A method and system for generating a dynamic deception domain name honeypot for active defense

Abstract

The application provides a kind of active defense-oriented dynamic deception domain name honeypot generation method and system, it is related to network security active deception technical field, specific scheme: based on headless browser access and save the web page of real business, the type of the web page is analyzed and different strategies are recorded to obtain web variables, based on re-renderer component rendering the web variables are cloned to obtain simulation web page, the simulation web page is packaged and combined with known container template to build container image to obtain honeypot device container;Based on the honeypot device container, attack logs are collected and marked, and the optimal cycle is obtained based on the multi-objective optimization algorithm, and the cycle of the false domain name bound to the honeypot device container is dynamically adjusted based on the optimal cycle to obtain the domain name honeypot.The application improves the problem that domain name is difficult to adapt to the change of attacker strategy and is difficult to dynamically optimize the defense strategy according to the behavior of the attacker.

Description

TECHNICAL FIELD

[0001] The application relates to the field of network security active deception technology, in particular to a method and system for generating a dynamic deception domain name honeypot for active defense. BACKGROUND

[0002] In recent years, active deception defense technology has gradually become the focus of the network security field due to its strong ability to lure and mislead attackers. Unlike traditional network security methods that rely on rule detection, active deception defense technology deploys honeypots in the network to simulate decoy systems to interfere, confuse and guide attackers to perform malicious operations, thereby effectively protecting real business systems from attacks.

[0003] A domain name honeypot is an active deception defense technology that dynamically binds to a specified domain name, simulates a lightweight real business device, deploys honeypot devices on different fake domain names, simulates real business services, and thus induces attackers to access these domain names and perform attack behaviors.

[0004] Existing technologies attract attackers by binding fake domain names, use static fake domain names, and enable attackers to identify and avoid these fake domain names for a long time, making it difficult for domain names to adapt to changes in attacker strategies, reducing the luring effect, and the deception chain design is often relatively simple, making it difficult to dynamically optimize defense strategies according to the behavior of attackers, and attackers can easily identify the simple deception strategy.

[0005] Therefore, there is an urgent need to develop a solution to solve the above problems. SUMMARY

[0006] The purpose of the present application is to provide a method and system for generating a dynamic deception domain name honeypot for active defense, which improves the problems of network domain names being difficult to adapt to changes in attacker strategies and being difficult to dynamically optimize defense strategies according to the behavior of attackers.

[0007] The method and system for generating a dynamic deception domain name honeypot for active defense provided by the present application adopt the following technical solutions:

[0008] A method for generating a dynamic deception domain name honeypot for active defense, the specific steps of which include:

[0009] Based on the headless browser accessing and saving the web page of the real business, the type of the web page is analyzed and different strategies are adopted to record the web page variables. After the web page variables are rendered based on the re-renderer component, the simulation web page is obtained by page cloning. The simulation web page is packaged and combined with the known container template to construct a container image, and the honeypot device container is instantiated based on the container image.

[0010] Based on the honeypot device container collects and marks the attacker request to get attack log; based on the attack log calculation honeypot device container binding domain name optimal cycle, for the first start simulation service, honeypot device container has no attack log data available for calculation, using the default switch domain name cycle; for non-initial start honeypot device container, according to the attack log calculation optimal cycle, including:

[0011] Statistical attack log in the identification and marking of the number of attackers, nonlinear regression fitting to get the maximum number of attackers and the rate of change of the number of attackers over time, based on the weighted sum method to get pareto optimal solution switch domain name cycle, the number of attackers and switch domain name cycle function relationship as follows:

[0012] ;

[0013] Wherein, and is a positive constant, representing the maximum number of attackers, for the rate of change of the number of attackers over time, for the number of attackers, for the switch domain name cycle;

[0014] The number of attackers and switch domain name cycle weighted after multi-objective optimization, optimization objective function as follows:

[0015] ;

[0016] The weight value of the number of attackers, for the weight value of the switch domain name cycle;

[0017] Optimization objective function derivative transformation obtained:

[0018] ;

[0019] In the formula, for the cycle length;

[0020] Based on the gradient descent method optimization cycle length Get optimal cycle;

[0021] Based on the container socket so that the honeypot device container and container daemon optimal cycle data interaction, by container daemon control honeypot device container and rebinding false domain name to honeypot device container, get domain name honeypot.

