Website identification method and related apparatus

Abstract

The application provides a website identification method and related device, and relates to the technical field of terminals. In the method, when an electronic device accesses a target website, a server can obtain website fingerprint data and website feature data of the target website; wherein the website fingerprint data and the website feature data of the target website can be immutable data; the server matches the website fingerprint data and the website feature data of the target website with the website fingerprint data and the website feature data of the target website of a malicious website respectively; in the case that they are the same, it can be determined that the target website is a homologous website of the malicious website; and the server can intercept the target website accessed by the electronic device. In this way, in the case that homologous malicious websites can easily evade interception by changing domain names, the malicious websites can be accurately identified through the immutable data, so that the success rate of intercepting malicious websites is improved, the security of accessing websites is improved, and the online experience of users is improved.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a website identification method and related apparatus. Background Technology

[0002] Users can use electronic devices to access the internet. For example, when a user enters a URL or search term into a browser application, the electronic device can access the webpage corresponding to that URL or search term. However, in potential implementations, malicious websites frequently appear on mobile networks, causing disruption to users' lives and work.

[0003] In one possible implementation, malicious URL detection and blocking strategies can be used to reduce the likelihood of accessing malicious websites. For example, electronic devices or browser servers can maintain a blacklist of malicious websites, which can include multiple malicious URL domains. When an electronic device accesses the network, the device or browser server can check the blacklist for the domain name of that network; if the domain name is included in the blacklist, the electronic device can block access to that network.

[0004] However, this method of detecting and blocking malicious websites relies on manual configuration, which is not very timely. For example, network administrators need to add the domain name of the malicious website to the blacklist. Furthermore, this method cannot handle new websites in real time, and malicious websites can circumvent the blacklist by frequently changing their domain names. Summary of the Invention

[0005] This application provides a website identification method and related apparatus. When an electronic device accesses a target website, the server can use immutable data such as the target website's website fingerprint data and website feature data to identify whether the target website is a malicious website. In cases where malicious URLs from the same origin can easily evade blocking by changing their domain names, immutable data can be used to accurately identify malicious websites, thereby improving the success rate of blocking malicious websites, enhancing the security of accessing websites, and improving the user's online experience.

[0006] In a first aspect, embodiments of this application provide a website identification method applied to a server. The method includes: the server receiving target website information sent by an electronic device, wherein the target website information includes website fingerprint data and website feature data of the target website; and when the website fingerprint data of the target website is the same as the website fingerprint data of a target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website, the server sends an interception instruction to the electronic device, the interception instruction being used to intercept the target website.

[0007] It should be noted that the server in this application embodiment can be a browser server.

[0008] In this way, when electronic devices access a target website, the target website information can be used to detect whether the target website is malicious, thereby improving the security of website access. At the same time, website fingerprint data and website feature data are not easy to modify, and malicious websites can be more accurately identified through immutable data, so as to reduce the situation where malicious URLs from the same origin can easily evade blocking by changing domain names.

[0009] Optionally, the target website's website fingerprint data includes at least one of the following: the target website's title or the target website's metadata.

[0010] In this way, the title and metadata of the target website can be uniquely identified, and different websites have different titles and metadata; this helps to accurately identify and distinguish different websites; in addition, since the title and metadata are usually in text format, the server can quickly match and compare them, improving matching efficiency.

[0011] Optionally, the website characteristic data of the target website includes information on the web page resources of the target website and the calling relationships between web page resources; the web page resources include at least one of the following: internal resources, external resources called when accessing internal resources, or backend interfaces, wherein internal resources are resources with the same domain name as the domain name of the target website, and external resources are resources with a different domain name than the domain name of the target website; the information on the web page resources includes the web page resource name and the web page resource directory; the web page resource directory is used to represent the storage location of the web page resources in the target website; the calling relationships between web page resources include at least one of the following: the internal resource storage hierarchy directory, backend interface information, external link information called when accessing the target website, or the dynamic calling relationship of web page resources.

[0012] While a website's domain name is easily modified, the data in the website fingerprint and website feature data is not easily modified. Therefore, the website fingerprint and website feature data of the same website can be relatively fixed. When using website feature data to identify malicious websites, the identification results obtained by the server are more accurate.

[0013] Optionally, after the server receives the target website information sent by the electronic device, the method further includes: the server matching the target website's website fingerprint data with the website fingerprint data of multiple malicious websites, and matching the target website's website feature data with the website feature data of multiple malicious websites, wherein the multiple malicious websites include the target malicious website.

[0014] In this way, the server can use both website fingerprint data and website feature data to match the target website with multiple malicious websites to determine whether the target website and malicious websites are the same website or have the same origin, thereby improving the accuracy of website identification.

[0015] Optionally, after the server receives the target website information sent by the electronic device, the method further includes: the server matching the target website's website fingerprint data with the website fingerprint data of multiple malicious websites, wherein the multiple malicious websites include the target malicious website; and if the target website's website fingerprint data is the same as the target malicious website's website fingerprint data, the server matching the target website's website feature data with the target malicious website's website feature data.

[0016] In this way, malicious websites can be initially screened out using website fingerprint data, reducing the number of times network feature data is traversed and thus improving the efficiency of website identification. In addition, the browser server can simultaneously verify the target website using both website fingerprint data and website feature data, thereby improving the accuracy of website identification.

[0017] Optionally, the target website information may also include: the URL of the target website; the server's website blacklist database stores the URLs of multiple malicious websites; the method may further include: the server matching the URL of the target website with the URLs of multiple malicious websites in the website blacklist database; the server matching the website fingerprint data of the target website with the website fingerprint data of multiple malicious websites, including: when the URL of the target website and the URLs of multiple malicious websites are all different, the server matching the website fingerprint data of the target website with the website fingerprint data of multiple malicious websites.

