Reverse proxy-based dynamic website cloning simulation training target field construction method

Abstract

The present application relates to the technical field of network security simulation, in particular to a dynamic website cloning simulation training range construction method based on reverse proxy, comprising the following steps: collecting communication data through proxy and generating dynamic resource set through regular matching, extracting asynchronous behavior and resource field update result, calculating structural similarity to replace malicious components to generate induction set, extracting difference and TLS parameter to encapsulate simulation result, constructing index grouping matching and rearranging injection optimization channel and calling result, in the present application, website communication data is collected and longest common subsequence matching is carried out, request and response details are captured, real dynamic resource data is generated, regularity and path matching ensure data integrity, dynamic interaction behavior is reproduced, structural similarity algorithm simulates security threat, induction component loading replacement and TLS handshake extraction enhance interactivity, innovative processing means improves simulation flexibility and security, and accurate verification and security support are provided.

Description

Technical Field

[0001] This invention relates to the field of network security simulation technology, and in particular to a method for constructing a dynamic website cloning simulation training range based on reverse proxies. Background Technology

[0002] The field of network simulation technology encompasses research directions involving structured modeling and behavioral simulation of network systems, service protocols, and security mechanisms. Its core content primarily involves accurately reproducing network communication protocols, server response processes, data transmission paths, and traffic behavior to support various application needs such as system verification, security analysis, and intrusion detection drills. Network simulation technology typically relies on refined protocol stack construction, interactive behavior tracking, and state transition logic control. It is widely used in information security drills, network architecture optimization, and training scenarios. Its development path encompasses systematic methods such as static model-driven approaches, dynamic behavioral simulation, and highly interactive reconstruction methods, possessing the ability to simulate multi-node collaboration, abnormal behavior responses, and complex topology deployments in network environments.

[0003] The method for constructing a dynamic website cloning simulation training range based on reverse proxy involves using a reverse proxy mechanism to obtain the original website's request and interaction data. Through protocol-level request restoration, dynamic page structure parsing, and resource path remapping, a simulation page with the original structure and behavioral characteristics is generated. This page is then deployed in a virtual simulation range environment for the training system to perform interactive simulation operations. For the request and response mechanism of dynamically generated websites, a strategy of real-time interaction capture and front-end / back-end structure decomposition is used to construct the simulation site. This is combined with multi-source resource merging and rule redirection methods to reproduce the original site's access flow and response logic, thereby constructing a website environment with specific behavioral semantics and interactive characteristics.

[0004] Current technologies primarily rely on static models and basic behavioral simulations during the simulation process, making it difficult to accurately reproduce dynamic websites. When performing network simulations, the lack of dynamic tracking of real-time interactive data and resource updates prevents the timely capture and simulation of asynchronously loaded content on pages, resulting in low reproducibility of complex webpage interactions. For the request-response mechanisms of dynamically generated websites, existing simulation methods typically rely only on basic page content and protocols, failing to delve into details such as resource paths and request structures during page loading. Furthermore, existing technologies are relatively limited in simulating malicious behavior and security risks, unable to simulate potential attack scenarios by loading malicious components in real time. The lack of detailed simulation of TLS handshakes and session parameters hinders the full realization of security drills. These shortcomings directly impact the accuracy and security of simulation training, failing to provide a highly realistic and interactive training environment, thus limiting its value in practical applications. Summary of the Invention

[0005] To address the technical problems existing in the prior art, embodiments of the present invention provide a method for constructing a dynamic website cloning simulation training range based on a reverse proxy, comprising the following steps:

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for constructing a dynamic website cloning simulation training range based on reverse proxy, comprising the following steps:

[0007] S1: Collect communication data packets from the first access to the page through the proxy server, extract the parameter key-value pairs and request paths of each communication record, perform path matching on the communication request items through the longest common subsequence algorithm, and regularize the items that fail to match, to generate a dynamic resource dataset.

[0008] S2: Call the dynamic resource dataset, obtain the asynchronous loading behavior and extract the response structure, request path and resource usage fields, determine whether the resource has been updated and summarize, and generate resource update results;

[0009] S3: Call the resource update result, calculate the matching degree between the DOM structure and the preset malicious component template library through the structural similarity algorithm, filter the path items with good matching degree and replace the original DOM structure with the corresponding malicious component to generate a set of inducing component loading;

[0010] S4: Call the inducing component loading set, obtain the difference between the original page DOM structure and the currently loaded content and perform resource simulation replacement, extract the session parameters and certificate information in the TLS handshake, form the TLS channel configuration, and uniformly encapsulate the replaced page resources, inducing component structure and TLS channel parameters to generate the website clone simulation training target construction result.

[0011] S5: Call the website clone simulation training target field construction results, extract hash values ​​and site identifier parameters to construct a target distribution index table and group users, perform page resource structure matching and rearrange the injection order of induced components, and generate optimized channel allocation and resource call results.

[0012] As a further aspect of the present invention, the dynamic resource dataset includes request path features, regularization failure item labels, and communication parameter key-value distribution; the resource update result specifically includes response structure field difference rate, resource usage tag sequence, and request path change label; the induced component loading set includes malicious component structure fields, replaced DOM path, and component tag nesting level; the website cloning simulation training target construction result specifically refers to resource replacement structure path, induced component loading sequence, and TLS session configuration parameter set; the optimized channel allocation and resource call result includes component injection order index, resource structure comparison field, and channel field mapping rules.

[0013] As a further aspect of the present invention, the specific steps of S1 are as follows:

[0014] S101: Extract the request path, request method, request parameters, response status, and data content structure fields from the communication data packets of the first access to the page through the proxy server, and group them. Then, compare the request path field of each communication item in each group character by character to obtain the path field sequence density.

