Webpage tamper-proofing method and device

Abstract

The invention provides a webpage tamper-proofing method and device, and the method comprises the steps: constructing a user request session information base and a white list information base, and building a mapping relation between the two information bases; generating a static page according to the webpage snapshot stored in the user request session information base, returning the static page to the client, and obtaining an operation request of the user; performing security verification according to the white list information base, the user request session information base and the mapping relation; if the operation request passes the security verification, mapping the operation request into an operation instruction for an original website corresponding to the webpage snapshot, and feeding back the operation instruction to the original website to obtain response data; and generating a new static page according to the response data, and returning the new static page to the client. In conclusion, the technical problems that in the prior art, timeliness is insufficient in the aspect of webpage tampering prevention, and an attack path cannot be effectively shielded are solved, and the real-time performance and reliability of webpage tampering prevention are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for preventing webpage tampering. Background Technology

[0002] With the rapid development of the internet, the Web (World Wide Web) has become an indispensable part of modern society, providing services, information, and communication. According to statistics from Netcraft in April 2023, the number of active websites worldwide reached 1.115 billion. However, along with the surge in the number of websites, security issues such as cyberattacks and data breaches have become increasingly serious, posing significant challenges to websites. The ever-increasing scale and complexity of websites have made website security a global issue, urgently requiring joint efforts from all parties to strengthen security measures and protect user information security.

[0003] Website tampering refers to the malicious modification of website content. Attackers use various methods to tamper with web pages in order to steal user information, spread malware, or carry out phishing attacks. Common tampering methods include exploiting vulnerabilities, injecting malicious scripts, and drive-by downloads. These attacks can not only lead to the leakage of users' personal information and the infection of computer systems by viruses, but also damage the brand image and reputation of businesses and government agencies.

[0004] While traditional website anti-tampering technologies primarily rely on monitoring website status, promptly fixing tampered content, and notifying administrators, this approach, which focuses on website monitoring and recovery, suffers from several significant drawbacks: Firstly, the timeliness of website recovery is insufficient; before tampering is detected and repaired, website users may have already accessed the modified page, posing a potential risk to their interests. Secondly, traditional technologies cannot effectively block attackers from exploiting website program vulnerabilities to tamper with files, nor can they completely isolate high-risk operations by users or hackers. Therefore, existing technologies have not completely solved the problem of website anti-tampering. Furthermore, while current content security detection and application detection products provide security detection for text, images, audio, video, and websites through SaaS (Software as a Service) applications to prevent violations, they also suffer from insufficient real-time monitoring capabilities and timeliness issues.

[0005] Therefore, existing technologies have technical problems in preventing webpage tampering, such as insufficient timeliness and inability to effectively block attack paths. Summary of the Invention

[0006] This application provides a method and apparatus for preventing webpage tampering, in order to solve the technical problems of insufficient timeliness and inability to effectively block attack paths in the prior art in terms of webpage tampering prevention.

[0007] To solve the above-mentioned technical problems, this application is implemented as follows:

[0008] In a first aspect, embodiments of this application provide a method for preventing webpage tampering, the method comprising:

[0009] Construct a user request session information database and a whitelist information database, and establish a mapping relationship between the user request session information database and the whitelist information database;

[0010] A static page is generated based on the webpage snapshots stored in the user request session information database, and the static page is returned to the client to obtain the user's operation request for the static page from the client.

[0011] The operation request is security verified based on the whitelist information database, the user request session information database, and the mapping relationship.

[0012] If the operation request passes the security verification, the operation request is mapped to an operation instruction on the original website corresponding to the webpage snapshot, and the operation instruction is fed back to the original website to obtain response data;

[0013] A new static page is generated based on the response data, and the new static page is returned to the client.

[0014] Optionally, after performing security verification on the operation request based on the whitelist information database, the user request session information database, and the mapping relationship, the method further includes:

[0015] If the operation request fails the security verification, the operation request is intercepted, the user's access to the original website is denied, and feedback information is generated and returned to the client, wherein the feedback information carries the reason for denying the user's access to the original website.

[0016] Optionally, the user request session information database includes at least one of the following: the user's browser information, the user's session identifier, a high-alert word recognition database, the webpage snapshot, and the reference coordinate point information on the webpage snapshot;

[0017] The whitelist database includes: the user's session identifier, the user's Internet Protocol IP address, trusted browser identifier, and trusted browser account;

[0018] The construction process of the high-alert vocabulary recognition database is as follows: acquiring historical webpage tampering behavior data; extracting text information from the historical webpage tampering data; based on the text information, using the term frequency-inverse document frequency (TF-IDF) algorithm to count key feature words in the text information; based on the key feature words, constructing an initial high-alert vocabulary recognition database; and matching new behavioral data on the Internet with the initial high-alert vocabulary recognition database based on Jaccard similarity calculation; and updating the initial high-alert vocabulary recognition database according to the matching results.

[0019] Optionally, a static page is generated based on the webpage snapshot stored in the user request session information database, and the static page is returned to the client. Obtaining the user's operation request for the static page from the client includes:

[0020] The webpage snapshot is obtained from the user request session information database, and the webpage snapshot is embedded in a preset HTML page frame to generate the static page;

[0021] The static page is returned to the client, and the user's operation request is detected in the static page using JavaScript technology.

[0022] When the operation request is detected, the coordinates of the click location of the operation request are obtained through JavaScript technology, and the operation request containing the coordinates, the user's session identifier, and the request content is obtained through AJAX technology.

[0023] Optionally, the security verification of the operation request based on the whitelist information database, the user request session information database, and the mapping relationship includes:

[0024] Verify whether the operation request content is in the high-alert word recognition database. If not, the verification passes. Continue to verify whether the IP address, browser identifier, and browser account of the user corresponding to the session identifier exist in the whitelist information database. If they do, the verification passes. Continue to determine whether the coordinate point is consistent with the reference coordinate point information in the user request session information database. If they are consistent, the operation request passes the security verification.

[0025] Optionally, generating a new static page based on the response data and returning the new static page to the client includes:

[0026] The response data is rendered using headless browser technology to generate a new webpage snapshot;

[0027] The new webpage snapshot is encapsulated in a preset HTML page framework to generate a new static page, and the new static page is returned to the client. The new static page integrates JavaScript technology and AJAX interaction logic.

