Page anomaly detection method, device and equipment and computer storage medium

Abstract

The invention discloses a page anomaly detection method, device and equipment and a computer storage medium, and relates to the technical field of page detection. The method comprises the following steps: firstly, acquiring a DOM structure tree and performance parameters of a page to be detected, wherein the DOM structure tree comprises a plurality of text label nodes and text lengths among the text label nodes; under the condition that the to-be-detected page is not loaded for the first time, calculating the path length sum of the DOM structure tree according to the text label node and the text length; clustering the to-be-detected pages based on the path length sum, the performance parameters and a preset reference page, and determining a target reference page; calculating a vector distance between the to-be-detected page and the target reference page, wherein vectors are vectors formed by path lengths and performance parameters; and under the condition that the vector distance is greater than a set threshold value, judging that the to-be-detected page is an abnormal page. According to the embodiment of the invention, during detection, the reference page is adjusted according to the real-time change of the page, so that the accuracy of page anomaly detection is improved.

Description

Technical Field

[0001] This application belongs to the field of page detection technology, and in particular relates to a method, apparatus, device and computer storage medium for page anomaly detection. Background Technology

[0002] With the continuous development of the Internet, the fifth generation of Hyper Text Markup Language (H5) pages are playing an increasingly important role in enterprise services and user interaction, and anomaly detection for H5 pages has become an urgent need.

[0003] Existing methods for page anomaly detection often compare the mixed feature values ​​of text and images based on pre-set static comparison standards when the page loads. However, since H5 pages use asynchronous data loading and the content changes in real time according to user interaction, they cannot detect anomalies in content that is retrieved and displayed as needed after the page loads, resulting in low accuracy of page anomaly detection. Summary of the Invention

[0004] This application provides a method, apparatus, device, and computer storage medium for page anomaly detection to address the problem of low accuracy in existing page anomaly detection technologies.

[0005] In a first aspect, embodiments of this application provide a method for detecting page anomalies, the method comprising:

[0006] Obtain the Document Object Model (DOM) structure tree and performance parameters of the page to be tested. The DOM structure tree includes multiple text tag nodes and the text length between text tag nodes.

[0007] If the page to be tested is not being loaded for the first time, calculate the path length of the DOM structure tree based on the text tag nodes and the text length. The path is the path formed by connecting the text tag nodes.

[0008] Cluster the pages to be detected based on path length, performance parameters, and preset benchmark pages to determine the target benchmark pages;

[0009] Calculate the vector distance between the page to be detected and the target reference page. The vector is a vector composed of path length and performance parameters.

[0010] If the vector distance is greater than a set threshold, the page to be detected is determined to be an abnormal page.

[0011] Secondly, embodiments of this application provide an apparatus for detecting page anomalies, the apparatus comprising:

[0012] The acquisition module is used to obtain the Document Object Model (DOM) structure tree and performance parameters of the page to be tested. The DOM structure tree includes multiple text tag nodes and the text length between text tag nodes.

[0013] The calculation module is used to calculate the path length of the DOM structure tree based on the text tag nodes and text length when the page to be tested is not loaded for the first time. The path is the path formed by connecting the text tag nodes.

[0014] The clustering module is used to cluster the pages to be detected based on path length, performance parameters, and preset benchmark pages to determine the target benchmark pages;

[0015] The calculation module is also used to calculate the vector distance between the page to be detected and the target reference page. The vector is a vector composed of path length and performance parameters.

[0016] The judgment module is used to determine whether the page to be detected is an abnormal page if the vector distance is greater than a set threshold.

[0017] Thirdly, embodiments of this application provide a terminal device, which includes: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the page anomaly detection method as described in the first aspect.

[0018] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the page anomaly detection method as described in the first aspect.

[0019] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform a page anomaly detection method as described in the first aspect.

