Link security risk detection method and related equipment

Abstract

The invention provides a link security risk detection method and related equipment. The method comprises the following steps: acquiring a first set of links, wherein the first set comprises at least one link; grouping the links in the first set according to the security risk detection state of each link in the first set to obtain at least two groups; acquiring partial links from the at least two groups based on a preset sampling proportion to obtain a second set; performing security risk detection on the links in the second set to obtain a corresponding security risk detection result; and updating the security risk detection state of the link in the first set based on the security risk detection result. According to the method and the device, high risk discovery efficiency can be achieved under relatively low detection quantity, the detection efficiency is improved, and the detection cost is reduced.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and particularly relates to a security risk detection method of link and related equipment. BACKGROUND

[0002] With the development of computer communication technology, various applications bring people excellent communication experience. A large number of deep links (Deeplink) are usually included in the application, and through the deep links, a user can be directly jumped to a specific page or function in the application. In order to ensure the security of user data, security risk detection needs to be performed on the deep links (Deeplink) in the application.

[0003] In the related art, after extracting the deep link (Deeplink) path and parameters of an application, the path, the parameters, and the parameter values are randomly combined and then subjected to fuzz testing. However, the cost of this testing is high. SUMMARY

[0004] Therefore, the present disclosure aims to provide a security risk detection method of link and related equipment.

[0005] To achieve the above object, in a first aspect, the present disclosure provides a security risk detection method of link, comprising: obtaining a first set of links, wherein the first set comprises at least one link; grouping the links in the first set according to their security risk detection states to obtain at least two groups; obtaining part of the links from the at least two groups based on a preset sampling ratio to obtain a second set; performing security risk detection on the links in the second set to obtain corresponding security risk detection results; updating the security risk detection states of the links in the first set based on the security risk detection results.

[0006] In some embodiments, the method further comprises: for each of the at least two groups, determining a security risk level of the group according to the security risk detection states of the links in the group, wherein different levels represent different security risk degrees; the sampling ratio of a group with high security risk is greater than the sampling ratio of a group with low security risk.

[0007] In some embodiments, the security risk detection states comprise one or more of undetected, invalid, valid and no risk, and valid and risk.

[0008] In some embodiments, obtaining partial links from at least two of the groups based on a preset sampling ratio includes: The sampling proportion of the group whose security risk detection status is not detected is greater than the sampling proportion of the group whose security risk detection status is invalid, valid, or risk-free. The sampling proportion of the group whose security risk detection status is valid and at risk is greater than the sampling proportion of the group whose security risk detection status is invalid, valid and at no risk. The sampling proportion of groups whose security risk detection status is invalid is greater than the sampling proportion of groups whose security risk detection status is valid and risk-free.

[0009] In some embodiments, performing security risk detection on the links in the second set to obtain corresponding security risk detection results includes: Perform validity checks on the links in the second set, and confirm the security risk detection status of links that fail the validity check as invalid. Links that pass the validity test are subjected to a first security test. Links that fail the first security test are confirmed as having a security risk but are also considered to be valid and risky. Links that pass the first security test are confirmed as having a security risk but are also considered to be valid and risk-free. The security risk test results of the first set are determined based on the security risk test status of the links in the second set.

[0010] In some embodiments, the validity check of the links in the second set includes: Determine whether the links in the second set can open the preset whitelist links; If a link in the second set cannot open a link in the whitelist, the validity check of the link is determined to be unsuccessful. If a link in the second set can be opened, the validity check of the link is determined to be passed.

[0011] In some embodiments, the first security detection includes access security detection and concept bypass security detection; the step of confirming the security risk detection status of links that fail the first security detection as valid and risky, and confirming the security risk detection status of links that pass the first security detection as valid and risk-free, includes: The security risk detection status of a link that fails either the access security detection or the concept bypass security detection is confirmed as valid and risky; The security risk detection status of a link that passes both the access security detection and the concept bypass security detection is confirmed as valid and risk-free.

[0012] In some embodiments, in response to the first security check including an access security check, performing the first security check on the link that passes the validity check includes: Determine if the link can access the test object provided by the test service; If the link is able to access the test object provided by the test service and the test service determines that the link has a security risk, the access security test result of the link is determined to be failed. In response to the link being unable to access the test object provided by the test service, the access security test result of the link is determined to be passed.

[0013] In some embodiments, in response to the first security check including a concept bypass security check, performing the first security check on the link that passes the validity check includes: Determine whether a link can bypass preset access controls and security checks to access the test object provided by the testing service; If a link can bypass preset access controls and security checks to access the test object provided by the test service, and the test service determines that the link has a security risk, the result of the link bypassing the security check is deemed as failing. If a link cannot bypass preset access controls and security checks to access the test object provided by the test service, the result of determining that the link bypasses security checks is considered successful.

[0014] In some embodiments, determining that the link poses a security risk includes: A first access request is sent to the first interface of the test service based on the link; The test service determines whether the first access request contains user data. In response to the fact that the first access request contains user data, it is determined that the link poses a data leakage security risk.

[0015] In some embodiments, determining that the link poses a security risk further includes: Receive test data of the test object returned by the test service, the test data being generated based on the first access request; The link loads and renders the test object based on the test object's test data, generates a second access request and sends it to the second interface of the test service, so that the test service determines that the link has a traffic redirection security risk based on the second access request.