[0022] Optionally, the type of the web page is analyzed and different strategies are taken to record the web page variables, including:

[0023] Detecting keywords in the page to determine the type of web page, the server generates a page with a mounting point and mounting declaration, the client renders the page with and only with the mounting point, the server renders the page without any mounting point, and the data is directly embedded in the page;

[0024] Different strategies are taken based on different web page types, and web variables are obtained by recording the changed parts of the web page.

[0025] Optionally, different strategies are taken based on different web page types, and web variables are obtained by recording the changed parts of the web page, including:

[0026] For server-rendered pages, directly request the same page multiple times to save the source code and analyze the changed parts to extract the changed parts to obtain web variables;

[0027] For client-rendered pages, save multiple refreshable extensible hypertext transfer requests and page source codes when the page is loaded by a headless browser, analyze the changed parts of the page request data to obtain web variables;

[0028] For server-generated pages, both of the above strategies are implemented, and both the changed values in the page and the changed values in the request are obtained to obtain web variables.

[0029] Optionally, the simulation web page is obtained by cloning the page based on the re-renderer component rendering the web variables, including:

[0030] Based on the re-renderer component, render the web element corresponding to the web variable at each access to the page;

[0031] Copy the page design, layout, function and data of the rendered web page to obtain the simulation web page.

[0032] In a second aspect, a system for generating a dynamic deception domain name honeypot for active defense includes:

[0033] The simulation page generation module accesses and saves the real business web page based on the headless browser, analyzes the type of the web page and takes different strategies to record to obtain web variables, clones the page based on the re-renderer component rendering the web variables to obtain the simulation web page, packages the simulation web page and combines the known container template to build a container image, and instantiates the honeypot device container based on the container image.

[0034] The domain name honeypot generation module collects and marks attack logs based on the honeypot device container based on the honeypot device container, counts the number of attackers marked in the attack logs and the domain name switching period, balances the number of attackers and the domain name switching period based on a multi-objective optimization algorithm, obtains an optimal period, and dynamically adjusts the period of the honeypot device container based on the optimal period to bind a false domain name to obtain a domain name honeypot.

[0035] Optionally, the simulation page generation module comprises a headless browser engine and a re-renderer component, the headless browser engine is used to access the web page of the real business and save the page source code and web page variables, and the re-renderer component is used for data extraction, web page variable insertion and dynamic rendering of the web page.

[0036] Optionally, the domain name honeypot generation module comprises a log analysis module, a period calculation module and a honeypot management module.

[0037] The log analysis module is used to analyze the logs and marks of the attackers returned by the honeypot device container in real time.

[0038] The period calculation module is used to analyze the network logs and attack records of the honeypot device containers of different businesses, and combine the switching domain name period of the honeypot device container and the number of attackers to obtain the optimal period of the honeypot device container bound to the domain name through multi-objective optimization solution.

[0039] The honeypot generation module relies on the container socket and the official interface, interacts with the container daemon through the container socket to control the honeypot device container and rebinding the false domain name to the honeypot device container, and obtains the domain name honeypot.

[0040] The method provided by the application has the beneficial effects that:

[0041] By dynamically generating a false domain name and binding it to the honeypot device, the problem of traditional static domain names being identified and evaded is improved, thereby improving the trapping effect on attackers. At the same time, the system designs lightweight honeypot devices, which only simulate necessary business services, avoiding the collection and leakage of real sensitive data, reducing the risk of data leakage that may exist in the high-interaction honeypot system. In addition, by introducing a dynamic optimization mechanism, the system can adjust the binding period of the honeypot device in real time to adapt to the changing strategies of attackers, significantly improving the overall defense capability of the system, and improving the deficiency of the existing honeypot system lacking active defense adjustment, so that the honeypot system can maintain high defense capability when facing changing attack strategies. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1A page crawling analysis flowchart of a dynamic deception domain name honeypot generation method for active defense is provided in the present application.

[0043] Figure 2 A honeypot device container image generation step flowchart of a dynamic deception domain name honeypot generation method for active defense is provided in the present application.

[0044] Figure 3 An optimal period calculation flowchart of a dynamic deception domain name honeypot generation method for active defense is provided in the present application.

