; if it meets the expected effect, determining to perform the step of synchronizing website data from the internal version to the intermediate version.

[0011] In some embodiments, before updating the user access entry, the method further includes: detecting whether the new website content meets the expected effect; if it meets the expected effect, determining to perform the step of updating the user access entry.

[0012] In some embodiments, database optimization processes include deleting revision files and junk files; security hardening processes include deleting wp-login.php, disabling access to the wp-admin folder via .htaccess, disabling xmlrpc and wp-json, disabling wp-cron.php, deleting WordPress temporary cache data, and restricting one or more of the following PHP functions.

[0013] In some embodiments, synchronizing website data from an intermediate version that has completed production environment adaptation to a publicly available version that is not currently used by users includes: synchronizing the website data from the intermediate version that has completed production environment adaptation to a temporary folder on a public server; and after determining the publicly available version that is not currently used by users, synchronizing the website data in the temporary folder to the publicly available version that is not currently used by users.

[0014] In some embodiments, each of the internal, intermediate, and public versions includes a database and a file system; website data synchronized from the internal version to the intermediate version and website data synchronized from the intermediate version to the public version both include database data and file system data; when synchronizing database data, a full synchronization method is used; when synchronizing file system data, an incremental synchronization method is used.

[0015] In some embodiments, the public version of the file system is deployed on a public server in a read-only manner, and the public version of the database controls user access to the public version of the website data through a combination of read-only accounts and triggers.

[0016] This application provides a website operation apparatus for curbing zero-day attacks according to a second aspect. In some embodiments, the website's content management system has multiple versions, including an internal version and an intermediate version deployed on an intranet server, and two public versions deployed on a public network server that are not simultaneously available to users. The internal version is used by website operators to edit and publish website content, while the public version is used by users to browse website content. The apparatus includes:

[0017] The first synchronization module is used to synchronize the internal version of the website data to the intermediate version after the operations staff publishes new website content.

[0018] The production environment adaptation processing module is used to perform production environment adaptation processing on website data synchronized to the intermediate version. The production environment adaptation processing includes one or more of the following: database optimization processing, domain name search and replacement processing, and security hardening processing.

[0019] The second synchronization module is used to synchronize the website data of the intermediate version that has completed production environment adaptation to the public version that is not currently available to users, and to update the user access portal so that the public version is available to users.

[0020] According to a third aspect, this application provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the website operation method for curbing zero-day attacks provided in any of the above embodiments.

[0021] According to a fourth aspect, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the website operation method for curbing zero-day attacks provided in any of the above embodiments.

[0022] In the above embodiments of this application, multiple versions are set up for the website's content management system, including an internal version, an intermediate version, and a public version. The deployment method for these three versions is as follows: the internal and intermediate versions are deployed on an internal network server, while the public version is deployed on a public network server. Website operators can edit and publish website content on the internal version. After the operators publish new website content, an automated device synchronizes the website data from the internal version to the intermediate version. Once the website data from the internal version is synchronized to the intermediate version, the automated device performs production environment adaptation processing on the website data in the intermediate version to meet specified requirements such as website performance and data security. There are two public versions, and these two public versions are not simultaneously available to users. Based on this, after performing production environment adaptation processing on the website data of the intermediate version, the website data of the intermediate version is first synchronized to the public version that is not currently available to users, and then the public version is made available to users by updating the user access portal. This application embodiment can transform a dynamically writable content management system into a static, read-only public service, greatly reducing the attack surface exposed by the online WordPress (i.e., public version) used in the production environment, and blocking write attacks at the source; moreover, even if the public version is attacked, it can be quickly restored through the update process of internal version → intermediate version → public version, thereby achieving the goal of curbing zero-day attacks. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the deployment of multiple versions of a website content management system and the synchronization method of website data for each version, according to one or more embodiments of this application.