[0028] Optionally, after generating a new static page based on the response data, the method further includes:

[0029] Generate a new webpage snapshot based on the new static page;

[0030] Analyze the DOM structure of the new webpage snapshot, extract the coordinate information of all interactive elements in the new static page based on the DOM structure, and generate a new list of coordinate values ​​based on the coordinate information;

[0031] The new webpage snapshot and the new list of coordinate values ​​are stored in the user request session information database.

[0032] Secondly, embodiments of this application provide a webpage anti-tampering device, the device comprising:

[0033] The construction module is used to construct a user request session information database and a whitelist information database, and to establish a mapping relationship between the user request session information database and the whitelist information database;

[0034] The execution module is used to generate a static page based on the webpage snapshots stored in the user request session information database, return the static page to the client, and obtain the user's operation request for the static page from the client.

[0035] The operation request is security verified based on the whitelist information database, the user request session information database, and the mapping relationship.

[0036] If the operation request passes the security verification, the operation request is mapped to an operation instruction on the original website corresponding to the webpage snapshot, and the operation instruction is fed back to the original website to obtain response data;

[0037] A new static page is generated based on the response data, and the new static page is returned to the client.

[0038] Thirdly, embodiments of this application provide a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the webpage anti-tampering method as described in the first aspect.

[0039] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the webpage anti-tampering method described in the first aspect.

[0040] Fifthly, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the webpage anti-tampering method as described in the first aspect.

[0041] In this embodiment, by constructing a user request session information database and a whitelist information database and establishing a mapping relationship between them, the foundation for access control is laid for subsequent security verification. Then, by generating static pages based on webpage snapshots and returning them to the client, all user interactions are isolated from the original website, fundamentally cutting off the path for attackers to directly exploit website vulnerabilities for tampering through the client. Subsequently, user operation requests are securely verified based on the whitelist, session information database, and mapping relationship, ensuring that only legitimate operations that have undergone strict authentication are allowed, effectively shielding high-risk operations. For verified requests, they are mapped to operation instructions on the original website, response data is obtained, and a new static page is dynamically generated and returned to the client. This not only ensures the normal interaction of website functions but also ensures that the end user always sees controllable static content, rather than the dynamic output of the original website, thus achieving proactive protection. In summary, this overcomes the technical problems of insufficient timeliness and inability to effectively block attack paths in existing technologies for webpage anti-tampering, significantly improving the real-time performance and reliability of webpage anti-tampering. Attached Figure Description

[0042] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0043] Figure 1 A flowchart illustrating a method for preventing webpage tampering provided in this application embodiment;

[0044] Figure 2 A structural block diagram of a webpage anti-tampering system provided in this application embodiment;

[0045] Figure 3 A structural block diagram of a webpage anti-tampering device provided in an embodiment of this application;

[0046] Figure 4 This is a structural block diagram of a network device provided in an embodiment of this application. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] Figure 1 This application illustrates a method for preventing webpage tampering according to an embodiment of the present application, such as... Figure 1 As shown, the method includes:

[0049] Step S101: Construct a user request session information database and a whitelist information database, and establish a mapping relationship between the user request session information database and the whitelist information database;

[0050] Step S102: Generate a static page based on the webpage snapshot stored in the user request session information database, return the static page to the client, and obtain the user's operation request for the static page from the client.

[0051] Step S103: Perform security verification on the operation request based on the whitelist information database, the user request session information database, and the mapping relationship;

[0052] Step S104: If the operation request passes the security verification, the operation request is mapped to an operation instruction on the original website corresponding to the webpage snapshot, and the operation instruction is fed back to the original website to obtain response data;

[0053] Step S105: Generate a new static page based on the response data and return the new static page to the client.

[0054] It should be noted that the method provided in this application constructs a security proxy layer between the client and the original website. Its core operating mechanism is as follows: First, by constructing a user request session information database and a whitelist information database and establishing a mapping relationship between the two, the foundation for the entire security verification system is laid. Based on this, the system does not directly expose the original website to the user. Instead, it retrieves a pre-stored webpage snapshot from the user request session information database to generate a static page and returns it to the client, ensuring that all subsequent user interactions are initiated based on this static interface. When a user's operation request for this static page is received from the client, the system performs multi-layered security verification on the operation request based on the constructed whitelist information database, user request session information database, and the mapping relationship between the two. This verification process covers user identity, operation content, and behavioral logic. If the operation request passes the security verification, it is accurately mapped to a secure operation instruction for the original website corresponding to the webpage snapshot, and this operation instruction is fed back to the original website to obtain the actual response data. Finally, the system generates a new static page based on this response data and returns it to the client, thus completing a secure interaction loop.

[0055] Therefore, by combining static isolation with in-process verification, it is ensured that users always interact with a controlled and secure copy of the static page, while all access to the original website is strictly filtered by the proxy layer. This fundamentally cuts off the path for attackers to directly tamper with web page content or exploit website vulnerabilities for high-risk operations, realizing a shift from passive repair to proactive prevention and significantly improving the real-time performance and reliability of web page anti-tampering.

[0056] In one possible implementation, the user request session information database includes at least one of the following: the user's browser information, the user's session identifier, a high-alert vocabulary recognition database, a webpage snapshot, and the reference coordinate point information on the webpage snapshot; the whitelist information database includes: the user's session identifier, IP (Internet Protocol) address, trusted browser identifier, and trusted browser account; wherein, the construction process of the high-alert vocabulary recognition database is as follows: acquiring historical webpage tampering behavior data; extracting text information from the historical webpage tampering data; based on the text information, using the TF-IDF (Term Frequency - Inverse Document Frequency) algorithm to count key feature words in the text information; based on the key feature words, constructing an initial high-alert vocabulary recognition database; and matching new behavioral data on the Internet with the initial high-alert vocabulary recognition database based on Jaccard similarity calculation; and updating the initial high-alert vocabulary recognition database according to the matching results.

[0057] It should be noted that the embodiments of this application further clarify the specific contents of the user request session information database and the whitelist information database that constitute the basic data of the entire security system. The user request session information database, as a comprehensive data pool, contains key information used to comprehensively characterize user context and page state, such as the user's browser information, a session identifier used to uniquely identify a user's interaction process, a high-alert vocabulary recognition database as the core filtering rule, webpage snapshots representing static versions of the page, and reference coordinate point information on the webpage snapshots that define the legally interactive areas on the page.