[0020] This application provides a method, apparatus, device, and computer storage medium for page anomaly detection. The method obtains the Document Object Model (DOM) structure tree and performance parameters of the page to be detected. The DOM structure tree includes multiple text tag nodes and the text lengths between them. The DOM structure tree provides a precise representation of the page content, and the performance parameters determine the actual operating status of the page. When the page to be detected is not being loaded for the first time, the path length of the DOM structure tree is determined based on the text tag nodes and text lengths. The path is the path formed by connecting text tag nodes. By analyzing the text tag nodes and text lengths, key features of the page structure can be captured. Based on the path length, performance parameters, and a preset benchmark page, the page to be detected is clustered to obtain a target benchmark page. The page to be detected is compared with the target benchmark page, and pages with differences exceeding a set rule are identified as anomaly pages. During each detection, the benchmark page is adjusted based on real-time changes in page performance data, improving the accuracy of page anomaly detection. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the page anomaly detection method provided in an embodiment of this application;

[0023] Figure 2 This is a flowchart illustrating the method for determining a preset baseline page provided in an embodiment of this application;

[0024] Figure 3 This is a flowchart illustrating the target baseline page determination method provided in an embodiment of this application;

[0025] Figure 4 This is a flowchart illustrating the method for judging page pattern feature anomalies provided in an embodiment of this application;

[0026] Figure 5 This is a schematic diagram of the structure of the page anomaly detection device provided in the embodiments of this application;

[0027] Figure 6 This is a schematic diagram of the structure of the terminal device provided in the embodiments of this application. Detailed Implementation

[0028] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0029] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0030] With the continuous development of internet technology, H5 pages are playing an increasingly important role in enterprise services and user interaction. However, the complexity of the network environment and the continuous evolution of attack techniques expose H5 pages to numerous security threats, which not only affect the service capabilities of enterprises but may also damage their image. To ensure the secure and stable operation of business, operations and maintenance departments typically use monitoring systems to conduct 24 / 7 monitoring of H5 pages. However, existing technologies rely too heavily on comparing mixed text and image feature values ​​for H5 page anomaly detection. This method lacks in-depth analysis combining page performance data and system source code text, leading to inaccurate results. Furthermore, it heavily depends on pre-set static comparison standards and lacks intelligent recognition capabilities for dynamically loaded and real-time updated page content. This not only limits the application of the system in complex page structures but also increases maintenance costs, making it difficult to efficiently handle large-scale, high-frequency page anomaly monitoring tasks. Especially for H5 pages using dynamic loading technology, existing technologies often fail to effectively identify page anomalies.

[0031] To address the shortcomings of existing technologies, this application provides a method, apparatus, device, and computer storage medium for page anomaly detection. The method obtains the Document Object Model (DOM) structure tree and performance parameters of the page to be detected. The DOM structure tree includes multiple text tag nodes and the text lengths between them. The DOM structure tree provides a precise representation of the page content, and the performance parameters determine the actual operating status of the page. When the page to be detected is not being loaded for the first time, the path length of the DOM structure tree is determined based on the text tag nodes and their text lengths. The path is the connection between the text tag nodes. By analyzing the text tag nodes and their text lengths, key features of the page structure can be captured. Based on the path lengths, performance parameters, and a preset benchmark page, the page to be detected is clustered to obtain a target benchmark page. The page to be detected is compared with the target benchmark page, and pages with differences exceeding a set rule are identified as anomaly pages. During each detection, the benchmark page is adjusted based on real-time changes in page performance data, improving the accuracy of page anomaly detection.

[0032] The method for detecting page anomalies provided in the embodiments of this application will be introduced first below.

[0033] Figure 1 A flowchart illustrating a method for detecting page anomalies according to an embodiment of this application is shown. Figure 1 As shown, the method may include the following steps: S101 to S105.

[0034] S101, obtain the Document Object Model (DOM) structure tree and performance parameters of the page to be tested. The DOM structure tree includes multiple text tag nodes and the text length between text tag nodes.

[0035] In some embodiments, performance parameters may include First Content Render (FCP), Speed ​​Index (SI), Maximum Content Block Render Time (LCP), Total Block Time (TBT), and Time to Interact (TTI).