[0016] In some embodiments, the method further includes: The security risk detection status of the link is marked by a status flag; and, The security risk detection status of the link is determined based on the status flag of the link.

[0017] A second aspect of this disclosure provides a security risk detection device for links, comprising: The acquisition module is configured to: acquire a first set of links, the first set including at least one link; The grouping module is configured to group the links in the first set according to the security risk detection status of each link in the first set to obtain at least two groups; The sampling module is configured to: obtain partial links from at least two of the groups based on a preset sampling ratio to obtain a second set; The detection module is configured to perform security risk detection on the links in the second set and obtain the corresponding security risk detection results; The update module is configured to update the security risk detection status of links in the first set based on the security risk detection results.

[0018] A third aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the link security risk detection method as described in the first aspect.

[0019] A fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the link security risk detection method described in the first aspect.

[0020] The fifth aspect of this disclosure provides a computer program product including computer program instructions that, when executed on a computer, cause the computer to perform the link security risk detection method as described in the first aspect.

[0021] As can be seen from the above, the security risk detection method and related equipment for links provided in this disclosure can group the links to be detected based on their security risk detection status, and obtain a portion of the links by sampling with different sampling ratios in each group. Security risk detection is then performed on only a portion of the links, thus eliminating the need to perform security risk detection on all links every time. This allows for higher risk discovery efficiency with a relatively low number of detections, improving detection efficiency and reducing detection costs. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A schematic diagram of an exemplary system provided by an embodiment of this disclosure is shown.

[0024] Figure 2 A flowchart illustrating an exemplary method provided by an embodiment of this disclosure is shown.

[0025] Figure 3 A flowchart illustrating another exemplary method provided by an embodiment of this disclosure is shown.

[0026] Figure 4 A flowchart illustrating yet another exemplary method provided by an embodiment of this disclosure is shown.

[0027] Figure 5 A schematic diagram of an exemplary apparatus provided by an embodiment of the present disclosure is shown.

[0028] Figure 6 A schematic diagram of the hardware structure of an exemplary computer device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0030] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0031] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0032] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0033] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0034] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0035] Figure 1 A schematic diagram of an exemplary system 100 provided in an embodiment of this disclosure is shown.

[0036] like Figure 1 As shown, system 100 may include terminal device 102, server 106, and database server 108. A medium (e.g., a network) may be provided between terminal device 102 and server 106 and database server 108 to provide a communication link. This network may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0037] The terminal device 102 may have various applications (APPs) or software installed, such as security monitoring applications or software, risk detection applications or software, etc. In some embodiments, these applications or software can perform security risk detection on the application based on the request of user 104.

[0038] The terminal device 102 here can be either hardware or software. When the terminal device 102 is hardware, it can be various electronic devices with a display screen, including but not limited to smartphones, tablets, e-book readers, MP3 players, laptops, and desktop computers (PCs). When the terminal device 102 is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software programs or software modules (e.g., to provide distributed services) or as a single software program or software module. No specific limitations are made here.

[0039] Server 106 can be a server providing various services, such as a backend server supporting various applications displayed on terminal device 102. Database server 108 can also be a database server providing various services. It is understood that if server 106 can implement the relevant functions of database server 108, database server 108 may not need to be set up in system 100.

[0040] The server 106 and database server 108 here can be either hardware or software. When they are hardware, they can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When they are software, they can be implemented as multiple software programs or software modules (for example, to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0041] It should be noted that the method for security risk detection provided in this embodiment can be executed by the server 106. It should be understood that... Figure 1 The number of terminal devices, users, servers, and database servers shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, users, servers, and database servers.

[0042] In one embodiment, a security risk detection application or software may be installed on the terminal device 102. The user 104 may use the application or software installed on the terminal device 102 to send a security risk detection request to the server 106. The server 106 performs security risk detection based on the security risk detection request and returns the detection result to the terminal device 102.

[0043] Links are a technology that allows users to directly jump to a specific page or function within an application. For users who have already installed the application, links can launch the target application on their device and take them directly to a deeper page. For users who haven't installed the application, deferred linking technology can first guide them to an app store or a channel-specific package to download the application, and then automatically restore the target page after installation. For example, clicking a link for a product on application A will launch application A and take them directly to the product details page, rather than leaving them on application A's homepage.

[0044] Links are widely used in marketing promotions, push notifications, cross-application navigation, and other scenarios, significantly improving user activity and retention, and are a key capability for the growth of mobile ecosystem applications.

[0045] To ensure user data security, it is necessary to perform security risk detection on links (deeplinks) within the application.

[0046] In related technologies, the path and parameters of the deep link can be extracted from the application's installation package (Apk Manifest) or from the application's installation package (Apk) using a static engine. By randomly combining the path, parameters, and parameter values ​​of the link, fuzz testing can be performed to detect security risks in the application.

[0047] However, the inventors of this disclosure have found that such fuzz testing is costly. This is because there are a great many random combinations of link paths, parameters, and parameter values, especially in scenarios with a very large number of link paths and parameters, such as some complex applications. This makes it difficult to efficiently complete the security risk detection of links in a short period of time.

[0048] In view of this, the present disclosure provides a method for detecting security risks of links to solve the above problems.