[0024] Figure 2 This is a flowchart illustrating a website operation method for curbing zero-day attacks provided in this application according to one or more embodiments;

[0025] Figure 3 This is a structural block diagram of a website operation device for curbing zero-day attacks provided in one or more embodiments of this application;

[0026] Figure 4 This is an internal structural diagram of a computer device provided in one or more embodiments of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings. It should be understood that the described embodiments are merely some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0028] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0029] In the description of this application, it should be understood that the terms "first," "second," "third," etc., are used only to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances. Furthermore, in the description of this application, unless otherwise stated, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0030] To address the shortcomings or defects of related technologies, this application provides a website operation method for curbing zero-day attacks. This method can curb zero-day attacks against WordPress (i.e., attacks based on zero-day vulnerabilities) and minimize losses when security protection measures fail. The method is described in detail below through some embodiments.

[0031] In some embodiments, a website's Content Management System (CMS) is a software platform or application that greatly simplifies the process of website creation and maintenance by separating content from design and providing an intuitive user interface. It allows users to create, edit, organize, publish, and manage website content, enabling them to effectively manage and publish content even without professional programming knowledge. A CMS could be WordPress.

[0032] This application sets up multiple versions for the website's content management system, including internal, intermediate, and public versions. For example... Figure 1As shown, the deployment methods for the three versions—internal, middle, and public—are as follows: internal and middle versions are deployed on internal network servers, while the public version is deployed on public network servers. An internal network server is a server deployed within an enterprise or organization's internal network, typically in the organization's internal data center, isolated from external networks by firewalls and routers. Administrators configure access control lists to restrict access to internal network servers to only internal users. Internal users can connect to the internal network server through an internal network (such as a virtual private network or company intranet), and access typically requires authentication (such as username and password) to ensure security. A public network server is a server deployed on the Internet (such as the Internet), accessible to users anywhere in the world via the Internet.

[0033] Each of the three release types—internal, intermediate, and public—has its own database and file system. Specifically, the internal release's database and file system are... Figure 1 The `mysql_internal` and `wordpress_internal` in the middle version; the database and file system in the intermediate version are respectively Figure 1 The `mysql_middle` and `wordpress_middle` are used in the middle; there are two public versions, which can be referred to as the first public version and the second public version. The database and file system of the first public version are respectively... Figure 1 In mysql_public_1 and wordpress_public_1, the second public version of the database and file system are respectively Figure 1 The names in the file are mysql_public_2 and wordpress_public_2.

[0034] The internal version is the "master" version of the intermediate and public versions. It is for the direct use of website operators. Website operators can edit and publish website content in the internal version. It has read and write permissions to the internal version's database. The internal version is not open to users (mainly those who use the website). Users cannot access the internal version or browse the website content in the internal version.

[0035] The website data in the intermediate version is synchronized from the internal version, but the data in the internal version and the intermediate version is not exactly the same. After the website data in the internal version is synchronized to the intermediate version, the automated system will perform a series of processes on the website data in the intermediate version (the relevant processes will be described in detail below) to meet specified requirements such as website performance and data security. The intermediate version is "transparent" to website operators, and users cannot access the intermediate version or browse its website content.

[0036] The public version is open to users, who can browse the website content and have read access to the database, but not write access. The website data in the public version is synchronized from the intermediate version. Having two public versions allows for seamless switching, ensuring users are unaware of content updates and improving user experience.

[0037] The website operation method for curbing zero-day attacks provided in this embodiment adopts... Figure 1 The website deployment method shown includes the following steps: Figure 2 As shown, the following will be combined with Figure 1 Each step is explained in detail.

[0038] S110: After the operations staff publishes new website content, synchronize the website data from the internal version to the intermediate version.

[0039] Website content refers to information that users can directly see and interact with in a browser, such as articles. Website content typically consists of text, images, videos, audio, layout, styles, etc. Website data refers to the underlying information that drives website functions, stores key information, defines website structure and configuration. This data can be stored in a database (specifically a MySQL database) and a file system.

[0040] Operations staff can edit new website content in the internal version and publish it after completion. This includes modifying old articles and writing new ones; both the modified and new articles are considered new website content. Once published, the internal version's website data can be synchronized to the intermediate version via automated devices.