[0058] Correspondingly, the whitelist database focuses on trusted authentication of identity and device. Its content includes the user's session identifier, IP address, trusted browser identifier, and trusted browser account associated with the user request session information database, thereby constructing a list of trusted access sources.

[0059] Furthermore, the solution details the construction process of the high-alert vocabulary recognition database, the core of dynamic defense. Specifically, the system first acquires historical webpage tampering behavior data as a learning foundation, then extracts text information from this historical data, and performs quantitative analysis based on the text information using the TF-IDF algorithm to statistically analyze and filter out key feature words that can significantly represent malicious intent. These key feature words are then used to construct the initial high-alert vocabulary recognition database. In order to enable the database to continuously resist new attacks, the system also introduces a matching mechanism based on Jaccard similarity calculation. By continuously calculating the similarity between new behavioral data on the Internet and the words in the initial database, the initial high-alert vocabulary recognition database is dynamically updated and expanded according to the matching results.

[0060] This transforms the user request session information database and whitelist information database from static, simple lists into a multi-dimensional verification system with rich layers and a dynamic, static approach. This provides precise data support and flexible rule-based judgment criteria for subsequent operation request security verification. In particular, the scientific construction and self-updating mechanism of the high-alert word recognition database greatly enhances the ability to identify covert attack intentions and the adaptive defense level against unknown threats, thus laying a solid foundation for the efficient and intelligent operation of the entire webpage anti-tampering method.

[0061] In one possible implementation, after performing security verification on the operation request based on the whitelist information database, the user request session information database, and the mapping relationship, the method further includes: if the operation request fails the security verification, the operation request is intercepted, the user's access to the original website is denied, and feedback information is generated and returned to the client, wherein the feedback information carries the reason for denying the user's access to the original website.

[0062] It should be noted that the method provided in this application, after performing security verification on the operation request based on the whitelist information database, the user request session information database, and the mapping relationship, also includes a security closed-loop processing mechanism: that is, when the operation request fails the aforementioned strict security verification, the system will immediately initiate an interception process. Specifically, the system will intercept the operation request that fails verification and thereby refuse any attempt by the user to access the original website. At the same time, in order to ensure the transparency of the interaction and provide clear guidance to the user, the system will synchronously generate detailed feedback information and return it to the client.

[0063] This feedback message will clearly state the specific reason for denying the user access to the original website. For example, the user's IP address may not be on the whitelist, the operation request may have triggered an alert in the high-alert word recognition database, or the coordinates of the operation may not match the baseline information.

[0064] This not only enables real-time and effective blocking of illegal or suspicious requests, preventing any unverified operation instructions from being mapped and fed back to the original website, thus completely eliminating the possibility of them posing a threat to website security at the source; but also enhances the interpretability and user experience of the system by providing feedback information with the reason for the denial to the client, enabling users or administrators to clearly understand the root cause of the access denial, which helps in subsequent problem investigation or security policy adjustment, thereby improving the defense depth and intelligent management level of the entire webpage anti-tampering system.

[0065] In one possible implementation, a static page is generated based on webpage snapshots stored in the user request session information database, and the static page is returned to the client. The user's operation requests for the static page from the client include:

[0066] The system retrieves a webpage snapshot from the user request session information database, embeds the webpage snapshot into a preset HTML page framework to generate a static page, returns the static page to the client, and uses JavaScript to detect the user's operation request within the static page. When an operation request is detected, the system uses JavaScript to obtain the coordinates of the click location of the operation request, and uses AJAX to obtain the operation request containing the coordinates, the user's session identifier, and the request content.

[0067] It should be noted that this application embodiment specifically describes the initial steps for secure user interaction with the original website. This process begins by retrieving a pre-stored webpage snapshot from the user request session information database. This snapshot, as a static copy of the original website content, is embedded in a preset HTML page frame to assemble the final static page. After returning this static page to the client, the system does not passively wait but actively monitors all user interactions using JavaScript technology integrated into the static page to detect user operation requests. Once an operation request is detected, the system immediately uses JavaScript technology to accurately capture the coordinates of the click location on the screen. Then, using AJAX technology, it encapsulates three key pieces of information—the coordinates involved in the operation, the user's session identifier (identifying the current session state), and the request content itself—into a complete data packet. This results in a clearly structured and complete user operation request from the client for the static page, providing accurate input data for subsequent deep security verification.

[0068] It should also be noted that JavaScript technology refers to a scripting language embedded in static web pages and executed by the client's browser. Its core function is to enable static pages to be interactive, dynamically monitor, respond to, and process various user operation events (such as clicks), and obtain specific data related to the operation (such as the coordinates of the click location).

[0069] AJAX technology refers to a set of web development technologies used to create fast, dynamic web applications. Its core mechanism allows web pages to exchange data asynchronously with the server in the background via client-side scripts without reloading the entire page. In this embodiment, it is specifically used to send captured user operation request data (coordinates, session identifiers, etc.) to the backend server for processing.

[0070] Therefore, by presenting dynamic content in a static form and using front-end technology for refined interaction capture, a security isolation layer is cleverly established between the user and the original website. This not only ensures that the page content the user initially encounters is an immutable static copy, but more importantly, it transforms the user's complex interface operations into a standardized data request containing precise contextual information (coordinates, session identifier, and request content) that can be rigorously reviewed by the back-end system. This lays a solid data foundation for subsequent multi-layered security verification based on whitelist information databases, user request session information databases, and mapping relationships.

[0071] In one possible implementation, the security verification of the operation request based on the whitelist information database, the user request session information database, and the mapping relationship includes: verifying whether the content of the operation request is in the high-alert word recognition database; if not, the verification passes; and then, based on the whitelist information database, verifying whether the IP address, browser identifier, and browser account of the user corresponding to the session identifier exist in the whitelist information database; if so, the verification passes; and then determining whether the coordinate point is consistent with the reference coordinate point information in the user request session information database; if they are consistent, the operation request passes the security verification.

[0072] It should be noted that this application embodiment details the specific logical process for security verification of operation requests based on the whitelist information database, the user request session information database, and the mapping relationship. First, the system verifies whether the request content of the operation request appears in the high-alert word recognition database within the user request session information database. This step focuses on identifying whether the request itself contains known malicious instructions or sensitive words. If the request content does not trigger an alarm in the high-alert word recognition database, the verification passes. The system then proceeds to the next layer of verification, namely, based on the whitelist information database, it verifies whether the key identity and device credentials—the user's IP address, trusted browser identifier, and trusted browser account—corresponding to the session identifier carried by the current operation request are completely present in the whitelist information database. This aims to confirm the legitimacy of the access source. Only when this condition is met, i.e., after verification passes, will the system proceed to coordinate point verification. Coordinate point verification determines whether the coordinate points captured in the operation request are consistent with the reference coordinate point information pre-stored for the current webpage snapshot in the user request session information database. Only when the consistency of the coordinate points is also confirmed will the system ultimately determine that the operation request has passed all security verifications.