[0015] S102: Based on the path field sequence density, the request path field in each group of communication items is matched using the longest common subsequence algorithm, the path matching feature value is calculated, path items that do not reach the path similarity threshold are filtered out, and the path matching difference rate is generated.

[0016] S103: Based on the path item corresponding to the path matching difference rate, extract the type structure of the random parameter field in the parameter key-value pair, summarize the part of the parameter name including the variable identifier in the form of a regular expression through the identifier separation rule, replace the variable part, and generate a dynamic resource dataset.

[0017] As a further aspect of the present invention, the path similarity threshold is set by the character length of the multi-request path field, the number of path levels, and the repetition rate of common fields in the communication records collected by the statistical proxy server.

[0018] As a further aspect of the present invention, the specific steps of S2 are as follows:

[0019] S201: Call the dynamic resource dataset to obtain the communication response content in the asynchronous loading state, extract the structure fields, resource request path and corresponding purpose tag fields included in each response record, and generate an asynchronous loading structure sequence according to the time sequence of the resource response;

[0020] S202: Based on the resource response structure field and purpose tag of each resource in the asynchronous loading structure sequence, determine the change status of the field content in two adjacent loading behaviors, filter the structural difference segments, calculate the update status ratio based on the ratio of the field difference value to the total number of fields, and obtain the resource structure update degree.

[0021] S203: Call the resource items whose update degree in the resource structure is greater than the update judgment threshold, match their resource purpose field and path field and perform classification statistics, summarize the ratio range of the number of resource update items and the update degree under each purpose, and generate resource update results;

[0022] The update determination threshold is set by statistically analyzing the resource update frequency and structural differences in the data and comparing the resource update behavior in multiple loading cycles.

[0023] As a further aspect of the present invention, the specific steps of S3 are as follows:

[0024] S301: Based on the resource update results, extract the tag hierarchy, attribute nodes and nesting relationships in the DOM structure, compare the feature tags and node distribution in the malicious component template, call the structural similarity algorithm to perform structural vector comparison, calculate the structural matching degree between the path and the template, and generate a path matching degree sequence.

[0025] S302: Based on the path matching degree sequence, filter path items with matching degree greater than the structural similarity judgment threshold, take the corresponding path items as candidate replacement target paths, extract the tag index in the candidate path and map it to the original DOM structure node, and obtain the replacement path mapping value.

[0026] S303: Based on the replacement path mapping value, call the replacement node content corresponding to the preset malicious component template, directly replace the mapping node in the DOM structure, reconstruct the node attribute parameters and script reference tags and merge and organize them to generate an inducing component loading set;

[0027] The malicious component template consists of phishing forms, script pop-ups, and links designed to induce downloads.

[0028] As a further aspect of the present invention, the structural similarity judgment threshold is set by comparing the DOM structure in the data with a preset malicious component template library, and by performing statistical analysis on the similarity between multiple templates and the DOM structure.

[0029] As a further aspect of the present invention, the specific steps of S4 are as follows:

[0030] S401: Call the induced component loading set, compare the original page DOM structure before and after the induced component loading, extract node paths, script tags and resource reference addresses, calculate the resource offset degree of the structure fields, identify the changed DOM areas and replace them, and generate the structure resource offset rate.

[0031] S402: Based on the structure resource offset rate, obtain the data packet content of the client and server completing the TLS handshake phase, extract the session identifier, cipher suite, server certificate public key field and key exchange parameters generated in each handshake round, and collect the fields to obtain the TLS channel parameter set;

[0032] S403: Based on the TLS channel parameter set, call the page structure after resource replacement and the original induced component loading set content, uniformly mark the path and certificate chain field of the page DOM structure, component tag sequence and TLS channel field and encapsulate them to generate the website clone simulation training target construction result.

[0033] As a further aspect of the present invention, the specific steps of S5 are as follows:

[0034] S501: Call the website clone simulation training target field construction results, extract the hash values ​​and site identifier parameters from the multi-page resources, divide the range to which the hash values ​​belong, count the number of hash value types and the frequency of occurrence of corresponding resources in the page loading order, and calculate to generate hash distribution density;

[0035] S502: Based on the hash distribution density, filter the hash quantity range and resource frequency interval corresponding to the site identifier, calculate the change range of resource call frequency and site access span in the site, classify access behavior tags according to site, and obtain user behavior grouping coefficients.

[0036] S503: Based on the user behavior grouping coefficient, align the page structure fields with the resource positions and script nesting order in the inducement components, identify resource injection order offset items, and rearrange the component loading order by field sorting to generate optimized channel allocation and resource call results.

[0037] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0038] In this invention, by accurately collecting website communication data and performing longest common subsequence matching, the details of page requests and responses can be effectively captured, thus providing more realistic and complete dynamic resource data for subsequent simulation training. Regularization and path matching of these requests ensure the integrity and accuracy of the data, reproducing various dynamic interactive behaviors of the website during simulation. Furthermore, by matching the DOM structure with malicious component template libraries using a structural similarity algorithm, the simulated page not only reproduces the behavior patterns of the original website but also simulates potential security threats, providing a more accurate and efficient environment for security analysis and drills. By inducing component loading and replacement and extracting TLS handshake information, a page interaction environment completely identical to the original website can be simulated, and the interactiveness and realism of the training are enhanced through resource simulation replacement. These innovative processing methods not only improve the flexibility and security of the simulation process but also provide more accurate support for system verification and attack detection. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1This is a schematic diagram of the steps of the present invention;

[0041] Figure 2 This is a detailed schematic diagram of S1 of the present invention;

[0042] Figure 3 This is a detailed schematic diagram of S2 of the present invention;

[0043] Figure 4 This is a detailed schematic diagram of S3 of the present invention;

[0044] Figure 5 This is a detailed schematic diagram of S4 of the present invention;

[0045] Figure 6 This is a detailed schematic diagram of S5 of the present invention. Detailed Implementation

[0046] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0047] In embodiments of the present invention, words such as "exemplarily" and "comprising" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0048] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent.