[0049] like Figure 2 As shown, the security risk detection method for the link includes: Step S101: Obtain a first set of links, the first set including at least one link.

[0050] Specifically, security risk detection of application links is required during the application's development and testing phases, the pre-release special testing phase, and the post-launch operation phase to determine the security risk detection results. Therefore, for each link in the first set that requires security risk detection, at least one link must have some links that have already been tested in previous security risk detections, while some links, such as newly added links, have not been tested.

[0051] The links in the first set can be all or some of the links obtained from one application; or, the links in the first set can be all or some of the links obtained from multiple applications, and this embodiment does not limit this.

[0052] In this embodiment, the links, such as paths and parameters, can be extracted from the manifest of the application's installation package (APK); or, the links, such as paths and parameters, can be extracted from the application's installation package (APK) by relying on a static engine.

[0053] like Figure 4 As shown, the Deeplink assets can be collected through the Extractor to find as many links as possible used in the application, such as metadata like schema, host, path, and parameters.

[0054] In some embodiments, the link can be a deep link, but this embodiment does not limit this.

[0055] Step S103: Group the links in the first set according to the security risk detection status of each link in the first set to obtain at least two groups.

[0056] In this embodiment, links in the first set are distinguished based on preset security risk detection states. Specifically, links that have undergone security risk detection have different security risk detection states than links that have not, and even links that have undergone security risk detection have different security risk detection states.

[0057] In this embodiment, links in the first set can be grouped based on their security risk detection status. Links in the same group have the same security risk detection status, while links in different groups have different security risk detection statuses.

[0058] Step S105: Based on a preset sampling ratio, obtain partial links from at least two of the groups to obtain a second set.

[0059] In this embodiment, for different groups, a portion of the links are extracted using different sampling ratios to obtain a second set containing that portion of the links.

[0060] Since the security risk detection status of the links included in each group is different, this embodiment uses different sampling ratios to sample the groups of links with different security risk detection statuses, thus obtaining only a portion of the links.

[0061] like Figure 4As shown, the Recorder can dynamically filter the links to be tested according to the sampling strategy, and is also responsible for recording the security risk detection status of each link after the test is completed.

[0062] Step S107: Perform security risk detection on the links in the second set to obtain the corresponding security risk detection results.

[0063] like Figure 4 As shown, a trigger can be used to detect security risks in all links sent by the recorder.

[0064] In this embodiment, security risk detection is performed on a portion of the links obtained based on sampling, without having to perform security risk detection on all links, thereby obtaining the corresponding security risk detection results.

[0065] Security risk detection can be performed using fuzz testing or other methods, but this embodiment does not limit the scope of the method.

[0066] Step S109: Update the security risk detection status of the links in the first set based on the security risk detection results.

[0067] In this embodiment, the security risk detection status of the corresponding links in the first set is updated based on the security risk detection results of each link in the second set, thereby determining the security risk detection status of each link in the first set; at the same time, when performing security risk detection on the links in the first set next time, the links can be used for security risk detection based on the updated security risk detection status of this detection.

[0068] In this embodiment, each link to be detected can be grouped based on its security risk detection status. A portion of the links can be obtained by sampling with different sampling ratios in each group, and security risk detection can be performed on only a portion of the links. This eliminates the need to perform security risk detection on all links every time, thereby achieving a high risk discovery efficiency with a relatively low number of detections.

[0069] In some embodiments, the method further includes: for each of the at least two groups, determining the security risk level of the group based on the security risk detection status of the links in the group, wherein different levels represent different degrees of security risk; the step of obtaining a portion of the links from the at least two groups based on a preset sampling ratio includes: the sampling ratio of the group with high security risk is greater than the sampling ratio of the group with low security risk.

[0070] In this embodiment, the security risk level of each group is determined based on the security risk detection status of the links in each group. The security risk level is used to represent the degree of security risk of the links in each group. In this way, during sampling, the sampling proportion of groups with high security risks is greater than that of groups with low security risks, thereby making it easier to discover potential risks while reducing the overhead of repeated testing.

[0071] In this embodiment, during the sampling process, the security risk level of each link group can be determined based on the security risk detection status. For groups of links with high security risk, a higher sampling ratio is used, making it easier to discover potential risks; for groups of links with low security risk, a lower sampling ratio is used, reducing the overhead of repeated testing. This eliminates the need to perform security risk detection on all links every time, thus achieving high risk discovery efficiency with a relatively low number of detections.

[0072] In some embodiments, the security risk detection status includes one or more of the following: not detected, invalid, valid and risk-free, and valid and risky.

[0073] The links in the first set may include newly added links and historical links. The historical links include the links whose security risk detection status was determined based on the historical security risk detection results, such as the links whose security risk detection status was updated based on the security risk detection results after the last security risk detection.

[0074] Security risk checks on application links are required during the application development and testing phase, the pre-release special testing phase, and the post-launch operation phase. For applications undergoing security risk checks for the first time, all links in the corresponding first set are new links; for applications undergoing security risk checks before, some links in the corresponding first set that have already undergone security risk checks are considered historical links, while others that have not undergone security risk checks are considered new links.

[0075] In some embodiments, the security risk detection status of newly added links includes not detected; the security risk detection status of historical links is determined based on historical security risk detection results, including one of invalid, valid and risk-free, and valid and risky.