[0045] Figure 4 A rebinding domain name flowchart of a dynamic deception domain name honeypot generation method for active defense is provided in the present application. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are some embodiments but not all of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the usual meanings understood by those skilled in the art. The words such as “comprise” and similar words used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0047] Noun explanation:

[0048] A domain name honeypot is a lightweight device that simulates real business by dynamically binding to specified domain names. By deploying honeypot devices on different fake domain names, it simulates real business services to lure attackers to access these domain names and perform attack behaviors. The core is to dynamically switch different honeypot devices and bind them to fake domain names to form a dynamic defense mechanism. Over time, the system will calculate the optimal binding period using a multi-objective optimization algorithm based on past attacker behavior data to ensure that the most attackers are attracted in the shortest time. In this way, the domain name honeypot system not only effectively confuses attackers, but also collects valuable attack data to help security personnel better defend.

[0049] Docker Daemon is the background process of the container engine, also known as the container daemon, responsible for managing container objects (such as images, containers, networks, volumes, etc.) and communicating with container clients to handle user requests.

[0050] The embodiment of the present application provides a kind of active defense-oriented dynamic deception domain name honeypot generation method, specific steps include:

[0051] S1, based on headless browser access and save the web page of real business, the type of the web page is analyzed and different strategies are recorded to obtain web variables, the web variables are rendered based on re-renderer component, and the simulation web page is cloned to obtain the simulation web page, the simulation web page is packaged and combined with known container template to build container image, and the container is instantiated based on the container image to obtain the container of honeypot equipment;

[0052] S2, based on the container of honeypot equipment, attack log is collected and marked, the number of attackers marked in the attack log and the switching domain name cycle are counted, the optimal cycle is obtained based on multi-objective optimization algorithm balancing the number of attackers and the switching domain name cycle, and the period of the false domain name bound to the container of honeypot equipment is dynamically adjusted based on the optimal cycle to obtain the domain name honeypot.

[0053] In some embodiments, when step S1 is performed, it specifically includes:

[0054] S1-1, based on headless browser access and save the web page of real business, the type of the web page is analyzed and different strategies are recorded to obtain web variables;

[0055] S1-2, based on re-renderer component rendering web variables, the simulation web page is cloned to obtain the simulation web page;

[0056] S1-3, the simulation web page is packaged and combined with known container template to build container image, and the container of honeypot equipment is instantiated based on the container image.

[0057] Specifically, when step S1-1 is performed, the type of the web page is analyzed and different strategies are recorded to obtain web variables, including:

[0058] S1-1-1, the keywords in the page are detected to determine the type of the web page, the page is generated for server when the mounting point and mounting declaration appear in the page, the page is rendered for client when there is usually only mounting point in the page, and the data is directly embedded in the page when there is no mounting point in the page.

[0059] S1-1-2, different strategies are taken based on different web page types, and the changed part of the web page is recorded to obtain web variables.

[0060] Actually, when step S1-1-1 is performed, simple regular expression is used to determine the HTML mounted in the web page.

[0061] Specifically, in the execution step S1-1-2, different strategies are adopted based on different web page types, and the changed part of the web page is recorded to obtain the web variable, including:

[0062] For the server-side rendered page, the same page is requested multiple times to save the source code and then analyze the changed part to extract the changed part to obtain the web variable;

[0063] For the client-side rendered page, the headless browser saves the extensible hypertext transfer request and the source code of the page multiple times when the page is loaded, and analyzes the changed part of the page request data to obtain the web variable;

[0064] For the server-generated page, both of the above strategies are implemented, and the changed values in the page and the request are observed to obtain the web variable.

[0065] In fact, referring to Figure 1 , the front-end page includes SSR (server-side rendering), CSR (client-side rendering), and SSG (server-side generation) rendering scheme, for CSR and SSG web pages, after listening to the request, the changed part of the request is analyzed, the page source code is saved, and the web variable is obtained by analyzing the page, for the SSR web page, the same page is requested multiple times to save the source code and then analyze the changed part, and the changed part is extracted to obtain the web variable.