[0041] S120: Perform production environment adaptation processing on website data synchronized to intermediate versions.

[0042] Once the website data from the internal version is synchronized to the intermediate version, the automated system will perform production environment adaptation processing on the website data in the intermediate version to meet specified requirements such as website performance and data security. Production environment adaptation processing includes one or more of the following: database optimization, domain name search and replacement, and security hardening.

[0043] Database optimization refers to the process of adjusting and maintaining one or more of the structure, configuration, and content of a database, with the aim of improving database performance (query speed, response time), reducing resource consumption (storage space, memory, CPU), enhancing data integrity, and laying a good foundation for future expansion.

[0044] Database optimization can include, but is not limited to, deleting revision files, deleting junk files, and cleaning up unused metadata or transient data.

[0045] When the content management system is WordPress, deleting revision files can include deleting revision posts. Revision posts are historical versions of articles that WordPress saves through the revision feature. If revision posts are not deleted, their number will increase significantly, which will increase the database size and slow down query speed. Deleting revision posts helps improve query speed. Deleting junk files can include deleting trash files. Trash files are similar to a recycle bin. Data such as posts, pages, and media files deleted by users are not actually deleted by WordPress, but are moved to trash files. These will occupy database space for a long time. Deleting trash files emptys the recycle bin and immediately releases the storage space occupied by this data. Cleaning up unused metadata or transient data can include deleting expired or no longer used options, temporary cached data, and orphaned metadata records from data tables such as wp_options, wp_postmeta, and wp_usermeta.

[0046] The `wp_options` table stores global settings and options for the website. These settings or options can be various parameters configured by operators through the WordPress admin panel, or specific settings added by themes and plugins. The data stored in `wp_options` includes basic site information (such as site title, site description, WordPress address, and site address), user-configured settings (such as the number of posts per page, date and time formats, and default timezone settings), theme and plugin settings (such as theme color schemes and layout options), and system-related options (such as whether to enable post comments and whether to allow new user registration).

[0047] wp_postmeta is a data table used to store metadata for posts. Operators can use wp_postmeta to add custom fields to posts in addition to basic fields such as title, content, and publication date. The data stored in wp_postmeta includes custom post fields (such as adding custom fields like product price, weight, and dimensions when writing product introduction posts) and featured image information (such as image IDs and related data).

[0048] wp_usermeta is a data table used to store user metadata. The data stored in wp_usermeta includes user personal settings information (such as how nicknames are displayed, user descriptions, and user language preferences in the WordPress admin panel).

[0049] By performing database optimizations on intermediate versions of the website data, database performance can be improved, thereby improving website performance.

[0050] Regarding domain search and replacement, website operation may require changing the website's domain name, such as changing the current domain "old-example.com" to "new-example.com". Since all URLs in WordPress posts (such as image attachments) are hard-coded URLs (Uniform Resource Locator) and do not change with settings, a global search and replace function is needed to replace the old domain name with the new domain name in the posts. Specifically, this involves iterating through all content in the intermediate version of the database and replacing the text strings related to the old domain name with the text strings related to the new domain name. By performing domain search and replace on the intermediate version of the website data, it is possible to ensure that the links in the website content are correct and the resources are available.

[0051] Security hardening refers to proactively improving the security of a system or application by modifying configurations, restricting access, removing unnecessary features, and / or updating software, thereby reducing the risk and potential attack surface of attacks (such as unauthorized access, data breaches, malware injection, denial-of-service attacks, etc.). By performing security hardening on intermediate versions of website data, website security can be improved (e.g., reduced risk, enhanced resilience).

[0052] Security hardening measures include, but are not limited to, deleting wp-login.php, disabling access to the wp-admin folder via .htaccess, disabling xmlrpc and wp-json, disabling wp-cron.php, deleting WordPress temporary cache data, and restricting one or more of the PHP functions.