[0036] In some embodiments, browser-provided APIs (such as Web APIs) can be used to obtain the DOM structure tree of the page and get the text length between text tag nodes; the browser-provided Performance API can be used to collect page performance parameters.

[0037] By obtaining the DOM structure tree and performance parameters of the page to be detected as the data basis for anomaly detection, we can comprehensively capture the page's structure and performance information, monitor page performance in real time, and provide a data foundation for subsequent analysis.

[0038] S102, if the page to be tested is not being loaded for the first time, calculate the path length of the DOM structure tree based on the text tag nodes and the text length. The path is the path formed by connecting the text tag nodes.

[0039] In some embodiments, calculating the sum of path lengths in the DOM structure tree may include:

[0040] Starting from the root node of the DOM structure tree, recursively traverse the DOM structure tree, recording the path formed by each text tag node and the text length between text tag nodes;

[0041] Calculate the sum of the lengths of all paths based on the paths formed by the recorded text tag nodes and the text lengths between the text tag nodes.

[0042] In some embodiments, when recursively traversing the DOM structure tree, a depth-first search (DFS) algorithm or a breadth-first search (BFS) algorithm can be used.

[0043] By summing the path lengths of text tags, the structural features of a page can be quantified into calculable path lengths, which helps to identify anomalies caused by structural changes.

[0044] S103, cluster the pages to be detected based on path length, performance parameters and preset benchmark pages to determine the target benchmark page.

[0045] In some embodiments, the K-means algorithm is used to perform cluster analysis on the pages to be detected.

[0046] Clustering adapts to changes in page structure and performance, finding the most similar baseline page.

[0047] S104, calculate the vector distance between the page to be detected and the target reference page. The vector is composed of path length and performance parameters.

[0048] In some embodiments, vector distance can be determined by cosine similarity calculation method, Euclidean distance calculation method, Mahalanobis distance calculation method or multi-dimensional feature fusion method.

[0049] By calculating the vector distance, the differences between pages are quantified into data, making it easier to compare the page to be detected with the target benchmark page, thereby identifying anomalies in the page to be detected.

[0050] S105, if the vector distance is greater than the set threshold, determine that the page to be detected is an abnormal page.

[0051] In some embodiments, the threshold can be set manually or dynamically adjusted based on historical page data to adapt to changes in page performance.

[0052] When dynamically adjusting the set threshold based on the page's historical data, it can be determined using a statistical method of the mean plus a standard value or a pre-trained machine learning model.

[0053] By comparing the results of vector distance and a set threshold, it is possible to determine whether the page to be detected is abnormal. This can achieve automated detection, reduce manual intervention, help to detect abnormal pages in a timely manner, and improve detection efficiency.

[0054] First, the Document Object Model (DOM) structure tree and performance parameters of the page to be tested are obtained. The DOM structure tree includes multiple text tag nodes and the text lengths between them. The DOM structure tree provides a precise representation of the page content, and the performance parameters determine the actual performance of the page. When the page to be tested is not being loaded for the first time, the path length of the DOM structure tree is determined based on the text tag nodes and their lengths. The path is the connection between the text tag nodes. By analyzing the text tag nodes and their lengths, key features of the page structure can be captured. Based on the path lengths, performance parameters, and a preset benchmark page, the page to be tested is clustered to obtain a target benchmark page. The page to be tested is compared with the target benchmark page, and pages with differences exceeding a set rule are identified as abnormal pages. During each test, the benchmark page is adjusted based on real-time changes in page performance data, improving the accuracy of page anomaly detection.

[0055] In some embodiments, the formula for calculating the sum of path lengths in the DOM structure tree can be:

[0056]

[0057] Where TotalPathLength is the sum of path lengths in the DOM structure tree, n represents the number of text tags, and length... i The number represents the text length of the i-th text label. i This represents the number of nodes for the i-th text label.