[0073] This constructs a multi-dimensional, in-depth defense system encompassing visitor identity, access device, operational intent, and the operational behavior itself. It ensures that only operational requests with credible sources, harmless content, and compliant behavior are allowed to proceed, thereby greatly enhancing system security and effectively resisting various potential attack methods, including identity forgery, malicious command injection, and unexpected operation simulation. This provides a solid foundation for subsequently mapping operational requests into secure operational instructions for the original website.

[0074] In one possible implementation, generating a new static page based on the response data and returning the new static page to the client includes: rendering the response data using headless browser technology to generate a new webpage snapshot; encapsulating the new webpage snapshot into a preset HTML page framework to generate a new static page, and returning the new static page to the client, wherein the new static page integrates JavaScript technology and AJAX interaction logic.

[0075] It should be noted that this application embodiment specifically describes the key process of how to securely generate the next interactive interface after the operation request passes security verification and successfully obtains response data from the original website. Specifically, the system first uses headless browser technology to fully render the response data returned by the original website. This step can simulate the behavior of a real browser, ensuring that dynamic content is correctly executed and displayed, thereby generating a completely static new webpage snapshot with defined content. Thus, the dynamic risk elements that the original website may contain can be effectively transformed into a clean static view. Secondly, the system encapsulates this newly generated webpage snapshot into a preset HTML page framework, assembles it into a new static page, and returns this new static page to the client, thereby completing a complete interaction loop.

[0076] Furthermore, the new static page generated and returned to the client during this process is not a simple read-only page. It will have JavaScript technology and AJAX interaction logic pre-integrated, meaning that the page already has the same security detection and communication capabilities as before.

[0077] This not only ensures that the page content received by the user each time is a clean and unmodified static snapshot rendered by headless browser technology, fundamentally eliminating the possibility of malicious code being directly transmitted to the client, but also prepares a complete interactive environment for the secure capture and verification of the next user operation by reintegrating JavaScript technology and AJAX interaction logic into the new static page. This allows the entire security proxy mechanism to form a sustainable and closed loop, thereby achieving continuity of secure interaction between the user and the original website. It ensures that anti-tampering protection of web pages runs through the entire user session, forming a dynamic and continuously effective proactive defense system.

[0078] In one possible implementation, after generating a new static page based on the response data, the method further includes: generating a new webpage snapshot based on the new static page; analyzing the DOM structure of the new webpage snapshot, extracting the coordinate information of all interactive elements in the new static page based on the DOM structure, generating a new list of coordinate values ​​based on the coordinate information; and storing the new webpage snapshot and the new list of coordinate values ​​in the user request session information database.

[0079] It should be noted that this application further defines the key self-update and maintenance process executed by the system after generating a new static page based on the response data. This process begins by generating a new webpage snapshot based on the newly generated static page. This aims to capture the most accurate visual and structural state of the current page. Subsequently, the system will deeply analyze the DOM (Document Object Model) structure of this new webpage snapshot. By parsing the DOM structure, all interactive interface elements in the page can be accurately identified, and the precise coordinate information corresponding to these interactive elements in the current static page can be extracted based on the layout information provided by the DOM structure. After successfully extracting the coordinate information, the system will organize and generate a brand-new list of coordinate values ​​that perfectly matches the current page state. This list clarifies the specific screen locations where all legal operations can occur. Finally, the system stores this newly generated webpage snapshot and the corresponding new list of coordinate values ​​together in the user request session information database, overwriting or updating the original related data.

[0080] This ensures that the baseline data (especially the baseline coordinate point information) used for security verification in the user request session information database is always synchronized with the latest version of the original website, thereby effectively avoiding the problem of coordinate verification failure or false blocking caused by website content updates. This greatly improves the accuracy and robustness of the security verification mechanism and ensures that the entire protection system can play a continuous and stable role.

[0081] In summary, by constructing a user request session information database and a whitelist database and establishing a mapping relationship between them, the foundation for access control is laid for subsequent security verification. Furthermore, by generating static pages based on webpage snapshots and returning them to the client, all user interactions are isolated from the original website, fundamentally cutting off the path for attackers to directly exploit website vulnerabilities and tamper with the site through the client. Subsequently, security verification of user operation requests is performed based on the whitelist, session information database, and mapping relationship, ensuring that only legitimate operations that have undergone strict authentication are allowed, effectively blocking high-risk operations. For verified requests, they are mapped to operation instructions on the original website, and response data is obtained. New static pages are then dynamically generated and returned to the client, ensuring not only the normal interaction of website functions but also that the end user always sees controllable static content, rather than the dynamic output of the original website, thus achieving proactive protection. In conclusion, this approach overcomes the technical problems of insufficient timeliness and inability to effectively block attack paths in existing technologies for webpage anti-tampering, significantly improving the real-time performance and reliability of webpage anti-tampering.

[0082] The webpage anti-tampering method shown in the embodiments of this application can be applied to webpage anti-tampering systems (see reference). Figure 2This application, based on a webpage anti-tampering system, describes the method shown in the embodiments of this application from the perspective of application scenarios. The embodiments of this application propose a webpage anti-tampering system based on underlying operational logic to establish an anti-tampering webpage. By leveraging the reliability of the underlying logic itself, the security of anti-tampering is improved, and tampering events are isolated from the source.

[0083] The website displayed on the user interface is a static webpage. A combination of JavaScript and AJAX is used to display the user's click location on top of the static interface and correspond to the click coordinates. When information interaction occurs, the coordinates of the static interface and the operation location, as well as the information to be interacted with, need to be bound together. After whitelist verification and mapping of user request session information, the interaction information is passed to the actual website, and the actual website provides feedback on the information required by the user. The interface displaying this information is then processed as a static page. Subsequently, after processing the user request session information, the returned static page and its corresponding coordinates are stored, so that the user still sees the static page state.