[0053] wp-login.php is the default login page entry point for WordPress. Deleting wp-login.php can prevent malicious attackers from brute-forcing the website administrator's login credentials by repeatedly trying different username and password combinations, thus protecting the website's login security. Furthermore, the default login page entry point is easily discovered and targeted by attackers. After deleting it, the login page entry point can be hidden through other methods (such as using plugins to redirect login requests to a custom login page), increasing the difficulty for attackers to find and compromise the login page.

[0054] The wp-admin folder is the location of the WordPress admin panel. Disabling access to the wp-admin folder restricts user access to the admin panel, preventing users from gaining access and thus protecting website configuration, content editing, and other functions from malicious tampering or damage. Furthermore, even if attackers cannot directly access the admin panel, they might still attempt to obtain sensitive website information (such as database connection information) by accessing files within the wp-admin folder. Disabling user access to the wp-admin folder can prevent this from happening and avoid information leaks.

[0055] XML-RPC (or XML-RPC) is a protocol that allows software applications to communicate with each other over the internet. WordPress specifically implements XML-RPC functionality through the xmlrpc.php file. Attackers could potentially use xmlrpc.php to perform brute-force attacks, attempting to guess usernames and passwords; therefore, disabling xmlrpc.php can reduce the risk of such attacks.

[0056] REST API (Representational State Transfer Application Programming Interface) is a web application interface based on HTTP (Hypertext Transfer Protocol). It allows different applications to communicate over a network. In WordPress, the REST API provides a standard set of interfaces that allow developers to manipulate data on the WordPress website through simple HTTP requests. For example, developers can use it to retrieve the latest posts from a mobile application on the WordPress website or update page content on the website from an external script. wp-json is the default entry point for the REST API in WordPress, used to output website data in JSON (JavaScript Object Notation) format. It provides a wealth of information about the website, including post, page, and user data. Disabling wp-json can prevent attackers from obtaining this information through the API, reducing the risk of information leakage.

[0057] wp-cron.php is WordPress's built-in task scheduler. It checks for and executes scheduled tasks every time a page loads. In some cases, this can lead to wasted server resources, especially on high-traffic websites. Disabling wp-cron.php can help optimize website performance and improve resource utilization. Furthermore, attackers might maliciously trigger wp-cron.php to perform unwanted tasks, such as sending large amounts of spam; disabling wp-cron.php can reduce this risk.

[0058] WordPress's temporary cache data may contain sensitive information, such as user session data and form submission data. Deleting this data can prevent attackers from accessing this information through cached files, thus protecting the security of the website and its users. Furthermore, excessive temporary cache data can consume server storage space and affect website loading speed; therefore, deleting temporary cache data (such as cleaning the wp-content / cache / directory) can free up storage space and improve website performance.

[0059] Attackers might exploit malicious scripts or code injection vulnerabilities to execute dangerous PHP code (such as system commands or server control) using PHP functions (e.g., `eval`, `exec`, `system`), leading to website intrusion or compromise. Restricting the use of PHP functions can mitigate this risk. Furthermore, restricting PHP functions encourages developers to write more secure and reliable code, avoiding security vulnerabilities caused by the use of insecure functions, thereby improving the overall security of the website.

[0060] Some related technologies deploy a website on both the intranet and public networks. Data from the intranet website is synchronized to the public website. Users can only access the public website, not the intranet one, thus preventing website data tampering. However, these technologies also have some shortcomings. For example, the intranet website requires full operational permissions for administrators. Directly hardening the intranet website would prevent administrators from operating normally (e.g., deleting wp-login.php or disabling wp-admin would prevent administrators from logging in). Another example is that the security hardening process may involve sensitive operations (such as executing cleanup scripts). If executed directly on the intranet website, script malfunctions could corrupt the editing environment.