[0066] Specifically, in the execution step S1-2, the cloned simulation web page is obtained by rendering the web variable based on the re-renderer component, including:

[0067] S1-2-1, based on the re-renderer component, the saved page data and request data are analyzed, and the obtained web variable is stored in pairs in the local, and the web element corresponding to the web variable is rendered in each access to the page;

[0068] S1-2-2, the page design, layout, function and data of the rendered web page are copied to obtain the simulation web page.

[0069] In fact, in the execution step S1-2-1, part of the re-renderer component is divided into an analysis part running in the construction stage and a middleware rendering part running in the honeypot device, both parts are realized by NodeJS technology, the analysis part mainly completes the data extraction and variable insertion of the page, and the middleware rendering part mainly completes the dynamic re-rendering of the page when the honeypot device processes the request.

[0070] Further, for the time and timestamp format with obvious changes in the web page variable, directly mark the variable using the current time, modify all web pages to the format of ejs template, randomly select from the paired repeated data each time and then return, which will make the web page have dynamic behavior, improve the simulation of the honeypot device container, and be more attractive to the attacker for interaction.

[0071] Further, when performing step S1-2-2, some hyperlinks bound to other false domain names are inserted in the simulation page, thereby forming a deception chain.

[0072] Specifically, when performing step S1-3, after the simulation web page template is cloned, it is placed in the template directory of the container containing the web page middleware and re-renderer component edited by the security personnel in advance, and the entire directory is packaged into a container image by using the Docker technology. The re-renderer component will dynamically generate a response according to the generated template file when the honeypot device is running.

[0073] In fact, referring to Figure 2 , after the request metadata of the web page is analyzed to obtain the web page variable, the re-renderer component is used for rendering analysis, the simulation page is obtained by re-rendering the multiple sets of data of the web page, the container image is generated in combination with the simulation page and the Dockerfile, and the honeypot device container obtained by instantiating the container image includes a log collector and a NodeJS middleware. The log collector is used to collect and mark the behavior of the attacker, and the NodeJS middleware is used for simulation.

[0074] In some embodiments, when performing step S2, specifically includes:

[0075] S2-1, collecting and marking the attack log of the attacker request based on the honeypot device container, and calculating the optimal period of the domain name bound to the honeypot device container based on the attack log;

[0076] S2-2, dynamically adjusting the period of the false domain name bound to the honeypot device container based on the optimal period to obtain the domain name honeypot.

[0077] Specifically, when performing step S2-1, the attack log of the attacker request is collected and marked based on the honeypot device container, and the optimal period of the domain name bound to the honeypot device container is calculated based on the attack log. For the simulation service started for the first time, the honeypot device container does not have attack log data available for calculation, and a default domain name switching period is used. For the honeypot device container that is not started for the first time, the optimal period is calculated according to the attack log and the marking information.

[0078] In fact, referring to Figure 3According to the log and marking information returned by the honeypot device container, and assigning a weight value to the data for weighted sum method and gradient descent method to obtain the optimal period, and then binding the optimal period to the honeypot device container.

[0079] In fact, for the honeypot device container that is not started for the first time, the optimal period is calculated according to the attack log, including:

[0080] The number of attackers identified and marked by the system within a certain time is counted, and a nonlinear regression fitting is made to obtain the maximum value of the number of attackers and the rate of change of the number of attackers with time, and a Pareto optimal solution is obtained based on the weighted sum method to obtain the switching domain name period, and the function relationship between the number of attackers and the switching domain name period is as follows:

[0081] ;

[0082] Wherein, and are positive constants, represents the maximum value of the number of attackers, the rate of change of the number of attackers with time, the number of attackers; the switching domain name period;

[0083] The number of attackers and the switching domain name period are weighted and then subjected to multi-objective optimization, and the optimization objective function is as follows:

[0084] ;

[0085] is the weight value of the number of attackers, is the weight value of the switching domain name period, represents the maximum value of the number of attackers;

[0086] The derivative transformation of the optimization objective function is obtained as follows:

[0087] ;

[0088] In the formula, is the period length under the given weight, and other parameters are the same as above;

[0089] Based on the gradient descent method, the period length is optimized to obtain the optimal period.

[0090] Further, the function formula after weighting the number of attackers and the switching domain name period is as follows:

[0091] ;

[0092] is the weight value of the number of attackers, To switch the weight value of the domain name cycle, This represents the maximum number of attackers. Number of attackers; This is for switching domain name cycles.

