Website security identification method and device, equipment, storage medium and program product

Abstract

The invention provides a website security identification method and device, equipment, a storage medium and a program product. The method comprises the following steps: in response to a website access request of a user, obtaining a to-be-identified website corresponding to the website access request; obtaining multi-dimensional traffic data of the website to be identified; wherein the multi-dimensional traffic data comprises multiple of webpage uniform resource locator traffic data, webpage text traffic data, webpage picture traffic data and user behavior traffic data; and uploading the multi-dimensional traffic data to an edge cloud, so that the edge cloud performs feature extraction processing on the multi-dimensional traffic data to obtain multi-dimensional feature data, and performing identification processing according to the trained website security identification model and the multi-dimensional feature data to obtain a risk probability. The real-time performance of website security identification can be improved, so that the security is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device, storage medium, and program product for identifying website security. Background Technology

[0002] With the widespread adoption of home broadband networks, users are accessing the internet more frequently through smart devices, but they are also facing various website security threats.

[0003] Current website security identification mainly relies on a collaborative mechanism between home routers and cloud-based blacklists. The cloud determines whether to add a website to the blacklist based on the website content identification and classification results. If a website is added to the blacklist, the blacklist website database is updated and then sent to the router to trigger protection.

[0004] However, this approach suffers from a delay in the process of identifying and blocking blacklisted websites, resulting in low security. Summary of the Invention

[0005] This application provides a method, apparatus, device, storage medium, and program product for identifying website security, in order to solve the problem that existing solutions have a certain delay in the process from website identification to blocking blacklisted websites, resulting in low security.

[0006] Firstly, this application provides a website security identification method applied to a home gateway, comprising:

[0007] In response to a user's website access request, obtain the website to be identified corresponding to the website access request;

[0008] Obtain multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data;

[0009] The multidimensional traffic data is uploaded to the edge cloud so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data. Based on the trained website security identification model and the multidimensional feature data, identification processing is performed to obtain the risk probability.

[0010] In one possible implementation, obtaining the website to be identified corresponding to the website access request includes: performing packet capture processing and domain name acquisition processing on the website access request through a packet capture library application programming interface to determine the website to be identified corresponding to the website access request.

[0011] In one possible implementation, obtaining the multidimensional traffic data of the website to be identified includes: obtaining the domain name of the website to be identified; generating a crawling task based on the domain name; and simulating access to the website to be identified based on the crawling task to obtain the multidimensional traffic data.

[0012] In one possible implementation, the step of simulating access to the website to be identified according to the crawling task to obtain the multidimensional traffic data includes: simulating access to the website to be identified according to the crawling task to obtain multiple of the following: Uniform Resource Locator (URL) address data, URL request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data of the website to be identified; and performing structured processing on the URL address data, URL request frequency data, HTML text data, title data, keyword data, image data, and user behavior data to obtain multiple of the following: webpage URL traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data.

[0013] Secondly, this application provides a website security identification method, applied to edge cloud, including:

[0014] The system receives multidimensional traffic data sent by a home gateway; wherein the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to a user's website access request after obtaining the website to be identified corresponding to the website access request; wherein the multidimensional traffic data includes multiple of the following: web page Uniform Resource Locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data;

[0015] The multidimensional traffic data is subjected to feature extraction processing to obtain multidimensional feature data;

[0016] The risk probability is obtained by performing identification processing based on the trained website security identification model and the multi-dimensional feature data.

[0017] In one possible implementation, the step of performing feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data includes: if the multidimensional traffic data includes webpage URI traffic data, then performing webpage URI feature extraction processing on the webpage URI traffic data to obtain first feature data; if the multidimensional traffic data includes webpage text traffic data, then performing natural language processing-based feature extraction processing on the webpage text traffic data to obtain second feature data; if the multidimensional traffic data includes webpage image traffic data, then performing computer vision contrast-based feature extraction processing on the webpage image traffic data to obtain third feature data; and if the multidimensional traffic data includes user behavior traffic data, then performing behavioral interaction-based feature extraction processing on the user behavior traffic data to obtain fourth feature data.