[0061] This embodiment uses a three-version isolation architecture, which can be found in [reference needed]. Figure 1As shown, the intranet version allows operators to freely edit, publish, and preview website content, while the public network version allows users to browse website content in read-only mode. The intermediate version acts as a preparation area or buffer zone, inheriting website data from the intranet version and completely removing high-risk functions unnecessary for the production environment through production environment adaptation. Even if situations such as complete operation failure or unexpected consequences occur during processing, it will not immediately affect operators or real users. Therefore, it plays an important role in decoupling and isolating risky operations and ensuring the stability and security of the production environment.

[0062] S130: Synchronize the website data from the intermediate version that has been adapted for the production environment to the public version that is not currently available to users, and update the user access portal to make the public version available to users.

[0063] After adapting the intermediate version of the website data for the production environment, the intermediate version is synchronized to the public version. In related technologies, there is usually only one public version; however, in this embodiment, there are two public versions, and these two versions are not simultaneously available to users. If only one public version is used, when website content needs to be updated, a shutdown and switching (e.g., shutting down the service → overwriting files → restarting) is required, which would interrupt user access. Moreover, if an attacker injects malicious code during synchronization, it could contaminate the sole public version, rendering it unusable for users. Using two public versions that are not simultaneously available to users allows for updating the currently unused public version first when website content is updated. After the update is complete, this public version can be made available to users, resulting in a smoother user experience with virtually no awareness of the content update. Furthermore, if one public version is attacked, it can be easily switched back to the other public version to continue providing services to users.

[0064] Two public versions can be used together via iptables rules to ensure they are not used by users at the same time and to allow for seamless switching. For example, two public versions of WordPress can be deployed on a public server. These two public versions can be distinguished by different ports (or different IP addresses). For instance, the first public version (referred to as version 1) uses port 80, while the second public version (referred to as version 2) uses port 8080. By changing the port, the public version used by users can be switched.

[0065] This application embodiment can transform a dynamically writable content management system into a static, read-only public service, greatly reducing the attack surface exposed by the online WordPress (i.e., public version) used in the production environment, and blocking write attacks at the source; moreover, even if the public version is attacked, it can be quickly restored through the update process of internal version → intermediate version → public version, thereby achieving the goal of curbing zero-day attacks.

[0066] In some embodiments, in addition to being accessible to users, the public version may also reserve ports for internal personnel of an enterprise or organization, such as operations staff and developers, to achieve purposes such as review and whitelist control. For example, the public version reserves at least two ports, as shown in Figure 1: iptables_port_forward port 443 (open to the public) and nginx_review port (open to internal personnel).

[0067] In some embodiments, before synchronizing website data from the internal version to the intermediate version, the method further includes: detecting whether the new website content meets the expected effect; if it meets the expected effect, determining to perform the step of synchronizing website data from the internal version to the intermediate version.

[0068] After the operations team publishes new website content, they can check whether the new content meets expectations. If it does, the website data from the internal version is synchronized to the intermediate version. If the new website content does not meet expectations, the process returns to the steps where the operations team edits and publishes the new content in the internal version.

[0069] When website content needs to be updated frequently, automated devices can be used to perform the expected results detection operations, thereby improving the detection speed, reducing the error rate, and thus improving the overall update efficiency of website content.

[0070] In some embodiments, before updating the user access entry, the method further includes: detecting whether the new website content meets the expected effect; if it meets the expected effect, determining to perform the step of updating the user access entry.

[0071] After synchronizing the intermediate version of the website data to the public version not yet available to users, the new website content can be retested to ensure it meets expectations. If it does, then the step of updating the user access portal can be executed. If the new website content does not meet expectations, the process returns to the steps where operations staff edit and publish the new website content in the internal version. This dual expectation testing process ensures that the new website content meets expectations as much as possible.

[0072] Furthermore, after synchronizing the website data from the intermediate version, which has already undergone production environment adaptation, to the currently unreleased public version, the system first checks whether the synchronization was successful. If the synchronization is successful, it proceeds to the step of checking whether the new website content meets the expected results. If the synchronization fails, it returns to the step of synchronizing the website data from the internal version to the intermediate version.