[0049] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0050] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0051] Please see Figure 1 This invention provides a method for constructing a dynamic website cloning simulation training range based on a reverse proxy, comprising the following steps:

[0052] S1: Collect communication data packets from the first access to the page through the proxy server, extract the parameter key-value pairs and request paths of each communication record, perform path matching on the communication request items through the longest common subsequence algorithm, and regularize the items that fail to match, to generate a dynamic resource dataset.

[0053] S2: Call the dynamic resource dataset, obtain the asynchronous loading behavior and extract the response structure, request path and resource usage fields, determine whether the resource has been updated and summarize, and generate resource update results;

[0054] S3: Call the resource update result, calculate the matching degree between the DOM structure and the preset malicious component template library through the structural similarity algorithm, filter the path items with the best matching degree and replace the original DOM structure with the corresponding malicious component to generate a set of inducing component loading;

[0055] S4: Call the inducing component loading set, obtain the differences between the original page DOM structure and the currently loaded content and perform resource simulation replacement, extract session parameters and certificate information in the TLS handshake, form TLS channel configuration, and uniformly encapsulate the replaced page resources, inducing component structure and TLS channel parameters to generate the website clone simulation training target construction result.

[0056] S5: Call the website clone simulation training target field construction results, extract hash values ​​and site identifier parameters to construct a target distribution index table and group users, perform page resource structure matching and rearrange the injection order of induced components, and generate optimized channel allocation and resource call results.

[0057] The dynamic resource dataset includes request path features, regularization failure labels, and communication parameter key-value distribution; the resource update results specifically include response structure field difference rate, resource usage tag sequence, and request path change labels; the induced component loading set includes malicious component structure fields, replaced DOM path, and component tag nesting level; the website cloning simulation training target range construction results specifically refer to resource replacement structure path, induced component loading sequence, and TLS session configuration parameter set; the optimized channel allocation and resource call results include component injection order index, resource structure comparison fields, and channel field mapping rules.

[0058] Please see Figure 2 The specific steps of S1 are as follows:

[0059] S101: Extract the request path, request method, request parameters, response status, and data content structure fields from the communication data packets of the first access to the page through the proxy server, and group them. Then, compare the request path field of each communication item in each group character by character to obtain the path field sequence density.

[0060] The system captures the communication data packets from the user's first visit via a proxy server, extracting the request path / search, request method GET, request parameters query=product, page=1, and response status 200 OK. Items with the same path are grouped together, and the path strings within each group are compared character by character. The frequency of each character position is recorded, including the 1st to 7th characters / s / e / a / r / c / h appearing 10 times in 10 requests, the 8th character ? appearing 10 times, the 9th to 14th characters query= appearing 10 times, and the 15th to 21st characters showing differences (product appearing 5 times, user appearing 5 times). The density of the characters at multiple positions is calculated: positions 1-14 have a density value of 1.0 (full match), and positions 15-21 have a density value of 0.5 (partial match), forming a density sequence [1.0, 1.0, 0.5, 0.5].

[0061] S102: Based on the path field sequence density, the request path field in each group of communication items is matched using the longest common subsequence algorithm, the path matching feature value is calculated, path items that do not reach the path similarity threshold are filtered out, and the path matching difference rate is generated.

[0062] Based on the density sequence [1.0, 1.0, 0.5, 0.5], where L is the length of the longest common subsequence (number of characters), obtained by comparing path strings, and S... P : Similarity weight of path P, quantifying the semantic importance of keywords in the path (range [0,1]), S Q The similarity weight of path Q is logically the same as that of S. P L P : Total length of path P (number of characters), directly count the string length, L Q The total length of path Q, logically the same as L. P k: Path length adjustment factor, used to balance the common subsequence length deviation of long paths; L (length of the longest common subsequence), compares the path string character by character, and calculates the number of consecutive matching characters; path P: / search?query = product → string sequence P1 to P 21 Path Q: / search? query=user→string sequence Q1 to Q 18 Match result: First 14 characters / search?query=exact match → L=14, S P With S Q(Similarity Weighting) Extract keywords (e.g., search, user) from the path, count the keyword frequency in the request (high frequency > 50%, medium frequency 10%-50%, low frequency < 10%), and assign weight values: high frequency words = 0.3, medium frequency words = 0.2, low frequency words = 0.1; static path segments (fixed weight = 0.2, cumulative weight (maximum 0.9), path P contains the high frequency word search (weight 0.3) and the static segment / ?query = (weight 0.4), sum S P =0.7, path Q contains the high-frequency word "search" (0.3), static segments (0.4), and the mid-frequency word "user" (0.2), with a total S. Q =0.9 (reaching the upper limit), L P With L Q (Path length) is directly counted by characters, P: / search?query = conduct → number of characters L P =21, Q: / search? query=user→number of characters L Q =18, k (length adjustment factor), based on the average path length, empirical formula. statistics (Similarity threshold = 0.6) Statistically analyze 1000 manually labeled similar path pairs and calculate the H-value distribution: Similar path pairs: H ∈ [0.65, 0.95], Dissimilar path pairs: H ∈ [0.15, 0.55]. Take the intersection threshold of 0.6 as the threshold to maximize classification accuracy. When H ≥ 0.6, the manual verification similarity accuracy is > 92%; when H < 0.6, the dissimilarity accuracy is > 89%. Substitute these values ​​into the formula... Since 0.4786 < 0.6, it is determined that paths P and Q do not match.