[0084] When malicious actors attempt to illegally modify a webpage, even code modifications cannot alter the information on the static page. Therefore, code modifications also change the coordinates of user actions. If the user's action coordinates differ from the original coordinates of the static page, the request will be intercepted, and feedback will be provided to both the user and the website administrator. Users will not suffer any losses due to webpage tampering, and the perpetrator will not affect users with the modified page.

[0085] The specific technical solution is as follows:

[0086] 1. Construct an initial user request session information database and whitelist information, and establish a mapping relationship between the two; for tampering behaviors that have occurred, establish an information word early warning acquisition model, and dynamically adjust the identification of high-alert words.

[0087] The user request session information database includes user browser information, user session identifier, request content, high-alert vocabulary recognition database, current webpage snapshot, and coordinate location information. User browser information includes multiple trusted browser addresses, while untrusted browser addresses are defined as high-alert browsers. Subsequent content extraction and verification of content generated from high-alert browsers are required.

[0088] Furthermore, a classification and management system for user browser information needs to be established, specifically including: A dynamic trusted list: A dynamically updated database of trusted browser addresses needs to be established. This database should include not only classic browser identifiers but also browser version information and configuration data to ensure that only browsers conforming to the latest security standards are classified as trusted. Real-time monitoring and updates: The system needs to continuously monitor and evaluate new browser versions and updates, and adjust the trusted browser list in a timely manner to reflect the latest security research results and market changes. Special handling can also be applied to untrusted browsers, specifically including: Content extraction and approval process: For requests from untrusted browsers, the system will implement additional content review and approval processes. This includes in-depth analysis of the requested content, checking for high-risk keywords, malicious scripts, or unusual request patterns.

[0089] It's also important to note that the content requests on a website are incredibly diverse, making it impossible to apply restrictions to every single page. Therefore, a whitelist is necessary as the first line of defense. Whitelist technology allows the website's anti-tampering system to only allow users to click on URLs containing coordinate information. The access whitelist filtering strategy is flexibly configurable, allowing for flexible access authorization based on factors such as the user's source IP address and account.

[0090] 2. Establish a high-risk keyword identification database. High-risk keywords are synchronized with the high-risk keyword identification database, and intelligent word segmentation is performed using natural language processing (NLP) technology commonly used in artificial intelligence, followed by extraction and matching verification of highly sensitive words. The specific verification process is consistent with the high-risk keyword identification database. Unusual request patterns include: abnormally high request frequency, such as a large number of requests for the same resource in a short period of time; abnormal request content, such as containing illegal characters or abnormally large request load; requests from unusual geographical locations, especially those that are significantly inconsistent with normal user behavior; and request behavior that is significantly inconsistent with the user's historical behavior. The above content is learned and predicted using a random forest learning model to learn and predict the user's normal request patterns. These models can learn from the user's historical data and are used to identify requests that deviate from these patterns.

[0091] First, an isolation and review environment needs to be established: A secure, isolated environment should be created to run and test requests from high-alert browsers. This prevents potential malicious code from affecting the main system while allowing the security team to conduct in-depth analysis of suspicious activity. Specifically, the network channels on the whitelist should be run independently from those of the high-alert browsers. Second, user behavior analysis is required, starting with behavioral pattern recognition: Machine learning techniques should be used to analyze user behavior patterns from different browsers to identify abnormal or potentially malicious behavior. These analyses are based on user click-through rates, request frequencies, and page dwell times. Next, data collection and preprocessing are necessary: ​​Data collection: Collect user click-through rates, request frequencies, and page dwell times from server logs or user behavior tracking tools; Data cleaning: Handle missing values ​​and outliers, and standardize data formats and ranges; Feature extraction: Extract useful features from the raw data, and calculate the average click-through rate, request frequency, and maximum / minimum / average page dwell time for each user; Feature selection: Use Principal Component Analysis (PCA) to select the features that have the greatest impact on model predictions.

[0092] Next, a model needs to be selected, such as a neural network machine learning model. Model training involves training the model using a training dataset and adjusting its parameters. Cross-validation is then used to evaluate the model's performance, ensuring its generalization ability. Metrics such as accuracy, recall, and F1 score can be used to assess the model's effectiveness. Thresholds are then set based on the model's output to determine which behaviors are abnormal or potentially malicious. The model can be deployed to a production environment for real-time monitoring and analysis of user behavior. The model can be adjusted and optimized based on actual detection results. A feedback mechanism can also be established, allowing the security team to manually review the model's identification results and continuously optimize thresholds and model parameters.

[0093] The following details the update process of the high-alert word recognition database, which involves setting up an information word early warning acquisition model based on the tampering behavior that has already occurred, updating it to the high-alert word recognition database, and making dynamic adjustments to the high-alert word recognition.

[0094] The known acts of tampering are categorized based on the different behaviors before the tampering, such as tampering occurring after information interaction or tampering occurring directly after access; and further categorized based on the purpose of the tampering, such as obtaining user information, causing users to access a specific page, or adding page advertisements without authorization.

[0095] The different categories of behavior before tampering are defined as A. ;

[0096] Different categories based on the purpose of tampering are defined as B. ;

[0097] Sensitive word extraction: First, the text data is preprocessed, including noise removal (such as punctuation marks, numbers, meaningless filler words, etc.). Then, for Chinese, Jieba segmentation can be used, and for English, NLTK (Natural Language Toolkit) or Spacy (Spacy is an open-source, industrial-grade natural language processing library written in Python, whose core design goal is to achieve efficient, accurate, and scalable processing and analysis of large-scale text data) can be used for word segmentation. According to the type of tampering behavior, the text data is organized according to known classification labels, and word frequency statistics are performed for each category. TF-IDF is used to measure the importance of words. The sensitive words extracted from each category are merged into a total sensitive word library. During the merging process, deduplication is performed to ensure that the words in the sensitive word library are unique. A collection of tampering warning sensitive word data from different categories is constructed as Ai and Bi.

[0098] The sensitive word database needs to be reviewed and updated regularly, and adjusted based on new data and patterns of tampering. This can be done by adding new sensitive words or deleting words that are no longer relevant.

[0099] Training data from random access and tampering behavior access are selected, and high-frequency words are synthesized into a training dataset Ci through word truncation.