[0018] In one possible implementation, the step of performing identification processing based on the trained website security identification model and the multidimensional feature data to obtain the risk probability includes: acquiring the trained website identification model; wherein the website identification model is trained from multidimensional feature data samples and risk probability labels corresponding to the multidimensional feature data samples; inputting the multidimensional feature data into the trained website identification model; and determining the risk probability based on the output of the trained website identification model.

[0019] In one possible implementation, after performing identification processing based on the trained website security identification model and the multidimensional feature data to obtain the risk probability, the method further includes: if the risk probability is greater than a preset risk probability threshold, sending a warning message to a preset application to trigger a risk alarm in the application.

[0020] Thirdly, this application provides a website security identification device for use in a home gateway, comprising:

[0021] The first acquisition module is used to acquire the website to be identified corresponding to the user's website access request in response to the user's website access request;

[0022] The second acquisition module is used to acquire multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data;

[0023] The upload module is used to upload the multidimensional traffic data to the edge cloud, so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data. Based on the trained website security identification model and the multidimensional feature data, identification processing is performed to obtain the risk probability.

[0024] Fourthly, this application provides a website security identification device applied in the edge cloud, comprising:

[0025] A receiving module is used to receive multidimensional traffic data sent by a home gateway; wherein, the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to a user's website access request after obtaining the website to be identified corresponding to the website access request; wherein, the multidimensional traffic data includes multiple of the following: web page Uniform Resource Locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data;

[0026] The feature extraction module is used to perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data;

[0027] The identification processing module is used to perform identification processing based on the trained website security identification model and the multi-dimensional feature data to obtain the risk probability.

[0028] Fifthly, this application provides a website security identification device, including: a memory and a processor;

[0029] The memory stores computer-executed instructions;

[0030] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect or the second aspect and / or various possible implementations of the second aspect.

[0031] In a sixth aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect or the second aspect and / or various possible implementations of the second aspect.

[0032] In a seventh aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect or the second aspect and / or various possible implementations of the second aspect.

[0033] The website security identification method, apparatus, device, storage medium, and program products provided in this application parse users' website access requests through a home gateway to obtain multi-dimensional traffic data of the website to be identified in real time. This multi-dimensional traffic data is then uploaded to an edge cloud, enabling the edge cloud to identify the risk probability of the website in real time based on the multi-dimensional traffic data. This improves the real-time performance of website security identification, thereby enhancing security. Attached Figure Description

[0034] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0035] Figure 1 A schematic diagram illustrating a website security identification method provided in an embodiment of this application;

[0036] Figure 2 A schematic diagram illustrating a scenario for another website security identification method provided in this application embodiment;

[0037] Figure 3 A flowchart illustrating a website security identification method provided in one embodiment of this application;

[0038] Figure 4 A flowchart illustrating a website security identification method provided in another embodiment of this application;

[0039] Figure 5 This is a schematic diagram illustrating a method for determining risk probability in an edge cloud environment, as provided in one embodiment of this application.

[0040] Figure 6 A schematic diagram of the interaction flow of a website security identification method provided in an embodiment of this application;

[0041] Figure 7 A schematic diagram of the structure of a website security identification device provided in this application embodiment;

[0042] Figure 8 A schematic diagram of another website security identification device provided in this application embodiment;

[0043] Figure 9 This is a schematic diagram of the structure of a website security identification device provided in an embodiment of this application.

[0044] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0046] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0047] Currently, website security identification primarily relies on home routers to identify risky websites. Based on a home router and cloud-based architecture, the cloud performs text analysis on website content, categorizes it, and determines whether to add the website to a blacklist. If added, the blacklist database is updated and then sent to the router to trigger protection. However, there is a delay in the process from cloud-based identification and categorization to blacklist distribution to the router and subsequent blocking, making real-time identification impossible. Furthermore, the cloud's text analysis of website content results in low accuracy, ultimately leading to low security.