[0093] Furthermore, the gradient descent method is used to optimize the calculated results. The update formula for gradient descent is set as follows:

[0094] ;

[0095] in, The learning rate controls the step size of each iteration. When a small learning rate is selected and iterations are performed until the gradient is sufficiently small, the optimal cycle is obtained. .

[0096] Specifically, during step S2-2, the honeypot device container's binding period to the fake domain name is dynamically adjusted based on the optimal period to obtain the domain honeypot, including:

[0097] Based on container sockets, the honeypot device container and the container daemon can perform optimal periodic data interaction. The container daemon controls the honeypot device container and rebinds fake domain names to the honeypot device container to obtain domain honeypots.

[0098] Furthermore, the dynamic adjustment and updating of honeypot devices is achieved by modifying the IP address resolved to by the domain name.

[0099] In fact, see Figure 4 The honeypot device controller uses container sockets to enable optimal periodic data interaction between the honeypot device container and the container daemon. The container daemon controls the honeypot device container and rebinds fake domains to the honeypot device container. The honeypot device container will send back the attacker's logs and tags to the honeypot device controller in real time.

[0100] Furthermore, when an attacker is tagged by a honeypot device container bound to different domains at different times, the honeypot device controller will depict the attacker's attack path based on the deception chain and the attacker's logs.

[0101] In reality, the generation of fake domain names relies on multiple preset subdomain brute-force dictionaries and multiple actual subdomains targeting real businesses. Based on this, multiple dictionaries and actual subdomains are merged, the word frequency of the subdomain in the merged dictionary is calculated, and then existing algorithms are used to calculate the relevance between the domain names in the merged dictionary and the protected business. Fake domain names are selected based on the relevance.

[0102] This invention also provides a dynamic deception domain honeypot generation system for proactive defense, characterized by comprising:

[0103] The simulation page generation module accesses and saves a web page of a real business based on a headless browser, analyzes the type of the web page and adopts different strategies to record to obtain web variables, renders the web variables based on a re-renderer component to obtain a simulation web page through page cloning, packages the simulation web page and combines a known container template to construct a container image, and instantiates the container image to obtain a honeypot device container;

[0104] The domain name honeypot generation module collects and marks an attacker request based on the honeypot device container to obtain an attack log, calculates an optimal period of the honeypot device container binding a domain name based on the attack log, and dynamically adjusts the period of the honeypot device container binding a false domain name based on the optimal period to obtain a domain name honeypot.

[0105] In some embodiments, the simulation page generation module includes a headless browser engine and a re-renderer component, the headless browser engine is used to access a web page of a real business and save a page source code and web variables, and the re-renderer component is used for data extraction, web variable insertion, and dynamic rendering of the web page.

[0106] In some embodiments, the domain name honeypot generation module includes a log analysis module, a period calculation module, and a honeypot management module.

[0107] The log analysis module is used to analyze and mark an attacker log and real-time feedback of the honeypot device container.

[0108] The period calculation module is used to analyze network logs and attack records of different business honeypot device containers, and combines a honeypot device container switching domain name period and an attacker number to obtain an optimal period of the honeypot device container binding a domain name through multi-objective optimization solution.

[0109] The honeypot generation module relies on a container socket and an official interface, interacts with a container daemon through the container socket, controls the honeypot device container and rebinds a false domain name to the honeypot device container by the container daemon, and obtains a domain name honeypot.

[0110] Although the embodiments of the present application have been described in detail above, it is obvious to those skilled in the art that various modifications and changes can be made to the embodiments. However, it should be understood that such modifications and changes are within the scope and spirit of the present application as described in the claims. Moreover, the present application described herein can have other embodiments and can be implemented or realized in various ways.