[0100] The initial dataset contains 20 words (N). The similarity coefficient between the training dataset and the highly sensitive word dataset is calculated using Jaccard: the similarity of the sensitive word dataset for each category is calculated as follows: or Final training dataset This involves assigning weights to the similarities calculated for different categories based on the frequency of potential tampering, thereby calculating a comprehensive similarity value. Each training dataset is categorized according to the purpose of the tampering, and the similarity calculated for different categories is then derived using the final similarity model of the training dataset. The dataset with less than 70% considered problem-free was used to determine the number of data points suspected of tampering based on similarity. Data points identified as tampered through manual verification were designated as set Y. Data points predicted to have tampering issues were designated as prediction set R. The ratio of problematic behaviors identified by the model was then calculated. :

[0101]

[0102] This represents the number of items that have been manually verified to have been tampered with. This represents the number of problems identified in the prediction results.

[0103] When calculated If the value is less than 80%, the comparison vocabulary N will be dynamically adjusted to adjust the granularity of the comparison. When N < 7, adjustments will be made. The value is reduced to increase the number of entries into the problem dataset; until the number of entries in the dataset can accurately identify behaviors that may have been tampered with, and the trained dataset is then stored in the high-alert word recognition.

[0104] 3. Based on the user request session information database, whitelist information, and high-alert word recognition database established above, once abnormal behavior is detected, the system will automatically trigger an alert and take corresponding response measures according to the severity of the behavior, such as temporarily restricting the user's operation, requiring additional authentication, or directly blocking high-risk requests.

[0105] For users using untrusted browsers, the system should provide clear notifications and suggestions guiding them to safer browsing options. This helps raise user security awareness while maintaining a good user experience. It is also essential to ensure that security measures do not excessively impact system performance or user interaction. Optimizing review and response processes reduces disruption to normal user activities.

[0106] This section describes the specific process of verifying operation requests based on a user request session information database, a whitelist, and a high-alert word recognition database.

[0107] It's important to note beforehand that for user session identifiers, a list of coordinate values ​​can be generated based on the content of each webpage snapshot to be output, using a combination of DOM tree and image processing coordinate extraction methods. For text and link elements, DOM tree coordinate extraction is used; for non-text elements such as images, image processing-based coordinate extraction methods are used to accurately extract webpage coordinates, forming a list of rectangular coordinate values ​​for page elements, which is then saved. This list is bound to the page snapshot; when the page snapshot changes, a new list of coordinate values ​​needs to be generated.

[0108] Store the coordinate value list using a structured data format (such as JSON or XML) for easy retrieval and processing. Index this data in the database to improve query efficiency, especially when frequent access and updates to the coordinate data are required. Implement a real-time data synchronization mechanism to ensure the coordinate value list is updated along with the webpage content, keeping the data up-to-date. Notify relevant security monitoring systems and applications in real time of any changes to the coordinate values.

[0109] The created index includes an identifiable webpage ID (Identifier), creation time, and all corresponding coordinate points. When constructing the coordinate value list for each static webpage, a webpage ID needs to be constructed to facilitate differentiation when multiple users access different websites. The webpage ID includes the browser characteristics, time characteristics (feedback time and the length of time for subsequent visits), and access IP characteristics.

[0110] Therefore, when a user's network IP is unstable, it will only be mapped to the correct index table again if the access request is made again within a specified time. That is, when browsing and accessing information through the browser for the first time, the time when the browser sends back the webpage snapshot is defined as the feedback time and is recorded in the time feature. Based on the number of coordinate points in the feedback webpage snapshot, the average access time of the browser is calculated, which is the length of time for the next access.

[0111] When the index table is incorrect due to unstable network IP, the system will repeatedly search for index tables with the same browser characteristics and similar time characteristics. Only when all index tables fail to match will the access be judged as an irregular access, and the access request needs to be interrupted and feedback sent to the network maintenance system. The feedback includes the access IP, the browser used, the corresponding webpage snapshot and request content, and the corresponding coordinates.

[0112] For the request content, the request content obtained from the webpage entry needs to be truncated and segmented into a high-alert word recognition database for early warning recognition. At the same time, the correspondence between the request content and the coordinate points is recorded. When there is no risk after being identified by the high-alert word recognition database, the request content, the corresponding coordinate points, and the current static page will be fed back to the user session for mapping and recognition of the coordinate value list.

[0113] High-alert word identification involves recording high-frequency words, combining and identifying these words, and comparing their similarity with various categorized datasets. Each categorized dataset has an identifier. If a dataset with high similarity is matched, the user's request content is labeled. When a high-alert label appears, the request transmission is stopped, and feedback is sent to the operations and maintenance system for further verification. If the information is verified and it is not considered abnormal access content, the threshold of the corresponding identifier is adjusted by modifying the information word alert acquisition model. If operations and maintenance personnel or the system discover other words and behaviors not included in the dataset, a new dataset will be created or the new words will be added to the corresponding existing dataset.

[0114] For coordinate point information, the current webpage snapshot contains the coordinate points where clickable or input information can be entered, along with the corresponding webpage snapshot. Based on the above settings, the system compares the entered request content and its corresponding coordinate points in the current webpage snapshot with the coordinate value list recorded in the original webpage snapshot. If the coordinate points match the previously stored values, the webpage access is considered normal, and the request content is sent to the backend for feedback. If the coordinates do not match the original recorded coordinate value list, the request is considered invalid, the request is blocked, and feedback is sent to the maintenance system.

[0115] Furthermore, the system needs to replace the original website entry point, with the new entry point directly interacting with external users. This new entry point is responsible for receiving users' webpage browsing requests and click coordinates, and returning a static page containing a webpage snapshot to the user's browser. It is important to note that when the original website entry point is updated, the replacement entry point must be updated synchronously to prevent unauthorized access.

[0116] In terms of user interface presentation, the initial static interface uses a combination of JavaScript and AJAX technologies to overlay the user's click location onto the static interface, recording the corresponding click coordinates. This method effectively optimizes the user experience, making it difficult for users to perceive that they are actually accessing a static interface composed of webpage snapshots. The specific implementation includes the following steps: listening for page click events using JavaScript; extracting the click coordinates (such as event.clientX and event.clientY) from the event object; using AJAX to send the coordinate data, after whitelisting, to the user request session information database; and dynamically displaying the coordinate information near the user's click location using JavaScript.