[0076] For at least one link in the first set, its security risk detection status can be one or more of the following: not detected, invalid, valid and risk-free, valid and risky. For each link in the first set, its security risk detection status can be one of the following: not detected, invalid, valid and risk-free, valid and risky.

[0077] In this embodiment, an invalid security risk detection status indicates that the link failed the validity test; a valid and risk-free security risk detection status indicates that the link passed the validity test and also passed the access security test and the concept bypass security test; a valid and risky security risk detection status indicates that the link passed the validity test, but failed at least one of the access security test and the concept bypass security test.

[0078] When a new link is obtained, its security risk detection status is set to undetected before it is added to the first set.

[0079] In some embodiments, the security risk detection status of the link is marked by a status flag.

[0080] In this embodiment, the security risk detection status of a link can be marked by a status flag. For example, when status=0, the security risk detection status of the link is determined to be undetected; when status=-1, the security risk detection status of the link is determined to be invalid; when status=1, the security risk detection status of the link is determined to be valid and risk-free; when status=2, the security risk detection status of the link is determined to be valid and risky.

[0081] In this embodiment, when a new link is obtained, its security risk detection status flag is set to status=0; for historical links, its security risk detection status flag is determined based on its previous security risk detection result.

[0082] In some embodiments, the security risk detection status of the link is determined based on the link's status flag.

[0083] In this embodiment, the security risk detection status of a link can be determined by the link's status flag. For example, if the status flag is 0, the security risk detection status of the link is determined to be undetected; if the status flag is -1, the security risk detection status of the link is determined to be invalid; if the status flag is 1, the security risk detection status of the link is determined to be valid and risk-free; if the status flag is 2, the security risk detection status of the link is determined to be valid and risky.

[0084] In some embodiments, obtaining partial links from at least two groups based on a preset sampling ratio includes: the sampling ratio of groups with a security risk detection status of "not detected" is greater than the sampling ratio of groups with a security risk detection status of "invalid," "valid," and "risk-free"; the sampling ratio of groups with a security risk detection status of "valid" and "risky" is greater than the sampling ratio of groups with a security risk detection status of "invalid," "valid," and "risk-free"; and the sampling ratio of groups with a security risk detection status of "invalid" is greater than the sampling ratio of groups with a security risk detection status of "valid" and "risk-free."

[0085] In this embodiment, for links with a security risk detection status of "undetected", their security risk detection status is unknown. Therefore, a higher sampling ratio is needed to avoid potential risks being missed compared to links with security risk detection statuses of "invalid", "valid", and "risk-free". Thus, the sampling ratio of the group of links with a security risk detection status of "undetected" is set to be greater than the sampling ratio of the group of links with any of the security risk detection statuses of "invalid", "valid", and "risk-free".

[0086] For links whose security risk detection status is valid and risky, meaning that there was a risk in the previous security risk detection, the probability of them continuing to pose a security risk or causing new types of risks is relatively high. Therefore, a higher sampling ratio is needed compared to links whose security risk detection status is invalid, valid and risk-free to prevent the recurrence of problems and unknown risks.

[0087] For links with an invalid security risk detection status, there is no security risk, so the sampling ratio is lower than that for links with an undetected, valid, and risky security risk detection status. However, since the invalid status may be reversed, a higher sampling ratio is needed compared to links with a valid and risk-free security risk detection status to avoid the possibility of an invalid status reversal leading to a security risk.

[0088] In this embodiment, different sampling ratios are used in each link group based on the level of security risk. A higher sampling ratio is used in the group with high security risk, while a lower sampling ratio is used in the group with low security risk. This makes it easier to discover potential risks while reducing the overhead of repeated testing.

[0089] In some embodiments, in response to any one of the security risk detection status being undetected, valid, or risky, the sampling rate of the link group is 100%.

[0090] In this embodiment, links with a security risk detection status of "undetected" require 100% full testing to thoroughly verify the security of unknown links and avoid overlooking potential risks. For links with a security risk detection status of "valid but risky," since security risks were discovered in the previous test, 100% full testing is performed each time to focus on monitoring high-risk links, preventing problem reproduction and unknown risks.

[0091] In some embodiments, in response to the security risk detection status being invalid, the sampling ratio of the link group is 15%-25%.

[0092] In this embodiment, for links whose security risk detection status is invalid, 15%-25% are sampled for testing each time, thereby reducing the testing cost of invalid links, while reserving a small number of samples to avoid unknown risks caused by the reversal of invalid status.

[0093] In some embodiments, in response to the security risk detection status being valid and risk-free, the sampling rate of the link group is 5%-15%.

[0094] In this embodiment, for links whose security risk detection status is valid and risk-free, since no risk was found in the previous security risk detection, 5%-15% are sampled for testing each time, thereby reducing the overhead of repeated testing and focusing on high-risk links.

[0095] In some embodiments, in response to the security risk detection status being invalid, the sampling ratio of the link group is 20%; in response to the security risk detection status being valid and risk-free, the sampling ratio of the link group is 10%.

[0096] In some embodiments, such as Figure 3 , Figure 4 As shown, step S107, which involves performing security risk detection on the links in the second set to obtain the corresponding security risk detection results, includes: Step S201: Perform validity checks on the links in the second set, and confirm the security risk detection status of links that fail the validity check as invalid.