[0048] The website security identification method provided in this application processes user website access requests through a home gateway to acquire multi-dimensional traffic data of the website to be identified in real time. It automatically triggers edge cloud processing to extract features from the multi-dimensional traffic data, obtaining multi-dimensional feature data. Based on the website security identification model and the multi-dimensional feature data, identification processing is performed to obtain the risk probability, meeting the real-time requirements of website security identification and improving the accuracy of identification. Warning information is sent to preset applications, triggering risk alerts in the applications, achieving timely warnings and improving the security of website security identification.

[0049] Figure 1 A schematic diagram illustrating a website security identification method provided in this application embodiment, such as... Figure 1 As shown, the specific application scenarios of this application include: user terminal 101, home gateway 102, edge cloud 103, and application 104.

[0050] The user terminal 101 can be a mobile phone or a computer.

[0051] The user terminal 101 is connected to the Internet through the home gateway 102.

[0052] Among them, the edge cloud 103 can be a server. Optionally, it can be a single server or a cluster of multiple servers.

[0053] Specifically, user terminal 101 sends a website access request to home gateway 102. In response to the user's website access request, home gateway 102 obtains multi-dimensional traffic data of the corresponding website to be identified; home gateway 102 uploads the multi-dimensional traffic data to edge cloud 103. Edge cloud 103 calculates the risk probability based on the multi-dimensional traffic data; edge cloud 103 sends a warning message to application 104 based on the risk probability. Application 104 activates a risk alarm and sends an alarm notification to user terminal 101.

[0054] Figure 2 A schematic diagram illustrating a scenario for another website security identification method provided in this application embodiment, such as... Figure 2 As shown, the specific application scenarios of this application include: user terminals, home gateways, edge cloud, and the Internet.

[0055] The user terminal can be a mobile phone or a computer.

[0056] The home gateway includes a smart gateway plugin.

[0057] The user terminal connects to the Internet through a home gateway.

[0058] Specifically, the user terminal sends a website access request to the home gateway; the home gateway responds to the website access request by crawling multi-dimensional traffic data of the corresponding website to be identified from the Internet through the smart gateway plugin; the home gateway uploads the multi-dimensional traffic data to the edge cloud through the smart gateway plugin.

[0059] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0060] Figure 3 This is a flowchart illustrating a website security identification method provided in one embodiment of this application. The execution entity of this embodiment can be... Figure 1 The home gateway 102 shown can also be other computer devices, and this embodiment does not impose any special restrictions on it. Figure 3 As shown, the method includes:

[0061] S301: In response to a user's website access request, obtain the website to be identified corresponding to the website access request.

[0062] A website access request includes multiple parameters such as the request protocol, domain name, and resource path.

[0063] Optionally, obtaining the website to be identified corresponding to the website access request includes: performing packet capture processing and domain name acquisition processing on the website access request through the application programming interface of the packet capture library to determine the website to be identified corresponding to the website access request.

[0064] Specifically, raw network packets are captured at the data link layer using the packet capture library's application programming interface, traffic is extracted using the Berkeley packet filter, the traffic packet header is parsed to obtain the domain name, and the website to be identified corresponding to the website access request is determined based on the domain name.

[0065] By using the application programming interface of the packet capture library to identify users' website access requests in real time, the latency of website security identification can be shortened, thereby improving security.

[0066] S302: Obtain multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data.

[0067] It should be noted that the home gateway includes a smart gateway plugin, which is used to obtain multi-dimensional traffic data of the website to be identified.

[0068] Optionally, S302 specifically includes S3021 to S3023:

[0069] S3021: Obtain the domain name of the website to be identified.

[0070] Specifically, the website access request is parsed to obtain the domain name of the website to be identified.

[0071] Optionally, after obtaining the domain name of the website to be identified, the method further includes: matching the domain name of the website to be identified with a preset blacklist domain name database; if the match is successful, an alarm message is output to the user terminal.

[0072] The system enables rapid identification of blacklisted websites by using a pre-defined blacklist domain database.

[0073] S3022: Generate a crawling task based on the domain name.

[0074] Specifically, the domain name is standardized to obtain a standardized domain name; a hash value is calculated based on the standardized domain name; the corresponding temporary task is queried based on the hash value, and if the temporary task does not exist, the temporary task is generated; and a crawling task is generated based on the standardized domain name.