[0117] Based on the aforementioned whitelist database, the system employs a whitelist filtering mechanism to verify user-submitted coordinate information, allowing only coordinate data within a preset range to be transmitted to the user request session database for processing. This mechanism supports dynamic updates, allowing system administrators to adjust the whitelist content as needed, such as adding, modifying, or deleting trusted coordinate points. Simultaneously, the system adopts a tiered access control strategy, with different user levels corresponding to different coordinate access ranges. During coordinate point verification, if the requested coordinates are not on the whitelist, the system will reject the request or redirect to a secure page, providing the user with clear feedback. Furthermore, the system records detailed audit logs and conducts regular security audits to ensure the effectiveness and compliance of the whitelist policy.

[0118] In the coordinate mapping stage, the system locates the specific operation position based on the user's click coordinates and combines this with the coordinate information of the current snapshot in the user session information database to generate the actual user webpage request. The system employs coordinate calibration and dynamic adjustment technology to ensure that the coordinate points accurately correspond to the actual positions under different screen sizes and layouts. The mapped request and session information are then sent to the backend original website for processing. To ensure data security, the system encrypts the coordinates and session information during transmission and ensures that all processing procedures comply with relevant data protection regulations.

[0119] Furthermore, it should be noted that the webpage snapshot generation process utilizes PhantomJS technology to receive page information returned by the original website and generate a webpage snapshot containing screenshots of the webpage and corresponding operation coordinates. This module supports executing JavaScript, simulating user interactions (such as clicks and scrolling), and capturing the page state after AJAX loading, thereby obtaining a more complete webpage view. Regarding coordinate information capture, the system can handle both static and dynamic content and bind coordinate points to webpage element attributes (such as ID, class name, etc.). All snapshot data is stored in a structured format (such as JSON) for easy retrieval and analysis, while encryption measures are implemented to ensure data security and user privacy.

[0120] In static page generation, the system is responsible for transforming the original webpage content into a simplified static page. This process begins by using server-side scripts to crawl the original webpage content, extracting key elements such as text and images, and removing complex scripts and styles to improve loading performance and content integrity. Subsequently, a static page framework based on HTML (HyperText Markup Language) and CSS (Cascading Style Sheets) is built, and a snapshot of the webpage is embedded as an image. JavaScript and AJAX technologies are used to dynamically load content and handle user interactions, such as supporting image zooming and scrolling previews. The system employs a caching strategy and HTTPS (Hypertext Transfer Protocol Secure) transmission to optimize performance and enhance security, and includes a user feedback interface on the page to facilitate continuous improvement of page display and functionality.

[0121] In summary, compared with existing technologies, the webpage anti-tampering method shown in this application has the following advantages: it achieves refined management and control of user requests, significantly improving the overall security level while ensuring data security and stable system operation, and further enhancing users' trust in the system; the coordinate mapping method adopted has stronger processing capabilities and reliability, and can accurately respond to each user webpage request, effectively improving the overall system efficiency and user satisfaction while ensuring data security and user privacy rights, providing solid technical support for platform operation; the system can efficiently extract sensitive words related to specific tampering behaviors from text data, construct a sensitive word dataset for tampering warnings, thereby significantly enhancing the system's monitoring and early warning capabilities; static pages maintain the advantage of fast access while enhancing functionality and interactivity with the help of modern Web technologies, enabling users to obtain a smooth browsing experience even in low-bandwidth or high-latency network environments.

[0122] This application also provides a device for preventing webpage tampering, such as... Figure 3 As shown, the device 30 includes:

[0123] Module 301 is used to build a user request session information database and a whitelist information database, and to establish a mapping relationship between the user request session information database and the whitelist information database.

[0124] The execution module 302 is used to generate a static page based on the webpage snapshot stored in the user request session information database, return the static page to the client, and obtain the user's operation request for the static page from the client.

[0125] Security verification of operation requests is performed based on the whitelist information database, the user request session information database, and the mapping relationship;

[0126] If the operation request passes the security verification, the operation request will be mapped to an operation instruction on the original website corresponding to the webpage snapshot, and the operation instruction will be fed back to the original website to obtain response data;

[0127] A new static page is generated based on the response data, and the new static page is returned to the client.

[0128] In one possible implementation, the execution module 302 is further configured to, after performing security verification on the operation request based on the whitelist information database, the user request session information database, and the mapping relationship, if the operation request fails the security verification, intercept the operation request, deny the user's access to the original website, and generate feedback information to return to the client, wherein the feedback information carries the reason for denying the user's access to the original website.

[0129] In one possible implementation, the user request session information database includes at least one of the following: the user's browser information, the user's session identifier, a high-alert vocabulary recognition database, a webpage snapshot, and the reference coordinate point information on the webpage snapshot; the whitelist information database includes: the user's session identifier, the user's Internet Protocol IP address, the trusted browser identifier, and the trusted browser account; wherein, the construction process of the high-alert vocabulary recognition database is as follows: acquiring historical webpage tampering behavior data; extracting text information from the historical webpage tampering data; based on the text information, statistically analyzing key feature words in the text information using the TF-IDF algorithm; constructing an initial high-alert vocabulary recognition database based on the key feature words; and matching new behavioral data on the Internet with the initial high-alert vocabulary recognition database based on Jaccard similarity calculation; and updating the initial high-alert vocabulary recognition database according to the matching results.

[0130] In one possible implementation, the execution module 302 is further configured to obtain a webpage snapshot from the user request session information database and embed the webpage snapshot into a preset HTML page frame to generate a static page.

[0131] The static page is returned to the client, and the user's operation request is detected in the static page using JavaScript technology;

[0132] When an operation request is detected, the coordinates of the click location of the operation request are obtained using JavaScript technology, and the operation request containing the coordinates, the user's session identifier, and the request content is obtained using AJAX technology.

[0133] In one possible implementation, the execution module 302 is further configured to verify whether the content of the operation request is in the high-alert word recognition library. If not, the verification passes, and the module continues to verify whether the IP address, browser identifier, and browser account of the user corresponding to the session identifier exist in the whitelist information library. If they do, the verification passes, and the module continues to determine whether the coordinate point is consistent with the reference coordinate point information in the user request session information library. If they are consistent, the module determines that the operation request has passed the security verification.

[0134] In one possible implementation, execution module 302 is further configured to render the response data using headless browser technology to generate a new webpage snapshot; encapsulate the new webpage snapshot into a preset HTML page framework to generate a new static page; and return the new static page to the client, wherein the new static page integrates JavaScript technology and AJAX interaction logic.