[0063] S103: Based on the path item corresponding to the path matching difference rate, extract the type structure of the random parameter field in the parameter key-value pair, summarize the part of the parameter name that includes the variable identifier in the form of a regular expression through the identifier separation rule, replace the variable part, and generate a dynamic resource dataset.

[0064] Based on the unmatched paths corresponding to a difference rate of 12%, extract parameter key-value pairs such as query=product and query=user. Identify product and user as variable fields, use the identifier / to separate parameter names, summarize the variable parts into the regular expression pattern query=[a-zA-Z]+, replace it with the variable query={var}, and generate dynamic resource dataset entries: {path template: / search? query={var}, parameter pattern: alphabetic string, example value:[product,user]}.

[0065] Please see Figure 3 The specific steps of S2 are as follows:

[0066] S201: Call the dynamic resource dataset to obtain the communication response content in the asynchronous loading state, extract the structure fields, resource request path and corresponding purpose tag fields included in each response record, divide them according to the time sequence of resource response, and generate an asynchronous loading structure sequence;

[0067] The system calls a dynamic resource dataset (e.g., a generated entry {path template: / api / products?page={num}, parameter pattern: number, example value: [1, 2]}), retrieves the asynchronous loading response content from the proxy server logs, including the AJAX request response triggered after the user's first loading when accessing the e-commerce website. The response record with timestamp t1 (2025-08-01, 10:00:00) has the following structure: JSON format {product-id:101, name:Laptop, price:1200}, resource request path: / api / products?page=1, usage tag field: product-list. The response record with timestamp t2 (10:00:05) has the following structure: {ad-id:201, content:SummerSale, duration:30}, path: / api / ads?page=1. `type=promo`, tag `ad`, extract three fields from each record (structural fields are parsed into a set of key-value pairs, resource request path is stored as a string, and purpose tag is stored as a category string), sort them in ascending order by response timestamp to generate a sequence, including the following sequence entries: [Time t1, structural fields {product-id:101, name:Laptop, price:1200}, path / api / products?page=1, tag product-list], [Time t2, structural fields {ad-id:201, content:SummerSale, duration:30}, path / api / ads?type=promo, tag ad], the sequence contains response records at 10 time points, with time intervals all less than 2 seconds, ensuring continuous asynchronous loading behavior, generating an asynchronous loading structure sequence.

[0068] S202: Based on the resource response structure fields and usage tags in the asynchronous loading structure sequence, determine the change status of field content in two adjacent loading behaviors, filter the structural difference segments, calculate the update status ratio based on the ratio of field difference value to the total number of fields, and obtain the resource structure update degree.

[0069] Based on the asynchronous loading structure sequence (such as response records at adjacent time points t1 and t2 in the sequence), take response record A (t1 structure field set: key product-id value 101, key name value Laptop, key price value 1200) and response record B (t2 structure field set: key ad-id value 201, key content value SummerSale, key duration value 30). Compare the key-value pairs of the structure fields of A and B, checking the key name and key value for consistency key by key. If the key product-id is missing in B, the key ad-id is missing in A, and the key name and content have different key names, filter the difference fragments as newly added key ad-id, missing key product-id, and key name changes (name vs content). Calculate the field difference value D: the number of difference fragments. By counting the difference fragments, D = 3 (1 newly added, 1 missing, 1 key name change). Calculate the total number of fields T: the total number of fields in response record B. By counting the number of field key-value pairs, T = 3 (key ad-id, content, duration). Calculate the update state ratio R using the formula. Substitute value The formula uses a division operation. The numerator D represents the degree of field change, and the denominator T represents the baseline size of the field. The purpose is to normalize the update intensity and avoid bias caused by a large number of fields. The resource structure update degree R = 1.0 is obtained. The process is repeated for all adjacent pairs (9 pairs in total) in the sequence, including another pair of responses C (field {rating: 4.5}) and D (field {rating: 4.8, reviews: 10}). Key-value pairs are compared, and the differences are the changes in the key rating value (4.5 vs 4.8) and the addition of the key reviews. D = 2 (value change counts as 1 difference, addition counts as 1 difference), T = 2 (based on the total number of records in D). The update judgment threshold is set to 0.3. The threshold is obtained by statistically analyzing data from 100 loading cycles. The R value of each loading cycle is calculated to generate the R value distribution: low update interval [0, 0.2] (accounting for 40%, with small structural changes), medium update interval 0.2, 0.5 (accounting for 35%), and high update interval (0.5, 1.0] (accounting for 25%). The high update starting point of 0.3 is taken as the threshold to ensure the identification of changes (human verification accuracy > 85%). Data examples include: average R = 0.15 for cycle 1 and average R = 0.4 for cycle 2. The threshold of 0.3 distinguishes high update behavior. The R values ​​in the sequence are stored as an update degree array [1.0, 1.0, 0.2].

[0070] S203: Call the resource items whose update degree in the resource structure is greater than the update judgment threshold, match their resource purpose field and path field and perform classification statistics, summarize the range of the number of resource update items and update degree ratio under each purpose, and generate resource update results;

[0071] The update judgment threshold is set by statistically analyzing the resource update frequency and structural differences in the data and comparing the resource update behavior in multiple loading cycles.