[0075] S3023: Based on the crawling task, simulate access to the website to be identified in order to obtain multi-dimensional traffic data.

[0076] Specifically, depending on the crawling task, a headless browser or web crawler is used to simulate accessing the website to be identified in order to obtain multi-dimensional traffic data.

[0077] Specifically, S3023 includes Sa to Sb:

[0078] Sa: Based on the crawling task, simulate access to the website to be identified in order to obtain multiple data from the website, including Uniform Resource Locator (URL) address data, URL request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data.

[0079] Sb: Structures the Uniform Resource Locator (URL) address data, URL request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data to obtain multiple types of webpage URL traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data.

[0080] By proactively acquiring multi-dimensional traffic data of the website to be identified, the proactive identification of the website can be triggered in a timely manner, meeting the real-time requirements of network security identification and improving security.

[0081] S303: Upload multidimensional traffic data to the edge cloud so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data. Based on the trained website security identification model and the multidimensional feature data, identification processing is performed to obtain the risk probability.

[0082] The website security identification method provided in this application analyzes user website access requests through a home gateway to obtain multi-dimensional traffic data of the website to be identified in real time. This multi-dimensional traffic data is then uploaded to an edge cloud, enabling the edge cloud to identify the risk probability of the website in real time based on the multi-dimensional traffic data. This improves the real-time performance of website security identification, thereby enhancing security.

[0083] Figure 4 This is a flowchart illustrating a website security identification method provided in another embodiment of this application. The executing entity in this embodiment can be... Figure 1 The edge cloud 103 shown can also be other computer devices, and this embodiment does not impose any particular limitations on it. Figure 4 As shown, the method includes:

[0084] S401: Receive multidimensional traffic data sent by the home gateway; wherein, the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to the user's website access request after obtaining the website to be identified corresponding to the website access request; wherein, the multidimensional traffic data includes multiple of the following: web page uniform resource locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data.

[0085] S402: Perform feature extraction processing on multidimensional traffic data to obtain multidimensional feature data.

[0086] Specifically, S402 includes S4021 to S4024:

[0087] S4021: If the multidimensional traffic data includes Uniform Resource Locator (URL) traffic data, then perform URL feature extraction processing on the URL traffic data to obtain the first feature data.

[0088] The Uniform Resource Locator (URL) traffic data includes domain age, Hypertext Transfer Security Protocol (HTTP) certificate validity, and Internet Protocol (IP) geolocation.

[0089] Specifically, a deep learning model is used to extract character sequence features from the webpage URI traffic data to obtain character sequence features; a random forest model is used to extract network attribute features from the webpage URI traffic data to obtain network attribute features; and the character sequence features and network attribute features are determined as the first feature data.

[0090] S4022: If the multidimensional traffic data includes web page text traffic data, then perform feature extraction processing based on Natural Language Processing (NLP) on the web page text traffic data to obtain the second feature data.

[0091] Specifically, a pre-trained language model is used to perform semantic analysis on web page text traffic data to obtain speech feature values; keyword matching and sentiment recognition algorithms are used to extract expression features from web page text traffic data to obtain expression feature values; entity recognition is used to extract entity features from web page text traffic data to obtain entity feature values; and speech feature values, expression feature values, and entity feature values ​​are determined as the second feature data.

[0092] Specifically, entity recognition is used to extract entity features from web page text traffic data to obtain entity feature values. This includes: extracting entity data from web page text traffic data using entity recognition, comparing the entity data with a preset intelligence database to obtain entity feature values.

[0093] The entities include the organization name, telephone number, and bank account number, etc.

[0094] Specifically, keyword matching and sentiment recognition algorithms are used to extract expressive features from web page text traffic data to obtain expressive feature values. This includes: using keyword matching to extract sensitive words from web page text traffic data to obtain word feature values; using sentiment recognition algorithms to extract the emotional level of web page text traffic data to obtain emotional feature values; and determining the word feature values ​​and emotional feature values ​​as expressive feature values.