[0135] In one possible implementation, the execution module 302 is further configured to generate a new webpage snapshot based on the new static page after generating the new static page according to the response data; analyze the DOM structure of the new webpage snapshot, extract the coordinate information of all interactive elements in the new static page according to the DOM structure, generate a new list of coordinate values ​​according to the coordinate information; and store the new webpage snapshot and the new list of coordinate values ​​in the user request session information database.

[0136] In this embodiment, by constructing a user request session information database and a whitelist information database and establishing a mapping relationship between them, the foundation for access control is laid for subsequent security verification. Then, by generating static pages based on webpage snapshots and returning them to the client, all user interactions are isolated from the original website, fundamentally cutting off the path for attackers to directly exploit website vulnerabilities for tampering through the client. Subsequently, user operation requests are securely verified based on the whitelist, session information database, and mapping relationship, ensuring that only legitimate operations that have undergone strict authentication are allowed, effectively shielding high-risk operations. For verified requests, they are mapped to operation instructions on the original website, response data is obtained, and a new static page is dynamically generated and returned to the client. This not only ensures the normal interaction of website functions but also ensures that the end user always sees controllable static content, rather than the dynamic output of the original website, thus achieving proactive protection. In summary, this overcomes the technical problems of insufficient timeliness and inability to effectively block attack paths in existing technologies for webpage anti-tampering, significantly improving the real-time performance and reliability of webpage anti-tampering.

[0137] This application provides a network device 40, such as... Figure 4 As shown, the network device 40 includes a processor 401, a memory 402, and a program stored in the memory 402 and executable on the processor 401. When the program is executed by the processor 401, it implements the steps of a webpage anti-tampering method as shown in the above embodiment.

[0138] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of a webpage anti-tampering method as shown in the above embodiments, achieving the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0139] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the steps of the webpage anti-tampering method shown in the above embodiments and achieve the same technical effect. To avoid repetition, the details will not be repeated here.

[0140] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0142] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for webpage tamper-proofing, characterized in that, The method comprises: constructing a user request session information base and a whitelist information base, and establishing a mapping relationship between the user request session information base and the whitelist information base; generating a static page according to a web snapshot stored in the user request session information base, returning the static page to a client, and obtaining an operation request of a user of the client for the static page; performing security verification on the operation request according to the whitelist information base, the user request session information base, and the mapping relationship; if the operation request passes the security verification, mapping the operation request to an operation instruction for an original website corresponding to the web snapshot, and feeding back the operation instruction to the original website to obtain response data; generating a new static page according to the response data, and returning the new static page to the client.

2. The method of claim 1, wherein, After performing security verification on the operation request according to the whitelist information base, the user request session information base, and the mapping relationship, the method further comprises: if the operation request does not pass the security verification, intercepting the operation request, rejecting access of the user to the original website, and generating feedback information to return to the client, wherein the feedback information carries a reason for rejecting access of the user to the original website.

3. The method of claim 1, wherein, The user request session information base comprises at least one of the following: browser information of the user, a session identifier of the user, a high alert vocabulary recognition library, the web snapshot, and reference coordinate point information on the web snapshot; The whitelist information base comprises: a session identifier of the user, an Internet Protocol (IP) address of the user, a trusted browser identifier, and an account of a trusted browser; The construction process of the high alert vocabulary recognition library comprises: obtaining historical web tampering behavior data; extracting text information in the historical web tampering behavior data, counting key feature words in the text information by a Term Frequency-Inverse Document Frequency (TF-IDF) algorithm based on the text information, constructing an initial high alert vocabulary recognition library based on the key feature words, and matching new behavior data on the Internet with the initial high alert vocabulary recognition library based on Jaccard similarity calculation, and updating the initial high alert vocabulary recognition library according to a matching result.

4. The method of claim 3, wherein, Generating a static page according to a web snapshot stored in the user request session information base, returning the static page to a client, and obtaining an operation request of a user of the client for the static page comprises: obtaining the web snapshot from the user request session information base, embedding the web snapshot in a preset HTML page framework to generate the static page; returning the static page to the client, and detecting the operation request of the user in the static page by JavaScript technology; When the operation request is detected, a coordinate point of a click position of the operation request is obtained by the JavaScript technology, and an operation request containing the coordinate point, a session identification of a user, and a request content is obtained by using the AJAX technology.

5. The method of claim 4, wherein, According to the whitelist information base, the user request session information base, and the mapping relationship, the operation request is subjected to security verification, which includes: If the operation request content is not in the high alert vocabulary identification base, the verification is passed, and the IP address, browser identification, and browser account of the user corresponding to the session identification are verified based on the whitelist information base to determine whether they exist in the whitelist information base. If yes, the coordinate point is determined to be consistent with the reference coordinate point information in the user request session information base. If consistent, the operation request is determined to pass the security verification.

6. The method of claim 1, wherein, According to the response data, a new static page is generated, and the new static page is returned to the client, which includes: The response data is rendered by using the headless browser technology to generate a new web snapshot; The new web snapshot is encapsulated into a preset HTML page framework to generate a new static page, and the new static page is returned to the client, wherein the new static page integrates JavaScript technology and AJAX interaction logic.

7. The method according to any one of claims 1 to 6, characterized in that, After the new static page is generated according to the response data, the method further includes: A new web snapshot is generated based on the new static page; The DOM structure of the new web snapshot is analyzed, the coordinate information of all interactive elements in the new static page is extracted according to the DOM structure, and a new coordinate value list is generated according to the coordinate information; The new web snapshot and the new coordinate value list are stored in the user request session information base.

8. A device for webpage tamper-proofing, characterized in that, The device includes: A construction module is configured to construct a user request session information base and a whitelist information base, and establish a mapping relationship between the user request session information base and the whitelist information base; An execution module is configured to generate a static page according to a web snapshot stored in the user request session information base, return the static page to a client, and obtain an operation request of a user of the client for the static page; According to the whitelist information base, the user request session information base, and the mapping relationship, the operation request is subjected to security verification; If the operation request passes the security verification, the operation request is mapped to an operation instruction for an original website corresponding to the web snapshot, and the operation instruction is fed back to the original website to obtain response data; According to the response data, a new static page is generated, and the new static page is returned to the client.

9. A network device, comprising: It includes: A processor, a memory, and a program stored on the memory and executable on the processor, which implements the steps of the webpage tamper-proofing method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the webpage tamper-proofing method in any one of claims 1 to 7.

11. A computer program product, characterised in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the webpage tamper-proofing method in any one of claims 1 to 7.

Images