[0072] The system calls the resource structure update level array (e.g., values ​​[1.0, 0.2, 0.8]), where R represents the update status ratio. It filters items with R > 0.3 (indices 1 and 3), extracts the corresponding resource usage tag field and path field. Index 1 has the tag "ad" and the path is / api / ads?type = promo; Index 3 has the tag "content" and the path is / api / news?category = tech. The system matches the usage tags to classify items into categories such as ad, content, and product-list. It counts the number of update items in each category: ad category count = 1 (R = 0.8), content category count = 1 (R = 1.0). It calculates the update level ratio range for each category: ad category R value set [0.8], range [0.8, 0.8]; content category R value set [1.0], range [1.0, 1.0]. Finally, it summarizes all categories and generates a resource update result table.

[0073] Table 1: Statistics of Resource Update Results

[0074] ad 1 [0.8,0.8] content 1 [1.0,1.0] Product-list 0 [0.0,0.0]

[0075] As shown in Table 1, the classification statistics are summarized. The number of updated items is obtained by counting and filtering the items, and the update degree ratio range is obtained by calculating the minimum and maximum R values ​​of the same category.

[0076] Please see Figure 4 The specific steps of S3 are as follows:

[0077] S301: Based on the resource update results, extract the tag hierarchy, attribute nodes and nesting relationships in the DOM structure, compare the feature tags and node distribution in the malicious component template, call the structural similarity algorithm to perform structural vector comparison, calculate the structural matching degree between the path and the template, and generate a path matching degree sequence.

[0078] Based on the resource update results (such as the generated resource update result table, the usage category ad update degree ratio range [0.8, 0.8]), extract tags from the DOM structure (e-commerce page DOM tree, path body>div.container>ul#product-list>li.item, node level depth=4), attribute nodes (such as li.item's attribute class=item, data-id=101), nesting relationships (such as ul nested li, li nested img and span), call the preset malicious component template (phishing form template path form>input[type=text], input[type=password]), compare feature tags (target DOM tag livs template tag input), node distribution (target node quantity distribution: level 1:1 nodes, level 2:1 nodes, level 3:2 nodes vs template level 1:1, level 2:2), P: total number of paths, obtain the number of all unique paths through DM tree parsing, l k The number of nodes on the k-th path in the target DM, obtained by traversing the path and counting the nodes. The number of nodes in the k-th path of the malicious template is read from the preset template library, β. k : Hierarchical matching coefficient, quantifying path depth difference (range [0,1]), γ k Attribute similarity, quantifying the degree of node attribute matching (range [0,1]), P (total number of paths), parsing the DM tree, extracting the complete path from the root node to the leaf node, counting the number of unique paths, DM tree path: bdy>div.cntainer, bdy>ul>li, bdy>img → P=3, l k and (Number of nodes), l k : Traverse the k-th path of the target DM, counting the number of nodes separated by characters > 0. Read the number of nodes for the corresponding path in the template library. Path k=1: Target DM path bdy>div.cntainer>ul → nodes bdy,div,ul → l1=3, template path frm>div → node frm, β k (Hierarchical matching coefficient), Step 1: Obtain the target path hierarchy depth d t =l k (Number of nodes equals depth), Step 2: Obtain the template path hierarchy depth Step 3: Calculation γ k(Attribute Similarity), Step 1: Extract attribute key-value pairs from the end node of the target path (e.g., {class:cntainer, id:main}), Step 2: Extract attribute key-value pairs from the corresponding node of the template (e.g., {class:frm}), Step 3: Calculate the proportion of identical key names: Target attribute: {class:cntainer,id:main} (keys:class,id), Template attribute: {class:frm,type:text} (keys:class,type), Same key name: (Structural similarity threshold = 0.4) Statistical analysis of 100 sets of DM and template comparison data: Similar path pairs (manually labeled): ρ∈[0,0.35] (85%), Dissimilar path pairs: ρ∈0.35,1.0 (15%), taking a critical value of 0.4 (slightly higher than the upper limit of the similarity interval 0.35), balancing the false positive rate and the false negative rate, path 1 (k=1): γ1 = 0.5 (attributes: target {class:cntainer}, template {class:frm}), path 2 (k = 2): l2 = 4, γ2 = 0 (attributes: target {id:list}, template {type:input}), path 3 (k = 3): l3 = 2, γ3 = 0 (target has no attributes, template has attributes), substitute into the formula Path 1: Path 2: Path 3: Summation: ρ = 0.6665 + 0.25 + 0 = 0.9165. Since 0.9165 > 0.4, the path is determined to be dissimilar to the template, and a path matching degree sequence is directly generated (e.g., [0.9165, 0.2, 0.6]).

[0079] S302: Based on the path matching degree sequence, filter path items whose matching degree is greater than the structural similarity judgment threshold, take the corresponding path items as candidate replacement target paths, extract the tag index in the candidate path and map it to the original DOM structure node, and obtain the replacement path mapping value.

[0080] Based on the path matching degree sequence (e.g., [0.9165, 0.2, 0.6]), where p represents the structural matching degree, path items with matching degrees greater than the structural similarity judgment threshold of 0.4 are filtered (index 1 ρ = 0.9165, index 3 ρ = 0.6). The path at index 1 is used as a candidate replacement target path (e.g., body>div.container). The candidate path tag index (tag div index position = 2), the original DOM structure node (root node body, child node index 1 = header, index 2 = div.container), and the mapping relationship (tag div is mapped to node index 2) are extracted. The replacement path mapping value {path:body>div.container, mapping node index: 2} is obtained. Repeat for all items in the sequence: the path at index 3 img, the mapping node index 5 (e.g., li>img in the DOM), and generate the mapping value array [{path:body>div.container, index: 2}, {path:img, index: 5}].