[0095] Specifically, a pre-trained language model is used to perform semantic analysis on web page text traffic data to obtain speech feature values, including: using a pre-trained language model to extract specific speech from web page text traffic data to obtain speech feature values.

[0096] S4023: If the multidimensional traffic data includes webpage image traffic data, then the webpage image traffic data is subjected to feature extraction processing based on computer vision (CV) comparison to obtain the third feature data.

[0097] Specifically, a computer vision comparison algorithm is used to extract features from webpage image traffic data to obtain webpage identification features; an object detection algorithm is used to identify objects in webpage image traffic data to obtain webpage layout features; and third feature data is determined based on the webpage identification features and webpage layout features.

[0098] S4024: If the multidimensional traffic data includes user behavior traffic data, then the user behavior traffic data is processed by feature extraction based on behavioral interaction to obtain the fourth feature data.

[0099] User behavior traffic data includes user input data, such as bank card input, username and password input, and SMS verification code input.

[0100] S403: Based on the trained website security identification model and multi-dimensional feature data, identification processing is performed to obtain the risk probability.

[0101] Specifically, S403 includes S4031 to S4033:

[0102] S4031: Obtain the trained website recognition model; wherein, the website recognition model is trained by multi-dimensional feature data samples and the risk probability labels corresponding to the multi-dimensional feature data samples.

[0103] Among them, the website recognition model can be a multimodal fusion large model.

[0104] S4032: Input multidimensional feature data into the trained website recognition model.

[0105] S4033: Determine the risk probability based on the output of the trained website recognition model.

[0106] The website security identification method provided in this application involves receiving multi-dimensional traffic data sent in real time from a home gateway at the edge cloud; automatically triggering the edge cloud to perform feature extraction processing on the multi-dimensional traffic data to obtain multi-dimensional feature data; and performing identification processing based on a trained website security identification model and the multi-dimensional feature data to obtain the risk probability. This method enables real-time website security identification, and the identification based on multi-dimensional feature data improves identification accuracy and enhances security.

[0107] In one embodiment of this application, based on the above embodiments, after step S403, a process of sending early warning information from the edge cloud is further included, as detailed below:

[0108] S404: If the risk probability is greater than the preset risk probability threshold, a warning message is sent to the preset application to trigger the application's risk alarm.

[0109] The early warning information includes the probability of risk.

[0110] The preset risk probability threshold can be 80%.

[0111] It should be noted that the application's risk alerts can be sent to the user's terminal via push notification and / or SMS alert.

[0112] The website security identification method provided in this application improves the security of website security identification by sending early warning information to a preset application, triggering the application's risk alarm, and achieving timely early warning.

[0113] Figure 5 This is a schematic diagram illustrating a method for determining risk probability in an edge cloud environment, as provided in one embodiment of this application. Figure 5 As shown, the method includes:

[0114] If the multidimensional traffic data includes webpage URI traffic data, then the webpage URI traffic data undergoes URI feature extraction processing to obtain the first feature data; if the multidimensional traffic data includes webpage text traffic data, then the webpage text traffic data undergoes natural language processing-based feature extraction processing to obtain the second feature data; if the multidimensional traffic data includes webpage image traffic data, then the webpage image traffic data undergoes computer vision contrast-based feature extraction processing to obtain the third feature data; if the multidimensional traffic data includes user behavior traffic data, then the user behavior traffic data undergoes behavioral interaction-based feature extraction processing to obtain the fourth feature data.

[0115] The first feature data, the second feature data, the third feature data, and the fourth feature data are input into the multimodal fusion model to output the risk probability.

[0116] Figure 6 This is a schematic diagram of the interaction flow of a website security identification method provided in an embodiment of this application. Figure 6 As shown, the method includes:

[0117] S601: The home gateway responds to the user's website access request and obtains the website to be identified corresponding to the website access request.

[0118] S602: The home gateway uses the packet capture library application programming interface to capture and process website access requests and obtain domain names in order to identify the website to be identified corresponding to the website access request.

[0119] S603: The home gateway obtains the domain name of the website to be identified; and generates a crawling task based on the domain name.