[0097] Specifically, step S201, which involves performing validity checks on the links in the second set, includes: Step S301: Determine whether the links in the second set can open the preset whitelist links.

[0098] Step S303: In response to the fact that the link cannot open the whitelisted link, the validity test result of the link is determined to be unsuccessful.

[0099] Step S305: In response to the link being able to open the whitelisted link, the validity check result of the link is determined to be passed.

[0100] In this embodiment, the validity of the links is checked, including determining whether a link can successfully open a whitelisted link. A whitelisted link is a list of explicitly authorized and trusted whitelisted links; that is, whitelisted links are normal and allowed to be accessed. Testing whitelisted links can prevent open redirect vulnerabilities.

[0101] If a link cannot open a whitelisted link, it is highly likely that the link does not pose a security risk. In this case, the security risk detection status of the link can be marked as invalid, i.e., status=-1. If a link can open a whitelisted link, it is valid, but it may or may not pose a security risk, requiring further testing.

[0102] Step S203: Perform a first security check on links that pass the validity check; confirm the security risk status of links that fail the first security check as valid but risky; and confirm the security risk status of links that pass the first security check as valid but risk-free.

[0103] In this embodiment, links that pass the validity test are further subjected to a first security test, and the link is further determined to be risky based on the result of the first security test.

[0104] Step S205: Determine the security risk detection result of the first set based on the security risk detection status of the link.

[0105] In this embodiment, the security risk detection result of the first set is determined based on the security risk detection status of each link obtained in the above steps.

[0106] If the links in the first set are all or part of the links obtained from one application, the security risk detection result of that application can be determined based on the security risk detection result of the first set; if the links in the first set are all or part of the links obtained from multiple applications, the security risk detection result of those multiple applications can be determined based on the security risk detection result of the first set. This embodiment does not limit this.

[0107] In some embodiments, the first security detection includes access security detection and concept bypass security detection; step S203, which confirms the security risk detection status of links that fail the first security detection as valid and risky, and confirms the security risk detection status of links that pass the first security detection as valid and risk-free, includes: confirming the security risk detection status of links that fail either the access security detection or the concept bypass security detection as valid and risky; and confirming the security risk detection status of links that pass both the access security detection and the concept bypass security detection as valid and risk-free.

[0108] In this embodiment, the first security detection includes access security detection and concept bypass security detection.

[0109] Access security checks can include blacklist checks. A blacklist is a list of blocked links from known malicious sources. Blacklist checks determine whether a link on the blacklist is accessible, thus blocking identified malicious sources.

[0110] Proof of Concept case is used to discover and verify vulnerabilities in a link, determining whether there are vulnerabilities that would allow attackers to bypass protections and perform unauthorized operations.

[0111] In this embodiment, if both the access security test and the concept bypass security test pass, it means that the first security test has passed, and the security risk detection status of the link can be confirmed as valid and risk-free; if either the access security test or the concept bypass security test fails, it means that the first security test has failed, and the security risk detection status of the link can be confirmed as valid and risky.

[0112] In some embodiments, in response to the first security detection including access security detection, the security risk detection status of a link that fails the access security detection is confirmed as valid and risky.

[0113] The first security check on the links that pass the validity test in step S203 includes: Step S401: Determine whether the link can access the test object provided by the test service.

[0114] In this embodiment, the Trap Service provides various testing materials and related interfaces, and is responsible for receiving traffic from the security risk detection process to analyze whether corresponding links pose security risks. The Trap Service can provide test targets as a blacklist. These test targets can, for example, be pre-defined malicious websites.

[0115] Step S403: In response to the fact that the link can access the test object provided by the test service and the test service determines that the link has a security risk, the access security test result of the link is determined to be unsuccessful.

[0116] Specifically, determining that the link poses a security risk in step S403 includes: Step S601: Send a first access request to the first interface of the test service based on the link.

[0117] Step S603: Determine whether the first access request contains user data through the test service.

[0118] Step S605: In response to the fact that the first access request contains user data, it is determined that the link poses a data leakage security risk.

[0119] In this embodiment, when the trigger performs a security risk detection on the link, it generates a first access request and sends this request to the first interface of the testing service to request access to the test object provided by the testing service. The testing service receives the first access request through the first interface and determines whether it contains user data such as small text files (cookies), device unique identifiers (DIDs), or user identifiers (UIDs). If the first access request contains such data, it indicates that the first access request may leak user data, thus confirming a data leakage security risk associated with the link.

[0120] In some embodiments, determining that the link poses a security risk in step S403 further includes: Step S601: Send a first access request to the first interface of the test service based on the link.

[0121] Step S607: Receive the test data of the test object returned by the test service, the test data being generated based on the first access request.

[0122] Step S609: The link loads and renders the test object based on the test data of the test object, and generates a second access request to be sent to the second interface of the test service.

[0123] Step S611: The testing service determines, based on the second access request, that the link poses a traffic-driving security risk.

[0124] In this embodiment, when the trigger performs a security risk detection on the link and generates a first access request, it sends the first access request to the first interface of the testing service to request access to the test object provided by the testing service. The testing service provides test materials, such as test data of the test object, to the device performing the link test, such as the device where the trigger is located.