Claims

1. An active defense-oriented dynamic deception domain name honeypot generation method, characterized in that, The method comprises the following steps: Based on the headless browser access and save the real business web page, analyze the type of the web page and take different strategies to record the web page variables, render the web page variables based on the re-renderer component, clone the page to get the simulation web page, package the simulation web page and combine the known container template to build the container image, and instantiate the honeypot device container based on the container image; Based on the honeypot device container, collect and mark the attacker request to get the attack log; based on the attack log, calculate the optimal period of the honeypot device container binding domain name, for the first start of the simulation service, the honeypot device container has no attack log data for calculation, and the default domain name switching period is adopted; For the honeypot device container that is not started for the first time, the optimal period is calculated according to the attack log, including: Statistical analysis of the number of attackers identified and marked in the attack log, nonlinear regression fitting to obtain the maximum number of attackers and the change rate of the number of attackers over time, and the switching domain name period is obtained based on the weighted sum method, the function relationship between the number of attackers and the switching domain name period is as follows: ； wherein, and is a positive constant, denotes a maximum value of the number of attackers, is a rate of change of the number of attackers over time, is the number of attackers, is a switching domain name period; After weighting the number of attackers and the switching domain name period, multi-objective optimization is carried out, and the objective function is as follows: ； a weight value for the number of attackers, a weight value for the switching domain name period; The optimization objective function is derived and transformed to obtain: ； In the formula, is the period length; Optimizing cycle length based on gradient descent method to get optimal cycle Based on the container socket, the honeypot device container and the container daemon are interacted with the optimal period data, the honeypot device container is controlled by the container daemon, and the false domain name is re-bound to the honeypot device container to obtain the domain name honeypot.

2. The method for generating dynamic deception domain honeypots for proactive defense according to claim 1, characterized in that, Analyze the type of the web page and take different strategies to record the web page variables, including: Detecting keywords in the page to determine the type of the web page, the server generating the page has a mount point and a mount declaration, the client rendering the page has and only has the mount point, and the server rendering the page does not have any mount point, and the data is directly embedded in the page; Based on different web page types, different strategies are adopted to record the changed parts of the web page to obtain web page variables.

3. The method of claim 2, wherein the method further comprises: Based on different web page types, different strategies are adopted to record the changed parts of the web page to obtain web page variables, including: For server-rendered pages, directly request the same page multiple times to save the source code and then analyze the changed parts to extract the changed parts to obtain the web page variables; For client-rendered pages, save multiple refreshes of the extensible hypertext transfer request and the page source code when the page is loaded by the headless browser, analyze the changed part of the page request data to obtain the web page variables; For server-generated pages, both of the above strategies are implemented, and the changed values in the page and the changed values in the request are observed to obtain the web page variables.

4. The method of claim 1, wherein the method is a method of generating a dynamic honeypot for an active defense against a domain name system (DNS) -based phishing attack, the method comprising: Based on the re-renderer component, render the web page variables to clone the page to obtain the simulation web page, including: Based on the re-renderer component, render the web page elements corresponding to the web page variables every time the page is accessed; Copy the page design, layout, function and data of the rendered web page to obtain the simulation web page.

5. An active defense-oriented dynamic fake domain name honeypot generation system, the system is used for executing the active defense-oriented dynamic fake domain name honeypot generation method of claim 1, characterized in that, ​ The simulation page generation module accesses and saves a web page of a real business based on a headless browser, analyzes a type of the web page and takes different strategies to record to obtain web variables, renders the web variables based on a re-renderer component to obtain a simulation web page after page cloning, packs the simulation web page and combines a known container template to construct a container image, and instantiates the container image to obtain a honeypot device container; The domain name honeypot generation module includes a log analysis module, a period calculation module and a honeypot management module; The log analysis module is configured to analyze logs and marks of an attacker returned by the honeypot device container in real time; The period calculation module is configured to analyze network logs and attack records of different business honeypot device containers, and combine a domain name switching period of the honeypot device container and a number of attackers to obtain an optimal period bound by the honeypot device container on the domain name through multi-objective optimization solving. The honeypot generation module depends on a container socket and an official interface, and performs optimal period data interaction with a container daemon through the container socket, controls the honeypot device container by the container daemon, and rebinds a false domain name to the honeypot device container to obtain a domain name honeypot.

6. The pro-active defense oriented dynamic honeypot domain name generation system according to claim 5, wherein, The simulation page generation module includes a headless browser engine and a re-renderer component, the headless browser engine is configured to access a web page of a real business and save page source code and web variables, and the re-renderer component is configured to perform data extraction, web variable insertion and dynamic rendering on the web page.

Images