[0058] In some embodiments, before clustering the pages to be detected based on path length, performance parameters, and preset benchmark pages to determine the target benchmark page, the method may further include:

[0059] Normalize the path length and performance parameters to scale them to the [0, 1] interval. The normalization formula is as follows:

[0060]

[0061] Among them, X norm Let X be the normalized data point, and X be the current data point. min X is the minimum value among all data points. maxThis represents the maximum value among all data points, which can include path length and performance parameters.

[0062] In some embodiments, such as Figure 2 As shown, the method may further include:

[0063] S201, when the page to be tested is loaded for the first time, determine whether the DOM structure tree and performance parameters meet the set conditions;

[0064] S202, if the DOM structure tree and performance parameters meet the set conditions, the page to be tested will be used as the preset benchmark page.

[0065] After using the page to be tested as the preset baseline page, the DOM structure tree and performance parameters of the page to be tested are recorded.

[0066] The state of a page during its first load best reflects its original and unaltered structure and performance. By detecting the DOM structure and performance parameters when the page is first loaded, we can ensure that the most original state of the page is captured as a baseline, which is beneficial for subsequent anomaly detection.

[0067] In some embodiments, determining whether the DOM structure tree meets the set conditions can be done by checking the integrity of the DOM structure tree, which may include the nesting relationship of the text tag nodes in the DOM structure tree, the correctness of the attribute values, the number of text tag nodes, and the text length.

[0068] In some embodiments, determining whether a performance parameter meets the set conditions can be done by determining whether the performance parameter conforms to a preset performance parameter threshold range.

[0069] In some embodiments, when the DOM structure tree and performance parameters do not meet the set conditions, the page to be detected is considered an abnormal page.

[0070] In some embodiments, such as Figure 3 As shown, clustering the pages to be detected based on path length, performance parameters, and preset benchmark pages to determine the target benchmark page can include:

[0071] S301, obtain the path length and performance parameters of the detected pages corresponding to the page to be detected;

[0072] S302, use the preset baseline page vector as the initial cluster center;

[0073] S303, calculate the vector mean of the page to be detected and the detected pages, and use the vector mean as the target cluster center;

[0074] S304, calculate the vector distance from the page to be detected and the detected pages to the target cluster center, and take the page with the shortest distance to the target cluster center as the target reference page.

[0075] By combining path length, performance parameters, and preset benchmark pages for clustering, the similarity between the page to be detected and the pages already detected can be evaluated more comprehensively. Using the vector mean of the pages to be detected and the pages already detected as the target cluster centers allows for dynamic adjustment of the cluster centers, better adapting to changes in page structure and performance, reducing human intervention, and improving the accuracy of clustering.

[0076] In some embodiments, if the clustering operation converges to a single center point, that center point is used as the cluster center; if the clustering operation does not converge to a single center point, the center point of the largest cluster is used as the cluster center.

[0077] In some embodiments, the formula for calculating cluster centers can be:

[0078]

[0079] Where J is the number assigned to cluster center c. j The set of all data points, |J| is the number of data points in this set, x i Let i be the i-th data point.

[0080] Clustering ends when Δ satisfies the convergence condition. The convergence condition can be that the change in cluster centers Δ is less than a set threshold. The formula for the change in cluster centers is:

[0081]

[0082] in, Let j be the cluster center during the t-th clustering.

[0083] In some embodiments, the method may further include:

[0084] If the vector distance between the vector of the page to be detected and the target cluster center exceeds a set threshold, the vector of the page to be detected will be used as the new cluster center.

[0085] When the distance between the vector of the page to be detected and the cluster center is large, the vector of the page to be detected can be used as the new cluster center. This allows for dynamic adjustment of the cluster center, which helps to identify and isolate outlier data. This method can reduce the impact of outlier data on the overall clustering results.