[0125] If the device performing the link test, such as the device where the trigger resides, successfully loads and renders the test data of the test object, it generates a second access request and sends it to the second interface of the test service. This second access request can be a JavaScript request, and the second interface is different from the first interface.

[0126] If the second interface of the test service can receive the second access request, it can be determined that the link has a traffic redirection security risk.

[0127] Step S405: In response to the link being unable to access the test object provided by the test service, determine that the access security test result of the link is passed.

[0128] In this embodiment, for links that pass the validity test, it is further determined whether the link can directly access the test objects in the blacklist provided by the test service, that is, whether the link will be blocked when requesting to open a link in the blacklist.

[0129] Specifically, the system attempts to directly access the test service's interface (Trap Service API, where the Trap Service's domain name is not in the whitelist) through the key parameters of the link. If the access is not blocked, meaning the link can directly access the test object provided by the test service, and the test service successfully receives the request and confirms that there is a security risk, then the security check result of the link is failed, and the security risk check status of the link is marked as valid and risky, i.e., status=2.

[0130] If access is blocked, meaning the link cannot directly access the test object provided by the testing service, and the testing service cannot successfully receive the request, then the link's access security check result is passed. However, it may or may not have other security risks, requiring further testing.

[0131] In some embodiments, in response to the first security detection including concept bypass security detection, the security risk detection status of links that fail the concept bypass security detection is confirmed as valid and risky, and the security risk detection status of links that pass the concept bypass security detection is confirmed as valid and risk-free.

[0132] The first security check performed on the links that have passed the access security check in step S205 includes: Step S501: Determine whether the link can bypass the preset access control and security checks to access the test object provided by the test service.

[0133] Step S503: In response to the fact that the link can bypass the preset access control and security check to access the test object provided by the test service and the test service determines that the link has a security risk, the result of the link's concept bypassing the security check is determined to be a failure.

[0134] Specifically, determining that the link poses a security risk in step S503 includes: Step S701: Send a first access request to the first interface of the test service based on the link.

[0135] Step S703: Determine whether the first access request contains user data through the test service.

[0136] Step S705: In response to the fact that the first access request contains user data, it is determined that the link poses a data leakage security risk.

[0137] In this embodiment, when the trigger performs a security risk detection on the link, it generates a first access request and sends this first access request to the first interface of the testing service to request access to the test object provided by the testing service. The testing service receives the first access request through the first interface and determines whether the first access request contains user data such as small text files (cookies), device unique identifiers (DIDs), or user identifiers (UIDs). If the first access request carries the aforementioned data, it indicates that the first access request may leak user data, and therefore the link is flagged as having a data leakage security risk.

[0138] In some embodiments, determining that the link poses a security risk in step S503 further includes: Step S701: Send a first access request to the first interface of the test service based on the link.

[0139] Step S707: Receive test data of the test object returned by the test service, the test data being generated based on the first access request.

[0140] Step S709: The link loads and renders the test object based on the test data of the test object, and generates a second access request to be sent to the second interface of the test service.

[0141] Step S711: The testing service determines, based on the second access request, that the link has a traffic-driving security risk.

[0142] In this embodiment, when the trigger performs a security risk detection on the link and generates a first access request, it sends the first access request to the first interface of the test service to request access to the test object provided by the test service. The test service provides test materials, such as test data of the test object, to the device performing the link test, such as the device where the trigger is located.

[0143] If the device performing the link test, such as the device where the trigger resides, successfully loads and renders the test data of the test object, it generates a second access request and sends it to the second interface of the test service. This second access request can be a JavaScript request, and the second interface is different from the first interface.

[0144] If the second interface of the test service can receive the second access request, it can be determined that the link has a traffic redirection security risk.

[0145] Step S505: In response to the fact that the link cannot bypass the preset access control and security check to access the test object provided by the test service, the result of the link's concept bypassing the security check is determined to be passed.

[0146] In this embodiment, for links that pass the access security check, a concept bypass security check is performed, that is, it is determined whether the link can bypass the preset access control and security check to access the test object provided by the test service, that is, it is determined whether the link can bypass the preset security verification mechanism.

[0147] If the bypass is successful, the link concept bypass security check result is "failed," and the link's security risk check status is marked as "valid and risky," i.e., status=2. If the bypass is unsuccessful, the test stops after all bypass checks have been completed, and the link concept bypass security check result is determined to be "passed," and the link's security risk check status is marked as "valid and risk-free," i.e., status=1.

[0148] In this embodiment, since the security risk detection status of each link has been marked by a status flag, the next security risk detection can be performed based on the status flag of the current security risk detection status. Thus, through continuous iterative optimization, a high risk discovery efficiency can be achieved with a relatively low number of fuzz tests.

[0149] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0150] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0151] Based on the same inventive concept, corresponding to any of the above-described embodiments, this disclosure also provides a link security risk detection device.

[0152] refer to Figure 5 The security risk detection device for the link includes: The acquisition module 11 is configured to: acquire a first set of links, wherein the first set includes at least one link; Grouping module 13 is configured to: group the links in the first set according to the security risk detection status of each link in the first set to obtain at least two groups; Sampling module 15 is configured to: obtain partial links from at least two of the groups based on a preset sampling ratio to obtain a second set; The detection module 17 is configured to: perform security risk detection on the links in the second set and obtain the corresponding security risk detection results; The update module 19 is configured to update the security risk detection status of the links in the first set based on the security risk detection results.