[0073] In some embodiments, synchronizing website data from an intermediate version that has completed production environment adaptation to a publicly available version that is not currently used by users includes: synchronizing the website data from the intermediate version that has completed production environment adaptation to a temporary folder on a public server; and after determining the publicly available version that is not currently used by users, synchronizing the website data in the temporary folder to the publicly available version that is not currently used by users.

[0074] When synchronizing website data from an intermediate version to a publicly available version that is not currently accessible to users, the website data from the intermediate version can be directly synchronized to the publicly available version. However, this synchronization method has some drawbacks. For example, the synchronization operation between the intermediate version and the publicly available version is transmitted over the internet. If uncontrollable network failures occur during the direct synchronization to the publicly available version, the publicly available version may suffer unpredictable damage. Furthermore, this damage undermines the original intention of the publicly available version's "dual backup" mechanism; if the publicly available version accessible to users encounters problems, it is impossible to quickly revert to the non-user-accessible publicly available version. To address these shortcomings, this application sets up a temporary folder (such as...) on the public network server. Figure 1 The `wordpress_public_tmp` folder shown here is a temporary folder that acts as a data transfer station. After the intermediate version of the website data has been adapted for the production environment, it is first synchronized to the temporary folder on the public server. Data can be uploaded first, and then validated after the intermediate version's data arrives in the temporary folder. If validation is successful, the system then checks which public version is currently not available to users and synchronizes the entire website data in the temporary folder to that public version. Because the temporary folder and the public version reside on the same file system and are not transmitted over the network, the risk of synchronization failure due to uncontrollable factors is relatively low. Furthermore, once the website data in the temporary folder is fully synchronized to the public version not currently available to users, that public version is then made accessible, further eliminating the risk of business interruption.

[0075] In some embodiments, both public versions are deployed using Docker containers. Regarding the file systems and databases of each public version, the file system can be deployed in a read-only mode. A read-only deployment sets the system or data to read-only mode, where users can only view the data and cannot modify, delete, or add data. Using a read-only deployment for the file system can be used to protect important data, historical records, or shared resources. In some scenarios, it is necessary to protect certain fields in the database to prevent accidental modification, while simultaneously allowing other fields in the database to be updated. Therefore, a combination of read-only accounts and triggers can be used to achieve precise read-only access down to the field level. A read-only account in the database refers to a user account that only has query permissions and no modification, deletion, or addition permissions. By restricting users' database operation permissions, the risk of malicious data tampering can be reduced. A trigger is a special stored procedure that executes automatically when a specific database operation (such as adding, updating, or deleting) occurs. Triggers can be used to protect specific fields; when someone attempts to modify these fields, the trigger will prevent the operation. By combining read-only accounts and triggers, you can precisely control which fields in the database can be modified and which cannot, thus protecting important data from accidental modification. At the same time, you can allow some fields to be updated normally while keeping other fields read-only, thereby meeting complex business needs.

[0076] In some embodiments, website data that needs to be synchronized between versions, such as website data synchronized from an internal version to an intermediate version, or website data synchronized from an intermediate version to a public version, includes both database data and file system data. Database data refers to structured data stored in a MySQL database, typically organized in tabular form, containing various fields and records. File system data refers to unstructured data stored in the server's file system, typically organized in the form of files and directories. When synchronizing database data, a full synchronization method is used; when synchronizing file system data, an incremental synchronization method is used. Full synchronization means that during the synchronization process, the entire contents of the source data are copied to the target location, regardless of whether the data has changed; the complete dataset is transferred each time. Incremental synchronization means that during the synchronization process, only the data that has changed is synchronized. The incremental synchronization method determines which data needs to be synchronized by comparing the data's hash value, timestamp, or other identifiers.

[0077] Given that database data is typically structured and interconnected (e.g., tables may have complex dependencies), full synchronization ensures the consistency and integrity of all data, preventing errors caused by partial data synchronization. Furthermore, database data tends to change more frequently than file system data; full synchronization ensures all database changes are captured, preventing omissions. File system data (such as media files and log files) is usually large, and full synchronization would consume significant time and bandwidth. Since file system data typically changes infrequently, incremental synchronization reduces unnecessary data transfer, decreases server resource consumption, and improves synchronization efficiency.