[0120] S604: The home gateway simulates access to the website to be identified based on the crawling task in order to obtain multi-dimensional traffic data.

[0121] S605: The home gateway uploads multi-dimensional traffic data to the edge cloud.

[0122] S606: Edge cloud performs feature extraction processing on multi-dimensional traffic data to obtain multi-dimensional feature data.

[0123] S607: The edge cloud inputs multi-dimensional feature data into the trained website recognition model to obtain the risk probability.

[0124] S608: If the edge cloud determines that the risk probability is greater than the preset risk probability threshold, it will send an early warning message to the application.

[0125] S609: The application pushes alarm notifications to the user terminal based on the warning information.

[0126] The website security identification method provided in this application process the user's website access requests through a home gateway to acquire multi-dimensional traffic data of the website to be identified in real time. It automatically triggers edge cloud processing to extract features from the multi-dimensional traffic data, obtaining multi-dimensional feature data. Based on the website security identification model and the multi-dimensional feature data, identification processing is performed to obtain the risk probability, meeting the real-time requirements of website security identification and improving the accuracy of identification. Warning information is sent to preset applications, triggering risk alerts in the applications, achieving timely warnings and improving the security of website security identification.

[0127] In one embodiment of this application, based on the above embodiments, after step S604, a process is further included in which the home gateway obtains the access characteristics of the website to be identified, as detailed below:

[0128] S610: The home gateway obtains the traffic time-series data of the website to be identified.

[0129] S611: The home gateway uses a traffic timing analysis algorithm to analyze traffic timing data to obtain access data, redirection path data, and data packet information of the website to be identified.

[0130] S612: Add access data, redirection path data, and packet information to multidimensional traffic data.

[0131] The website security identification method provided in this application provides more comprehensive data on the website to be identified, improves the accuracy of network security identification, and thus improves the security of network security identification.

[0132] In one embodiment of this application, based on the above embodiments, step S606 is further provided in another way, as detailed below:

[0133] The edge cloud performs feature extraction processing on access data based on basic attributes and quantified behavior to obtain access data features; it performs feature extraction processing on jump path data based on path structure analysis to obtain jump path features; it performs feature extraction processing on data packet information based on transmission attributes to obtain data packet features; and it determines access data features, jump path features, and data packet features as multidimensional feature data.

[0134] Accordingly, step S607 also provides another implementation method, detailed below:

[0135] S6071: Edge cloud constructs access relationship graphs based on multi-dimensional feature data.

[0136] Specifically, the edge cloud uses the relationships between access data features, jump path features, and data packet features as nodes, and the interaction relationships between access data features, jump path features, and data packet features as edges to construct an access relationship graph.

[0137] S6072: The edge cloud inputs the access relationship graph into the trained website recognition model to obtain the risk probability.

[0138] The website identification model can be a graph neural network model.

[0139] The graph neural network model can be trained using access relationship graph samples and the risk probability labels corresponding to the access relationship graph samples.

[0140] The website security identification method provided in this application improves the accuracy of website security identification by constructing an access relationship graph based on multi-dimensional feature data, thereby enhancing the security of network security identification.

[0141] Figure 7 This is a schematic diagram of a website security identification device provided in an embodiment of this application, applied to a home gateway. Figure 7 As shown, the website security identification device provided in this embodiment includes: a first acquisition module 701, a second acquisition module 702, and an upload module 703.

[0142] The first acquisition module 701 is used to acquire the website to be identified corresponding to the website access request in response to the user's website access request;

[0143] The second acquisition module 702 is used to acquire multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data;

[0144] The upload module 703 is used to upload the multidimensional traffic data to the edge cloud, so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data, and perform identification processing based on the trained website security identification model and the multidimensional feature data to obtain the risk probability.

[0145] In one possible implementation, the first acquisition module 701 is specifically used to: perform packet capture and domain name acquisition processing on the website access request through a packet capture library application programming interface, so as to determine the website to be identified corresponding to the website access request.

[0146] In one possible implementation, the second acquisition module 702 is specifically used to: acquire the domain name of the website to be identified; generate a crawling task based on the domain name; and simulate accessing the website to be identified based on the crawling task to obtain the multidimensional traffic data.