[0153] In some embodiments, the method further includes: For each of the at least two groups, the security risk level of the group is determined based on the security risk detection status of the links in the group, with different levels representing different degrees of security risk; The step of obtaining partial links from at least two groups based on a preset sampling ratio includes: the sampling ratio of the group with high security risk is greater than the sampling ratio of the group with low security risk.

[0154] In some embodiments, the security risk detection status includes one or more of the following: not detected, invalid, valid and risk-free, and valid and risky.

[0155] In some embodiments, the sampling module 15 is further configured to: The sampling proportion of the group whose security risk detection status is not detected is greater than the sampling proportion of the group whose security risk detection status is invalid, valid, or risk-free. The sampling proportion of the group whose security risk detection status is valid and at risk is greater than the sampling proportion of the group whose security risk detection status is invalid, valid and at no risk. The sampling proportion of groups whose security risk detection status is invalid is greater than the sampling proportion of groups whose security risk detection status is valid and risk-free.

[0156] In some embodiments, the detection module 17 is further configured to: Perform validity checks on the links in the second set, and confirm the security risk detection status of links that fail the validity check as invalid. Links that pass the validity test are subjected to a first security test. Links that fail the first security test are confirmed as having a security risk but are also considered to be valid and risky. Links that pass the first security test are confirmed as having a security risk but are also considered to be valid and risk-free. The security risk test results of the first set are determined based on the security risk test status of the links in the second set.

[0157] In some embodiments, the validity check of the links in the second set includes: Determine whether the links in the second set can open the preset whitelist links; In response to the fact that the link cannot open the whitelisted link, the validity check result of the link is determined to be unsuccessful; In response to the link being able to open the whitelisted link, the validity check result of the link is determined to be passed.

[0158] In some embodiments, the first security detection includes access security detection and concept bypass security detection; the step of confirming the security risk detection status of links that fail the first security detection as valid and risky, and confirming the security risk detection status of links that pass the first security detection as valid and risk-free, includes: The security risk detection status of a link that fails either the access security detection or the concept bypass security detection is confirmed as valid and risky; The security risk detection status of a link that passes both the access security detection and the concept bypass security detection is confirmed as valid and risk-free.

[0159] In some embodiments, in response to the first security check including access security check, the first security check on the link that passes the validity check includes: Determine whether the link can access the test object provided by the test service; If the link can access the test object provided by the test service and the test service determines that the link has a security risk, the access security test result of the link is determined to be failed. In response to the link being unable to access the test object provided by the test service, the access security test result of the link is determined to be passed.

[0160] In some embodiments, the response to the first security detection includes a concept bypass security detection, and the first security detection is performed on links that pass the validity detection, including: Determine whether the link can bypass preset access controls and security checks to access the test object provided by the test service; If the link can bypass preset access control and security checks to access the test object provided by the test service, and the test service determines that the link has a security risk, the result of the link bypassing the security check is determined to be a failure. In response to the fact that the link cannot bypass the preset access control and security checks to access the test object provided by the test service, the result of the link's concept of bypassing the security detection is determined to be passed.

[0161] In some embodiments, determining that the link poses a security risk includes: A first access request is sent to the first interface of the test service based on the link; The test service determines whether the first access request contains user data. In response to the fact that the first access request contains user data, it is determined that the link poses a data leakage security risk.

[0162] In some embodiments, determining that the link poses a security risk further includes: Receive test data of the test object returned by the test service, the test data being based on the first access request; The link loads and renders the test object based on the test data, generates a second access request and sends it to the second interface of the test service, so that the test service determines that the link has a traffic redirection security risk based on the second access request.

[0163] In some embodiments, the device is further configured to: The security risk detection status of the link is marked by a status flag; and, The security risk detection status of the link is determined based on the status flag of the link.

[0164] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0165] The apparatus described above is used to implement the security risk detection method for the corresponding link in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0166] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the link security risk detection method described in any of the above embodiments.

[0167] Figure 6 This embodiment illustrates a more specific hardware structure of an electronic device. The device may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0168] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0169] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0170] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0171] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0172] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0173] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0174] The electronic devices described above are used to implement the security risk detection method for the corresponding links in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0175] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the link security risk detection method as described in any of the above embodiments.

[0176] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0177] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the security risk detection method for links as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0178] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a computer program product, which includes a computer program. In some embodiments, the computer program is executable by one or more processors to cause the processors to perform the security risk detection method for the linked data. Corresponding to the execution entity for each step in each embodiment of the method, the processor executing the corresponding step may belong to the corresponding execution entity.