[0078] When performing a full database synchronization, you can use the `mysqldump` command and the `mysql` command. `mysqldump` is a command-line tool that exports the contents of the source version of the MySQL database to an SQL file, making it easy to store and restore the database data. Then, you can use this SQL file to restore the database data in the target version of the database, thus achieving a full database synchronization. When synchronizing website data from an internal version to an intermediate version, the internal version is the source version, and the intermediate version is the target version. When synchronizing website data from an intermediate version to a public version, the intermediate version is the source version, and the public version is the target version.

[0079] When incrementally synchronizing file system data, changes to both file systems can be determined by reconciling one-way hash lists such as SHA256, and only the modified files can be transferred or deleted.

[0080] It should be noted that, regarding the various steps included in the website operation method for curbing zero-day attacks provided in any of the above embodiments, unless explicitly stated herein, there is no strict order restriction on the execution of these steps; they can be executed in other orders. Furthermore, at least some of these steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0081] Based on the same inventive concept, this application also provides a website operation device for curbing zero-day attacks. In some embodiments, the website's content management system has multiple versions, including an internal version and an intermediate version deployed on an intranet server, and two public versions deployed on a public network server that are simultaneously available to users; the internal version is used by website operators to edit and publish website content, while the public version is used by users to browse website content; such as Figure 3 As shown, the device includes:

[0082] The first synchronization module 110 is used to synchronize the internal version of the website data to the intermediate version after the operators publish new website content.

[0083] The production environment adaptation processing module 120 is used to perform production environment adaptation processing on website data synchronized to the intermediate version. The production environment adaptation processing includes one or more of the following: database optimization processing, domain name search and replacement processing, and security hardening processing.

[0084] The second synchronization module 130 is used to synchronize the website data of the intermediate version that has completed the production environment adaptation process to the public version that is not currently available to users, and to update the user access entry so that the public version is available to users.

[0085] In some embodiments, the apparatus further includes an expected effect detection module. The expected effect detection module is used to detect whether the new website content meets the expected effect before the first synchronization module 110 synchronizes the internal version of the website data to the intermediate version; if it meets the expected effect, it determines to execute the step of synchronizing the internal version of the website data to the intermediate version.

[0086] In some embodiments, the expected effect detection module is further configured to detect whether the new website content meets the expected effect before the second synchronization module 130 updates the user access entry; if it meets the expected effect, it determines to execute the step of updating the user access entry.

[0087] In some embodiments, database optimization processes include deleting revision files and junk files; security hardening processes include deleting wp-login.php, disabling access to the wp-admin folder via .htaccess, disabling xmlrpc and wp-json, disabling wp-cron.php, deleting WordPress temporary cache data, and restricting one or more of the following PHP functions.

[0088] In some embodiments, the production environment adaptation processing module 120 is specifically used to synchronize the website data of the intermediate version that has completed the production environment adaptation processing to the temporary folder of the public network server; after determining the public version that is not currently available to users, the website data in the temporary folder is synchronized to the public version that is not currently available to users.

[0089] In some embodiments, each of the internal, intermediate, and public versions includes a database and a file system; website data synchronized from the internal version to the intermediate version and website data synchronized from the intermediate version to the public version both include database data and file system data; when synchronizing database data, a full synchronization method is used; when synchronizing file system data, an incremental synchronization method is used.

[0090] In some embodiments, the public version of the file system is deployed on a public server in a read-only manner, and the public version of the database controls user access to the public version of the website data through a combination of read-only accounts and triggers.

[0091] Specific limitations regarding the website operation device used to curb zero-day attacks can be found in the limitations of the website operation methods used to curb zero-day attacks described above, and will not be repeated here. Each module in the aforementioned website operation device for curbing zero-day attacks can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0092] This application also provides a computer device, which in some embodiments includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it can implement the steps of the website operation method for curbing zero-day attacks provided in any of the above embodiments.