[0081] S303: Based on the replacement path mapping value, call the corresponding replacement node content in the preset malicious component template, directly replace the mapped node in the DOM structure, reconstruct the node attribute parameters and script reference tags, and merge and organize them to generate a set of inducing component loading;

[0082] The malicious component template consists of phishing forms, script pop-ups, and links designed to induce downloads;

[0083] Based on the replacement path mapping values ​​such as {path:body>div.container, index:2}, {path:img, index:5}, the preset malicious component template (phishing form template node content) is invoked. <form action＝malicious.com> <input type＝text> Matches the mapped node index 2 (corresponding to the DOM node div.container), and directly replaces the node content with the original content.<divclass=container> ...replace with, refactor the attribute parameters (change the original attribute class=container to action=malicious.com), and add script reference tags (add). <script src＝malware.js>)，合并整理(保留原DOM结构，仅替换目标节点)，生成诱导组件加载集[{替换节点索引:2,内容:<form action＝malicious.com>...< / form>},{替换节点索引:5,内容:<img src＝phishing.png onerror＝loadScript()>}]。

[0084] 请参阅图5，S4的具体步骤为：

[0085] S401：调用诱导组件加载集，对比诱导组件加载前与加载完成后的原始页面DOM结构，提取节点路径、脚本标签与资源引用地址，计算结构字段的资源偏移程度，识别变化的DOM区域并进行替换，生成结构资源偏移率；

[0086] 调用诱导组件加载集[{替换节点索引:2，内容:<form action＝malicious.com>< / form>}，{替换节点索引:5，内容:<img src＝phishing.png>}]，对比加载前原始页面DOM结构(节点索引2原内容：<divclass＝container>Product，子节点数量＝3)与加载后DOM(节点索引2新内容：<form><input><button>< / button>< / form>，子节点数量＝2)，提取节点路径(如body>div.container)，脚本标签(原DOM无script，新DOM增加<script src＝malware.js>)，资源引用地址(原资源地址 / static / logo.png，新地址phishing.png)，计算结构字段的资源偏移程度：选择子节点数量变化率指标，对每个变化节点i计算资源偏移率N代表变化节点数量，通过DOM比对计数差异节点获取，代表替换前第i节点子节点数量，解析DOM树计数，代表替换后对应节点子节点数量，解析新DOM树计数，节点索引2：节点索引5：原内容无，新内容(子节点数＝0)，δ5＝100％(新增节点)，计算平均资源偏移率变化节点数N＝2，偏移率阈值设为40％，阈值设置参照：统计50次恶意替换数据，偏移率分布：低风险[0，30％](占比20％)，中风险(30％，60％](占比45％)，高风险(60％，100％](占比35％)，取中高风险临界点40％(人工验证准确率>85％)，包括算例：替换Aδ＝25％(低风险)，替换Bδ＝55％(高风险)，识别变化区域为节点索引2和5，替换为原始安全节点(如还原标签)，生成结构资源偏移率δ＝66.65％。

[0087] S402：根据结构资源偏移率，获取客户端与服务端完成TLS握手阶段的数据包内容，提取每轮握手中协商产生的会话标识、加密套件、服务器证书公钥字段及密钥交换参数并进行字段归集，获取TLS通道参数集；

[0088] 根据结构资源偏移率δ＝66.65％(大于阈值40％)，获取TLS握手数据包(客户端IP:192.168.1.100，服务端IP:203.0.113.5)，提取ClientHello报文会话标识SessionID＝0x7a3f(十六进制)，加密套件CipherSuite＝TLS-AES-128-GCM-SHA256，ServerHello报文服务器证书公钥字段PublicKey＝0x2d5a(长度256字节)，ServerKeyExchange报文密钥交换参数ECDH-param＝0xbf04(长度64字节)，字段归集规则：会话标识直接记录十六进制字符串，加密套件映射标准IANA值0x1301，公钥提取RSA模数n＝0x2d5a…，密钥交换参数截取前32字节，生成TLS通道参数集{SessionID:7a3f，CipherSuite:0x1301，PublicKey-n:2d5a，ECDH-param:bf04…}，对连续3轮握手重复操作，包括第二轮SessionID＝0x8b1c，CipherSuite＝TLS-CHACHA20-POLY1305-SHA256(0x1303)，汇总所有参数。

[0089] 表2：TLS通道参数集表示例

[0090] 会话标识7a3fClientHello报文字段截取加密套件0x1301映射IANA标准编码公钥模数2d5a...(256字节)证书解析RSA-n值密钥交换参数bf04...(32字节)ServerKeyExchange前32字节

[0091] 如表2所示，参数通过Wireshark抓包工具解析获取，公钥模数使用OpenSSL提取。

[0092] S403：根据TLS通道参数集，调用资源替换后的页面结构与原始诱导组件加载集内容，将页面DOM结构、组件标签序列以及TLS通道字段统一标注路径与证书链字段并封装，生成网站克隆仿真训练靶场构建结果；