[0086] In some embodiments, such as Figure 4 As shown, the method may further include:

[0087] S401, if the vector distance between the page to be detected and the target reference page does not exceed a set threshold, obtain the page pattern features of the page to be detected and the target reference page;

[0088] S402, Based on the page pattern features of the page to be detected and the target reference page, determine the difference value of the target pattern features between the page to be detected and the target reference page;

[0089] S403: If the difference value of the target pattern features is greater than the set threshold, the page to be detected is determined to be an abnormal page.

[0090] If the vector distance between the page to be detected and the target reference page does not exceed a set threshold, the page pattern features of the page to be detected are detected. Only pages with high similarity to the reference page are subjected to in-depth pattern feature detection, which can save resources and improve the overall detection efficiency. Furthermore, considering both vector distance and page pattern features at the same time can more comprehensively evaluate the similarity and difference between the page to be detected and the target reference page, thereby improving the accuracy of detection.

[0091] In some embodiments, the page pattern features include color histogram features, oriented gradient histogram features, and mean absolute value deviation features. Based on the page pattern features of the page to be detected and the target reference page, the difference value of the page pattern features between the page to be detected and the target reference page is calculated, including:

[0092] The color histogram features, orientation gradient histogram features, and mean absolute value deviation features are concatenated and fused to obtain the target pattern features of the page to be detected and the target reference page, respectively.

[0093] Based on the target pattern features of the page to be detected and the target reference page, the target pattern feature difference value is determined according to the relationship between the pattern features and the pattern feature difference value between the page to be detected and the target reference page.

[0094] By splicing and fusing color histogram features, orientation gradient histogram features, and mean absolute value deviation features, richer and more comprehensive page pattern features can be obtained; determining the difference value of target pattern features can more accurately quantify the differences between pages, which helps to improve the accuracy and stability of the judgment.

[0095] In some embodiments, bilinear interpolation can be used to sample the page to be detected and the target reference page. After sampling, the number of pixels in the length and width of the page are 100 times n and m, respectively, where n = width 100 + 1 and m = height 100 + 1, and \ is the integer division operator.

[0096] In some embodiments, the process of obtaining the mean absolute value deviation characteristic may include:

[0097] The 100×100 pixel pattern block is converted to grayscale using the average value method. Then, the pattern grid is divided into 100 non-overlapping 10×10 pixel small pattern blocks, and the average absolute value deviation of each small pattern block is calculated.

[0098] Let H be a 10×10 pattern block, and let the mean absolute deviation be defined as δ. Then the formula for calculating δ is:

[0099]

[0100] Where K is the number of pixels in the page pattern information, with a value of 100, f(x,y) is the gray value of pixel (x,y) in the page pattern information, and μ is the average gray value of pixels in the pattern information, thus obtaining the average absolute value deviation of one of the small pattern blocks.

[0101] In some embodiments, color histogram features, orientation gradient histogram features, and mean absolute value deviation features are concatenated and fused to obtain target pattern features for the page to be detected and the target reference page, respectively. This may include:

[0102] The color histogram feature C, the directional gradient histogram feature H, and the mean absolute value deviation feature A in the target reference page and the page to be detected are normalized respectively to obtain the normalized features. and

[0103] The feature layer concatenation fusion method is used to and Feature fusion is performed to obtain the full features F1 of the target baseline page and the full features F2 of the page to be detected.

[0104] in, In the formula, [] indicates feature splicing.

[0105] In some embodiments, the difference θ between corresponding pattern block features of two page patterns is calculated using the cosine similarity formula, and the calculation formula is as follows:

[0106]

[0107] Where K is set to 276, F1 i and F2 i Let θ be the dimension of the i-th feature randomly selected from the reference page and the page to be detected, and let θ be the degree of difference between the pattern information of the reference page and the page to be detected.

[0108] Figure 5 This is a schematic diagram of the structure of a page anomaly detection device 500 provided in an embodiment of this application, as shown below. Figure 5As shown, the device may include:

[0109] The acquisition module 501 is used to acquire the Document Object Model (DOM) structure tree and performance parameters of the page to be tested. The DOM structure tree includes multiple text tag nodes and the text length between text tag nodes.