[0093] In some embodiments, the internal structure diagram of a computer device may be as follows: Figure 4 As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores data such as website content; the specific data stored can be further defined in the above method embodiments. The network interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a website operation method for curbing zero-day attacks.

[0094] Those skilled in the art will understand that Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0095] This application also provides a computer-readable storage medium, in some embodiments of which a computer program is stored on the computer-readable storage medium, and when executed by a processor, the computer program implements the steps of the website operation method for curbing zero-day attacks provided in any of the above embodiments.

[0096] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0097] Those skilled in the art will understand that all or part of the processes in the above method embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchlink, DRAM (SLDRAM), memory bus, direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0098] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A website operation method for containing zero-day attacks, characterized by, The content management system of the website has multiple versions, including an internal version and an intermediate version deployed on an intranet server, and two public versions deployed on a public network server and facing users at different times; The internal version is used by website operators to edit and publish website content, and the public version is used by users to browse website content; the method comprises: After the operators publish new website content, synchronizing website data of the internal version to the intermediate version; Performing production environment adaptation processing on the website data synchronized to the intermediate version, the production environment adaptation processing including one or more of database optimization processing, domain name search replacement processing, and security reinforcement processing; Synchronizing website data of the intermediate version that has completed the production environment adaptation processing to a public version that is not currently facing users, and updating a user access portal to make the public version face users.

2. The method of claim 1, wherein, Before synchronizing website data of the internal version to the intermediate version, the method further comprises: Detecting whether the new website content meets the expected effect; If it meets the expected effect, determining to perform the step of synchronizing website data of the internal version to the intermediate version.

3. The method of claim 1 or 2, wherein, Before updating the user access portal, the method further comprises: Detecting whether the new website content meets the expected effect; If it meets the expected effect, determining to perform the step of updating the user access portal.

4. The method of claim 1, wherein, The database optimization processing includes one or more of deleting revision files and garbage files; the security reinforcement processing includes one or more of deleting wp-login.php, disabling access to the wp-admin folder through htaccess, disabling xmlrpc and wp-json, disabling wp-cron.php, deleting temporary cache data of WordPress, and limiting php functions.

5. The method of claim 1, wherein, Synchronizing website data of the intermediate version that has completed the production environment adaptation processing to a public version that is not currently facing users, comprises: Synchronizing website data of the intermediate version that has completed the production environment adaptation processing to a temporary folder of the public network server; After determining the public version that is not currently facing users, synchronizing website data in the temporary folder to the public version that is not currently facing users.

6. The method of claim 1, wherein, Each of the internal version, the intermediate version, and the public version includes a database and a file system; website data synchronized by the internal version to the intermediate version and website data synchronized by the intermediate version to the public version both include database data and file system data; when synchronizing the database data, a full synchronization mode is used; when synchronizing the file system data, an incremental synchronization mode is used.

7. The method of claim 6, wherein, The file system of the public version is deployed in a read-only deployment mode on the public network server, and the database of the public version controls user access to website data of the public version through a combination of a read-only account and a trigger.

8. A website operating apparatus for containing a zero-day attack, characterized by comprising: The content management system of the website has multiple versions, including an internal version and an intermediate version deployed on an intranet server, and two public versions deployed on a public network server and facing users at different times; The internal version is used for website operators to edit and publish website content, and the public version is used for users to browse website content; the device comprises: A first synchronization module is configured to synchronize website data of the internal version to the intermediate version after the operators publish new website content; A production environment adaptation processing module is configured to perform production environment adaptation processing on the website data synchronized to the intermediate version, the production environment adaptation processing including one or more of database optimization processing, domain name search replacement processing, and security reinforcement processing; A second synchronization module is configured to synchronize the website data of the intermediate version, which has completed the production environment adaptation processing, to a public version that is not currently facing users, and to update a user access portal to enable the public version to face users.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images