[0147] In one possible implementation, the term is specifically used for: the second acquisition module 702, when "simulating access to the website to be identified according to the crawling task to obtain the multi-dimensional traffic data", specifically used for: simulating access to the website to be identified according to the crawling task to obtain multiple of the following: Uniform Resource Locator (URL) address data, URL request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data of the website to be identified; performing structured processing on the URL address data, URL request frequency data, HTML text data, title data, keyword data, image data, and user behavior data to obtain multiple of the following: webpage URL traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data.

[0148] The website security identification device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0149] Figure 8 This is a schematic diagram of another website security identification device provided in an embodiment of this application, applied to edge cloud. For example... Figure 8 As shown, the website security identification device provided in this embodiment includes: a receiving module 801, a feature extraction module 802, and an identification processing module 803.

[0150] The receiving module 801 is used to receive multidimensional traffic data sent by the home gateway; wherein, the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to a user's website access request after obtaining the website to be identified corresponding to the website access request; wherein, the multidimensional traffic data includes multiple of the following: web page Uniform Resource Locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data;

[0151] Feature extraction module 802 is used to perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data;

[0152] The identification processing module 803 is used to perform identification processing based on the trained website security identification model and the multi-dimensional feature data to obtain the risk probability.

[0153] In one possible implementation, the feature extraction module 802 is specifically configured to: if the multidimensional traffic data includes webpage URI traffic data, perform URI feature extraction processing on the webpage URI traffic data to obtain first feature data; if the multidimensional traffic data includes webpage text traffic data, perform natural language processing-based feature extraction processing on the webpage text traffic data to obtain second feature data; if the multidimensional traffic data includes webpage image traffic data, perform computer vision contrast-based feature extraction processing on the webpage image traffic data to obtain third feature data; and if the multidimensional traffic data includes user behavior traffic data, perform behavioral interaction-based feature extraction processing on the user behavior traffic data to obtain fourth feature data.

[0154] In one possible implementation, the identification processing module 803 is specifically used for: acquiring a trained website identification model; wherein the website identification model is trained from multidimensional feature data samples and risk probability labels corresponding to the multidimensional feature data samples; inputting the multidimensional feature data into the trained website identification model; and determining the risk probability based on the output of the trained website identification model.

[0155] In one possible implementation, the website security identification device further includes:

[0156] The sending module is used to send a warning message to a preset application if the risk probability is greater than a preset risk probability threshold, so as to trigger a risk alarm in the application.

[0157] The website security identification device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0158] Figure 9 This is a schematic diagram of the structure of a website security identification device provided in an embodiment of this application. This device can be a server, applied to a home gateway or edge cloud. Figure 9 As shown, the website security identification device provided in this embodiment includes at least one processor 901 and a memory 902. Optionally, the device further includes a communication component 903. The processor 901, memory 902, and communication component 903 are connected via a bus 904.

[0159] In a specific implementation, at least one processor 901 executes computer execution instructions stored in memory 902, causing at least one processor 901 to perform the above-described method.

[0160] The specific implementation process of processor 901 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0161] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0162] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0163] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0164] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0165] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0166] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0167] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0168] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0169] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0170] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0171] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0173] Finally, it should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and alterations may be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for identifying website security, characterized in that, Applied to a home gateway, the method includes: In response to a user's website access request, obtain the website to be identified corresponding to the website access request; Obtain multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data; The multidimensional traffic data is uploaded to the edge cloud so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data. Based on the trained website security identification model and the multidimensional feature data, identification processing is performed to obtain the risk probability.

2. The method according to claim 1, characterized in that, The step of obtaining the website to be identified corresponding to the website access request includes: The website access request is captured and the domain name is obtained by using the packet capture library application programming interface to determine the website to be identified corresponding to the website access request.

3. The method according to claim 1 or 2, characterized in that, The acquisition of multidimensional traffic data of the website to be identified includes: Obtain the domain name of the website to be identified; Generate a crawling task based on the domain name; Based on the crawling task, simulate access to the website to be identified in order to obtain the multidimensional traffic data.