[0110] The calculation module 502 is used to calculate the path length of the DOM structure tree based on the text tag nodes and the text length when the page to be detected is not loaded for the first time. The path is the path formed by connecting the text tag nodes.

[0111] Clustering module 503 is used to cluster the page to be detected based on path length, performance parameters and preset benchmark pages, and determine the target benchmark page;

[0112] The calculation module 502 is also used to calculate the vector distance between the page to be detected and the target reference page, where the vector is a vector composed of path length and performance parameters;

[0113] The judgment module 504 is used to determine that the page to be detected is an abnormal page when the vector distance is greater than a set threshold.

[0114] In some embodiments, the page anomaly detection apparatus 500 may further include:

[0115] The 504 judgment module is also used to determine whether the DOM structure tree and performance parameters meet the set conditions when the page to be tested is loaded for the first time;

[0116] The determination module is used to select the page to be tested as a preset benchmark page when the DOM structure tree and performance parameters meet the set conditions.

[0117] In some embodiments, the acquisition module 501 is further configured to acquire the path length and performance parameters of the detected page corresponding to the page to be detected;

[0118] The determination module is also used to use the preset baseline page vector as the initial cluster center;

[0119] The calculation module 502 is also used to calculate the vector mean of the page to be detected and the detected pages, and to use the vector mean as the target cluster center;

[0120] The calculation module 502 is also used to calculate the vector distance from the page to be detected and the detected pages to the target cluster center, and to take the page with the shortest distance to the target cluster center as the target reference page.

[0121] In some embodiments, the determining module is further configured to use the detected page vector as a new cluster center if the vector distance from the detected page vector to the target cluster center exceeds a set threshold.

[0122] In some embodiments, the acquisition module 501 is further configured to acquire page pattern features of the page to be detected and the target reference page when the vector distance between the page to be detected and the target reference page does not exceed a set threshold.

[0123] The determination module is also used to determine the difference value of the target pattern features between the page to be detected and the target reference page based on the page pattern features of the page to be detected and the target reference page;

[0124] The judgment module 504 is also used to determine that the page to be detected is an abnormal page when the difference value of the target pattern feature is greater than a set threshold.

[0125] In some embodiments, the page pattern features include color histogram features, orientation gradient histogram features, and mean absolute value deviation features. The page anomaly detection apparatus 500 may further include:

[0126] The stitching module is used to stitch and fuse the color histogram features, orientation gradient histogram features, and mean absolute value deviation features to obtain the target pattern features of the page to be detected and the target reference page, respectively.

[0127] The determination module is also used to determine the target pattern feature difference value based on the target pattern features of the page to be detected and the target reference page, according to the relationship between the pattern features and the pattern feature difference value between the page to be detected and the target reference page.

[0128] Figure 5 The various modules in the illustrated device can achieve Figure 1 The various steps involved, and the corresponding technical effects achieved, will not be elaborated upon here for the sake of brevity.

[0129] Figure 6 A schematic diagram of the hardware structure of the terminal device provided in an embodiment of this application is shown.

[0130] The terminal device may include a processor 601 and a memory 602 storing computer program instructions.

[0131] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0132] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one instance, memory 602 may include removable or non-removable (or fixed) media, or memory 602 may be non-volatile solid-state memory. Memory 602 may be internal or external to the integrated gateway disaster recovery device.

[0133] In one example, memory 602 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method of page anomaly detection according to this disclosure.

[0134] The processor 601 reads and executes computer program instructions stored in the memory 602 to achieve... Figure 1 The method for page anomaly detection in the illustrated embodiment.

[0135] In one example, the terminal device may further include a communication interface 603 and a bus 604. Wherein, for example... Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 604 and complete communication with each other.

[0136] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0137] Bus 604 includes hardware, software, or both, that couples components of an end device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 604 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0138] Furthermore, in conjunction with the page anomaly detection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the page anomaly detection methods in the above embodiments.