[0093] 根据TLS通道参数集，如{SessionID:7a3f}，调用资源替换后页面结构(还原后的DOM树：节点索引2恢复为，索引5恢复为空)，原始诱导组件加载集内容([{索引:2，恶意内容:<form>...}])，标注页面DOM结构路径(如body>div.container映射为Path01)，组件标签序列(索引2对应标签序列[div，ul，li])，TLS证书链字段(服务器证书签发链CA＝DigiCert，SN＝35:ad:...)，封装规则：DOM结构标注字段DOM-Path＝Path01，组件标签序列标注Tag-Seq＝[div，ul，li]，TLS字段标注Cert-Chain＝DigiCert / SN＝35ad...，生成网站克隆仿真训练靶场构建结果{DOM-Path:Path01，Tag-Seq:[div，ul，li]，Cert-Chain:DigiCert / SN＝35ad...，CipherSuite:0x1301}，对所有组件重复封装。

[0094] 请参阅图6，S5的具体步骤为：

[0095] S501：调用网站克隆仿真训练靶场构建结果，提取多页面资源中的哈希值与站点标识参数，并划分哈希值所属范围，统计哈希值种类数量与页面加载顺序中对应资源的出现频率并计算，生成哈希分布密度；

[0096] 基于网站克隆仿真训练靶场构建结果，包括包含DOM结构路径Path01和资源引用地址的条目，提取多页面资源中的哈希值，并对每个资源的URL进行SHA-256哈希计算，同时计算资源 / main.js的哈希值7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069，站点标识参数如站点ID＝site001，划分哈希值所属范围，规则为取哈希字符串的前两个字符作为范围标识，包括7f属于范围R1，8a属于范围R2，统计每个范围内出现的哈希值种类数量，包括范围R1有5种不同的哈希值，范围R2有3种，总哈希值种类数量为50，计算每个范围的哈希分布密度＝范围哈希值种类数量 / 总哈希值种类数量，包括R1密度＝5 / 50＝0.1，R2密度＝3 / 50＝0.06，同时，统计页面加载顺序中对应资源的出现频率，包括资源 / main.js在10次页面加载中出现8次，频率＝0.8，资源 / style.css出现5次，频率＝0.5，生成哈希分布密度表，包括{R1:0.1，R2:0.06}，资源频率映射表{main.js:0.8，style.css:0.5}。

[0097] S502：基于哈希分布密度，筛选站点标识对应的哈希数量范围与资源频率区间，计算站点中资源的调用频次变化幅度与站点访问跨度，按站点归类划分访问行为标签，获取用户行为分组系数；

[0098] 基于哈希分布密度表，包括{R1:0.1，R2:0.06}，筛选站点标识site001对应的哈希数量范围，通过站点资源清单获取site001的哈希值列表，包括[7f83b165…，8a3c…]，其范围R1和R2，哈希数量范围即R1和R2，资源频率区间设定为[0.4，1.0]，只保留频率在区间内的资源，包括 / main.js频率0.8保留， / style.css频率0.5保留， / ad.js频率0.3排除，计算站点中资源的调用频次变化幅度，调用频次指时间内该资源被请求的次数，包括在时间窗口[10:00-11:00]调用频次＝10，[11:00-12:00]＝15，变化幅度＝|15-10| / 10＝0.5，站点访问跨度指站点被访问的总时间长度，包括首次访问时间＝10:00，最后一次访问时间＝15:00，跨度＝5小时，按站点归类划分访问行为标签，包括定义变化幅度>0.4且跨度>4小时为high-activity，否则为low-activity，站点site001变化幅度0.5>0.4且跨度5>4，标签＝high-activity，获取用户行为分组系数，根据标签映射系数，high-activity系数＝0.8，low-activity系数＝0.2，因此site001的分组系数＝0.8。

[0099] S503：根据用户行为分组系数，对页面结构字段与诱导组件中的资源位置和脚本嵌套顺序进行结构字段对齐，识别资源注入顺序偏移项，并对组件加载顺序进行字段排序重排，生成优化后通道分配与资源调用结果；

[0100] 根据用户行为分组系数，包括site001:0.8，对页面结构字段(如DOM节点序列[div，span，script])与诱导组件中的资源位置(如恶意组件中脚本位置索引＝2)和脚本嵌套顺序(如<script>嵌套深度＝2)进行结构字段对齐，按索引位置对比，包括索引0原始＝div，诱导＝div一致，索引1原始＝span，诱导＝script不一致，识别为偏移项，索引2原始＝script，诱导＝span不一致，为偏移项，对组件加载顺序进行字段排序重排，规则为：若分组系数>0.5，则按原始DOM节点顺序重排诱导组件序列，否则保持原序列，本例系数0.8>0.5，重排诱导组件序列为[div，span，script]，生成优化后通道分配与资源调用结果，包括{重排后序列:[div，span，script]，偏移修正项数:2}。

[0101] 以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。< / script> < / form>

Claims

1. A method for constructing a dynamic website cloning simulation training range based on reverse proxy, characterized in that, Includes the following steps: S1: Collect communication data packets from the first access to the page through the proxy server, extract the parameter key-value pairs and request paths of each communication record, perform path matching on the communication request items through the longest common subsequence algorithm, and regularize the items that fail to match, to generate a dynamic resource dataset. S2: Call the dynamic resource dataset, obtain the asynchronous loading behavior and extract the response structure, request path and resource usage fields, determine whether the resource has been updated and summarize, and generate resource update results; S3: Call the resource update result, calculate the matching degree between the DOM structure and the preset malicious component template library through the structural similarity algorithm, filter the path items with good matching degree and replace the original DOM structure with the corresponding malicious component to generate a set of inducing component loading; S4: Call the inducing component loading set, obtain the differences between the original page DOM structure and the currently loaded content and perform resource simulation replacement, extract the session parameters and certificate information in the TLS handshake, form the TLS channel configuration, and uniformly encapsulate the replaced page resources, inducing component structure and TLS channel parameters to generate the website clone simulation training target construction result.

2. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 1, characterized in that, The dynamic resource dataset includes request path features, regularization failure item labels, and communication parameter key-value distribution; the resource update results specifically include response structure field difference rate, resource usage tag sequence, and request path change labels; the induced component loading set includes malicious component structure fields, replaced DOM path, and component tag nesting level; the website cloning simulation training target range construction results specifically refer to resource replacement structure path, induced component loading sequence, and TLS session configuration parameter set.

3. The method for constructing a dynamic website cloning simulation training range based on reverse proxy according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Extract the request path, request method, request parameters, response status, and data content structure fields from the communication data packets of the first access to the page through the proxy server, and group them. Then, compare the request path field of each communication item in each group character by character to obtain the path field sequence density. S102: Based on the path field sequence density, the request path field in each group of communication items is matched using the longest common subsequence algorithm, the path matching feature value is calculated, path items that do not reach the path similarity threshold are filtered out, and the path matching difference rate is generated. S103: Based on the path item corresponding to the path matching difference rate, extract the type structure of the random parameter field in the parameter key-value pair, summarize the part of the parameter name including the variable identifier in the form of a regular expression through the identifier separation rule, replace the variable part, and generate a dynamic resource dataset.

4. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 3, characterized in that, The path similarity threshold is set by considering the character length of the multi-request path field, the number of path levels, and the repetition rate of common fields in the communication records collected by the statistical proxy server.

5. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 1, characterized in that, The specific steps of S2 are as follows: S201: Call the dynamic resource dataset to obtain the communication response content in the asynchronous loading state, extract the structure fields, resource request path and corresponding purpose tag fields included in each response record, and generate an asynchronous loading structure sequence according to the time sequence of the resource response; S202: Based on each resource response structure field and purpose tag in the asynchronous loading structure sequence, determine the change status of the field content in two adjacent loading behaviors, filter the structural difference segments, calculate the update status ratio based on the ratio of the field difference value to the total number of fields, and obtain the resource structure update degree. S203: Call the resource items whose update degree in the resource structure is greater than the update judgment threshold, match their resource purpose field and path field and perform classification statistics, summarize the ratio range of the number of resource update items and the update degree under each purpose, and generate resource update results; The update determination threshold is set by statistically analyzing the resource update frequency and structural differences in the data and comparing the resource update behavior in multiple loading cycles.

6. The method for constructing a dynamic website cloning simulation training range based on reverse proxy according to claim 1, characterized in that, The specific steps for S3 are as follows: S301: Based on the resource update results, extract the tag hierarchy, attribute nodes and nesting relationships in the DOM structure, compare the feature tags and node distribution in the malicious component template, call the structural similarity algorithm to perform structural vector comparison, calculate the structural matching degree between the path and the template, and generate a path matching degree sequence. S302: Based on the path matching degree sequence, filter path items with matching degree greater than the structural similarity judgment threshold, take the corresponding path items as candidate replacement target paths, extract the tag index in the candidate path and map it to the original DOM structure node, and obtain the replacement path mapping value. S303: Based on the replacement path mapping value, call the replacement node content corresponding to the preset malicious component template, directly replace the mapping node in the DOM structure, reconstruct the node attribute parameters and script reference tags and merge and organize them to generate an inducing component loading set; The malicious component template consists of phishing forms, script pop-ups, and links designed to induce downloads.

7. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 6, characterized in that, The structural similarity judgment threshold is set by comparing the DOM structure in the data with a preset malicious component template library, and by statistically analyzing the similarity between multiple templates and the DOM structure.

8. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 1, characterized in that, The specific steps of S4 are as follows: S401: Call the induced component loading set, compare the original page DOM structure before and after the induced component loading, extract node paths, script tags and resource reference addresses, calculate the resource offset degree of the structure fields, identify the changed DOM areas and replace them, and generate the structure resource offset rate. S402: Based on the structure resource offset rate, obtain the data packet content of the client and server completing the TLS handshake phase, extract the session identifier, cipher suite, server certificate public key field and key exchange parameters generated in each handshake round, and collect the fields to obtain the TLS channel parameter set; S403: Based on the TLS channel parameter set, call the page structure after resource replacement and the original induced component loading set content, uniformly mark the path and certificate chain field of the page DOM structure, component tag sequence and TLS channel field and encapsulate them to generate the website clone simulation training target construction result.

9. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 1, characterized in that, The method further includes: S5: Call the website clone simulation training target field construction results, extract hash values ​​and site identifier parameters to construct a target distribution index table and group users, perform page resource structure matching and rearrange the injection order of the inducing components, and generate optimized channel allocation and resource call results; The optimized channel allocation and resource call results include component injection order index, resource structure comparison field, and channel field mapping rules.

10. The method for constructing a dynamic website cloning simulation training range based on a reverse proxy according to claim 9, characterized in that, The specific steps of S5 are as follows: S501: Call the website clone simulation training target field construction results, extract the hash values ​​and site identifier parameters from the multi-page resources, divide the range to which the hash values ​​belong, count the number of hash value types and the frequency of occurrence of corresponding resources in the page loading order, and calculate to generate hash distribution density; S502: Based on the hash distribution density, filter the hash quantity range and resource frequency interval corresponding to the site identifier, calculate the change range of resource call frequency and site access span in the site, classify access behavior tags according to site, and obtain user behavior grouping coefficients. S503: Based on the user behavior grouping coefficient, align the page structure fields with the resource positions and script nesting order in the inducement components, identify resource injection order offset items, and rearrange the component loading order by field sorting to generate optimized channel allocation and resource call results.

Images