4. The method according to claim 3, characterized in that, The step of simulating access to the website to be identified based on the crawling task to obtain the multidimensional traffic data includes: According to the crawling task, simulate access to the website to be identified in order to obtain multiple of the following data from the website to be identified: Uniform Resource Locator (URL) address data, Uniform Resource Locator (URL) request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data. The Uniform Resource Locator (URL) address data, URL request frequency data, Hypertext Markup Language (HTML) text data, title data, keyword data, image data, and user behavior data are structured to obtain multiple types of webpage URL traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data.

5. A method for identifying website security, characterized in that, Applied to edge cloud, the method includes: The system receives multidimensional traffic data sent by a home gateway; wherein the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to a user's website access request after obtaining the website to be identified corresponding to the website access request; wherein the multidimensional traffic data includes multiple of the following: web page Uniform Resource Locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data; The multidimensional traffic data is subjected to feature extraction processing to obtain multidimensional feature data; The risk probability is obtained by performing identification processing based on the trained website security identification model and the multi-dimensional feature data.

6. The method according to claim 5, characterized in that, The process of extracting features from the multidimensional traffic data to obtain multidimensional feature data includes: If the multidimensional traffic data includes web page uniform resource locator (URL) traffic data, then the URL traffic data is subjected to URL feature extraction processing to obtain the first feature data. If the multidimensional traffic data includes web page text traffic data, then the web page text traffic data is subjected to feature extraction processing based on natural language processing to obtain second feature data; If the multidimensional traffic data includes webpage image traffic data, then the webpage image traffic data is subjected to feature extraction processing based on computer vision comparison to obtain third feature data. If the multidimensional traffic data includes user behavior traffic data, then the user behavior traffic data is subjected to feature extraction processing based on behavioral interaction to obtain the fourth feature data.

7. The method according to claim 5, characterized in that, The step of performing identification processing based on the trained website security identification model and the multi-dimensional feature data to obtain the risk probability includes: Obtain a trained website identification model; wherein the website identification model is trained from multi-dimensional feature data samples and risk probability labels corresponding to the multi-dimensional feature data samples; The multidimensional feature data is input into the trained website recognition model; The risk probability is determined based on the output of the trained website recognition model.

8. The method according to any one of claims 5-7, characterized in that, After performing identification processing based on the trained website security identification model and the multi-dimensional feature data to obtain the risk probability, the method further includes: If the risk probability is greater than a preset risk probability threshold, a warning message is sent to a preset application to trigger a risk alarm in the application.

9. A website security identification device, characterized in that, Applications in home gateways include: The first acquisition module is used to acquire the website to be identified corresponding to the user's website access request in response to the user's website access request; The second acquisition module is used to acquire multidimensional traffic data of the website to be identified; wherein, the multidimensional traffic data includes multiple of the following: webpage Uniform Resource Locator traffic data, webpage text traffic data, webpage image traffic data, and user behavior traffic data; The upload module is used to upload the multidimensional traffic data to the edge cloud, so that the edge cloud can perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data. Based on the trained website security identification model and the multidimensional feature data, identification processing is performed to obtain the risk probability.

10. A website security identification device, characterized in that, Applications in the edge cloud include: A receiving module is used to receive multidimensional traffic data sent by a home gateway; wherein, the multidimensional traffic data is the multidimensional traffic data of the website to be identified obtained by the home gateway in response to a user's website access request after obtaining the website to be identified corresponding to the website access request; wherein, the multidimensional traffic data includes multiple of the following: web page Uniform Resource Locator traffic data, web page text traffic data, web page image traffic data, and user behavior traffic data; The feature extraction module is used to perform feature extraction processing on the multidimensional traffic data to obtain multidimensional feature data; The identification processing module is used to perform identification processing based on the trained website security identification model and the multi-dimensional feature data to obtain the risk probability.

11. A website security identification device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-4 or as described in any one of claims 5-8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement any one of claims 1-4 or to perform the method described in any one of claims 5-8.

13. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements any one of claims 1-4 or performs the method described in any one of claims 5-8.

Images