[0139] This application also provides a computer program product, including a computer program, which, when executed, implements any of the page anomaly detection methods described in the above embodiments.

[0140] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0141] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or text segments used to perform the required tasks. Programs or text segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Text segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0142] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0143] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0144] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting page anomalies, characterized in that, include: Obtain the Document Object Model (DOM) structure tree and performance parameters of the page to be tested. The DOM structure tree includes multiple text tag nodes and the text length between the text tag nodes. If the page to be detected is not being loaded for the first time, the path length of the DOM structure tree is calculated based on the text tag nodes and the text length, where the path is the path formed by connecting the text tag nodes; Based on the path length, performance parameters, and preset benchmark pages, the pages to be detected are clustered to determine the target benchmark pages; Calculate the vector distance between the page to be detected and the target reference page, where the vector is a vector composed of path length and performance parameters; If the vector distance is greater than a set threshold, the page to be detected is determined to be an abnormal page.

2. The method for detecting page anomalies according to claim 1, characterized in that, The method further includes: When the page to be tested is loaded for the first time, it is determined whether the DOM structure tree and performance parameters meet the set conditions; If the DOM structure tree and performance parameters meet the set conditions, the page to be tested will be used as the preset benchmark page.

3. The method for detecting page anomalies according to claim 1, characterized in that, The step of clustering the pages to be detected based on the path length, performance parameters, and preset benchmark pages to determine the target benchmark page includes: Obtain the path length and performance parameters of the detected pages corresponding to the page to be detected; Use the preset baseline page vector as the initial cluster center; Calculate the vector mean of the page to be detected and the detected pages, and use the vector mean as the target cluster center; Calculate the vector distance from the page to be detected and the detected pages to the target cluster center, and take the page with the shortest distance to the target cluster center as the target reference page.

4. The method for detecting page anomalies according to claim 3, characterized in that, The method further includes: If the vector distance from the vector of the page to be detected to the target cluster center exceeds a set threshold, the vector of the page to be detected will be used as the new cluster center.

5. The method for detecting page anomalies according to claim 1, characterized in that, The method further includes: If the vector distance between the page to be detected and the target reference page does not exceed a set threshold, the page pattern features of the page to be detected and the target reference page are obtained. Based on the page pattern features of the page to be detected and the target reference page, the difference value of the target pattern features between the page to be detected and the target reference page is determined; If the difference value of the target pattern features is greater than a set threshold, the page to be detected is determined to be an abnormal page.

6. The method for detecting page anomalies according to claim 5, characterized in that, The page pattern features include color histogram features, directional gradient histogram features, and mean absolute value deviation features. The calculation of the page pattern feature difference value between the page to be detected and the target reference page based on their respective page pattern features includes: The color histogram features, orientation gradient histogram features, and mean absolute value deviation features are spliced ​​and fused to obtain the target pattern features of the page to be detected and the target reference page, respectively. Based on the target pattern features of the page to be detected and the target reference page, the target pattern feature difference value is determined according to the relationship between the pattern features and the pattern feature difference value of the page to be detected and the target reference page.

7. A device for detecting page anomalies, characterized in that, The device includes: The acquisition module is used to acquire the Document Object Model (DOM) structure tree and performance parameters of the page to be detected. The DOM structure tree includes multiple text tag nodes and the text length between the text tag nodes. The calculation module is used to calculate the sum of path lengths of the DOM structure tree based on the text tag nodes and text lengths when the page to be detected is not being loaded for the first time. The path is a path formed by connecting the text tag nodes. The clustering module is used to cluster the pages to be detected based on the path length, performance parameters, and preset benchmark pages to determine the target benchmark page; The calculation module is also used to calculate the vector distance between the page to be detected and the target reference page, wherein the vector is a vector composed of path length and performance parameters; The judgment module is used to determine that the page to be detected is an abnormal page if the vector distance is greater than a set threshold.

8. A terminal device, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the page anomaly detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the page anomaly detection method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the page anomaly detection method as described in any one of claims 1-6.

Images