[0179] The computer program product of the above embodiments is used to cause the processor to execute the security risk detection method of the link as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0180] Those skilled in the art will recognize that embodiments of this disclosure can be implemented as a system, method, or computer program product. Therefore, this disclosure can be implemented as entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this disclosure can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0181] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (not exhaustive) of a computer-readable storage medium may include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0182] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0183] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0184] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0185] It should be understood that each block of a flowchart and / or block diagram, as well as combinations of blocks in a flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine that, when executed by a computer or other programmable data processing device, creates means for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0186] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce a product comprising an instruction apparatus that implements the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0187] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, such that the instructions that execute on the computer or other programmable apparatus can provide a process for implementing the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0188] Furthermore, although the operations of the methods of this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Rather, the steps depicted in the flowcharts may be executed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0189] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0190] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0191] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0192] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0193] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0194] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for detecting security risks in links, comprising: Obtain a first set of links, wherein the first set includes at least one link; Based on the security risk detection status of each link in the first set, the links in the first set are grouped to obtain at least two groups; Based on a preset sampling ratio, partial links are obtained from at least two of the groups to obtain a second set; Security risk detection is performed on the links in the second set to obtain the corresponding security risk detection results; The security risk detection status of the links in the first set is updated based on the security risk detection results.

2. The method according to claim 1, further comprising: For each of the at least two groups, the security risk level of the group is determined based on the security risk detection status of the links in the group, with different levels representing different degrees of security risk; The step of obtaining partial links from at least two groups based on a preset sampling ratio includes: the sampling ratio of the group with high security risk is greater than the sampling ratio of the group with low security risk.

3. The method according to claim 1, wherein, The security risk detection status includes one or more of the following: not detected, invalid, valid and risk-free, and valid and risky.

4. The method according to claim 3, wherein obtaining partial links from at least two groups based on a preset sampling ratio comprises: The sampling proportion of the group whose security risk detection status is not detected is greater than the sampling proportion of the group whose security risk detection status is invalid, valid, or risk-free. The sampling proportion of the group whose security risk detection status is valid and at risk is greater than the sampling proportion of the group whose security risk detection status is invalid, valid and at no risk. The sampling proportion of groups whose security risk detection status is invalid is greater than the sampling proportion of groups whose security risk detection status is valid and risk-free.

5. The method according to claim 3, wherein, The security risk detection of links in the second set, and the corresponding security risk detection results, include: Perform validity checks on the links in the second set, and confirm the security risk detection status of links that fail the validity check as invalid. Links that pass the validity test are subjected to a first security test. Links that fail the first security test are confirmed as valid but risky. Links that pass the first security test are confirmed as valid but risk-free. The security risk detection result of the first set is determined based on the security risk detection status of the links in the second set.

6. The method according to claim 5, wherein, The validity check of the links in the second set includes: Determine whether the links in the second set can open the preset whitelist links; In response to the fact that the link cannot open the whitelisted link, the validity check result of the link is determined to be unsuccessful; In response to the link being able to open the whitelisted link, the validity check result of the link is determined to be passed.

7. The method according to claim 5, wherein, The first security check includes access security check and concept bypass security check; the step of confirming the security risk status of links that fail the first security check as valid and risky, and confirming the security risk status of links that pass the first security check as valid and risk-free, includes: The security risk detection status of a link that fails either the access security detection or the concept bypass security detection is confirmed as valid and risky; The security risk detection status of a link that passes both the access security detection and the concept bypass security detection is confirmed as valid and risk-free.

8. The method according to claim 7, wherein, In response to the first security check including access security check, the first security check on the link that passes the validity check includes: Determine if the link can access the test object provided by the test service; If the link is able to access the test object provided by the test service and the test service determines that the link has a security risk, the access security test result of the link is determined to be failed. In response to the link being unable to access the test object provided by the test service, the access security test result of the link is determined to be passed.

9. The method according to claim 7, wherein, In response to the first security check including the concept of bypassing security check, the first security check on the link that passes the validity check includes: Determine whether a link can bypass preset access controls and security checks to access the test object provided by the testing service; If a link can bypass preset access controls and security checks to access the test object provided by the test service, and the test service determines that the link has a security risk, the result of the link bypassing the security check is deemed as failing. If a link cannot bypass preset access controls and security checks to access the test object provided by the test service, the result of determining that the link bypasses security checks is considered successful.

10. The method according to claim 8 or 9, wherein, The determination that the link poses a security risk includes: A first access request is sent to the first interface of the test service based on the link; The test service determines whether the first access request contains user data. In response to the fact that the first access request contains user data, it is determined that the link poses a data leakage security risk.

11. The method according to claim 10, wherein, The determination that the link poses a security risk also includes: Receive test data of the test object returned by the test service, the test data being generated based on the first access request; The link loads and renders the test object based on the test data, generates a second access request and sends it to the second interface of the test service, so that the test service determines that the link has a traffic redirection security risk based on the second access request.

12. The method according to any one of claims 1-9, further comprising: The security risk detection status of the link is marked by a status flag; as well as, The security risk detection status of the link is determined based on the status flag of the link.

13. A security risk detection device for links, comprising: The acquisition module is configured to: acquire a first set of links, the first set including at least one link; The grouping module is configured to group the links in the first set according to the security risk detection status of each link in the first set to obtain at least two groups; The sampling module is configured to: obtain partial links from at least two of the groups based on a preset sampling ratio to obtain a second set; The detection module is configured to perform security risk detection on the links in the second set and obtain the corresponding security risk detection results; The update module is configured to update the security risk detection status of links in the first set based on the security risk detection results.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the link security risk detection method as described in any one of claims 1 to 12.

15. A non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the link security risk detection method according to any one of claims 1 to 12.

16. A computer program product, characterized in that, It includes computer program instructions that, when executed on a computer, cause the computer to perform the link security risk detection method as described in any one of claims 1 to 12.

Images