[0018] In this way, even if the target website is malicious and its domain name has been modified, it can still be identified as a malicious website, improving the accuracy of website identification and enhancing the security of accessing the website; at the same time, it can reduce the number of times website fingerprint data and website feature data are matched, thereby improving the overall processing efficiency.

[0019] Optionally, in the website blacklist database, each URL among multiple malicious website URLs corresponds to a website type and an interception policy; the website type is used to characterize the risk level of the malicious website, and the interception policy corresponds to the website type; before the server sends an interception instruction to the electronic device, the process includes: the server matching the URL of the target malicious website with the URLs of multiple malicious websites in the website blacklist database; if the URL of the target malicious website is included in the website blacklist database, the server obtains the website type and interception policy corresponding to the URL of the target malicious website from the website blacklist database; the server sending the interception instruction to the electronic device includes: the server sending the website type and interception policy corresponding to the URL of the target malicious website to the electronic device.

[0020] In this way, when the website blacklist includes a website from the same origin as the target website (such as a malicious website), the server can handle the target website in the same way as it handles the malicious website. Thus, when the security of the target website cannot be determined using the URL in the website blacklist, the target website can be blocked by the website type and blocking strategy of the same origin website, thereby improving the security of accessing the website.

[0021] Optionally, after the server sends the website type and blocking policy corresponding to the URL of the target malicious website to the electronic device, the method further includes: the server adding the URL of the target website, the website type and blocking policy corresponding to the URL of the target malicious website to the website blacklist database.

[0022] This allows for timely updates to the URLs in the website blacklist. When a user subsequently accesses the target website again using an electronic device, the browser server can quickly detect the risk of the target website through the domain name of the URL in the website blacklist, thereby improving the efficiency of website identification and malicious website blocking.

[0023] Optionally, after the server receives the target website information sent by the electronic device, the method further includes: the server cleaning the variable data in the website feature data of the target website.

[0024] In this way, after cleaning the website fingerprint data and website feature data, immutable data can be retained in the website fingerprint data and website feature data. Compared with the mutable data, this immutable data is more stable, and malicious websites cannot evade interception by modifying the website fingerprint data and website feature data, thereby improving the accuracy of malicious website identification and improving the security of users' online activities.

[0025] Optionally, the website feature data of the target website is obtained based on the request initiator chain when an electronic device accesses the target website. The website feature data of the target website includes multiple web page resource links of the target website. The server cleans the variable data in the website feature data of the target website, including: the server removes the variable data in the multiple web page resource links of the target website and retains the immutable data. The variable data includes at least one of the following: the value of the query parameter in the multiple web page resource links, the domain name of the internal resource, or the file name of the media resource in the web page resource. The immutable data includes at least one of the following: the file name and storage location of the CSS style file, the file name and storage location of the JS script file, the storage location of the media resource, the domain name of the external link, or the dynamic calling relationship between multiple web page resource links. The dynamic calling relationship between multiple web page resource links is used to characterize the calling relationship between the web page resource link and one or more sub-web page resource links when accessing the web page resource link.

[0026] In this way, after cleaning the website fingerprint data and website feature data, immutable data can be retained in the website fingerprint data and website feature data. Compared with the mutable data, this immutable data is more stable, and malicious websites cannot evade interception by modifying the website fingerprint data and website feature data, thereby improving the accuracy of malicious website identification and improving the security of users' online activities.

[0027] Optionally, the method further includes: the server matching the URL of the target website with the URLs of multiple malicious websites in a website blacklist database; if the URL of the target website is included in the website blacklist database, the server matching the website fingerprint data and website feature data of the target website with the website fingerprint data and website feature data of multiple malicious websites; if the website fingerprint data of the target website is different from the website fingerprint data of the target malicious website, or if the website feature data of the target website is different from the website feature data of the target malicious website, the server adding the website fingerprint data and website feature data of the target website.

[0028] This automatically synchronizes the website fingerprint data and website feature data of malicious websites in the website blacklist to the website feature database, facilitating the subsequent interception of websites with the same origin as the malicious website, thereby improving the accuracy of website identification. Simultaneously, after the target website version is upgraded, the browser server can promptly update the relevant information of the target website in the website feature database, ensuring the accuracy and timeliness of the data in the website feature database, further enhancing the accuracy of website identification.

[0029] Optionally, the target website's metadata includes at least one of the following: the target website's name attribute, http-equip attribute, or content attribute; the name attribute includes at least one of the following: the target website's keyword information, the target website's description information, the target website's author information, or the target website's generator; the http-equip attribute includes at least one of the following: content-type, refresh information, or expiration information.

[0030] Optionally, the server may include a website signature database, which may store website fingerprint data and website signature data of multiple malicious websites.

[0031] Secondly, embodiments of this application provide a website identification method applied to an electronic device. The method includes: in response to an operation for accessing a target website, the electronic device collects target website information; wherein the target website information includes website fingerprint data and website feature data of the target website; the electronic device sends the target website information to a server; the electronic device receives an interception instruction sent by the server, the interception instruction being used to intercept the target website, the interception instruction being sent by the server to the electronic device when the website fingerprint data of the target website is the same as the website fingerprint data of a target malicious website, and the website feature data of the target website is the same as the website feature data of a target malicious website; the electronic device stops accessing the target website according to the interception instruction.

[0032] In this way, when electronic devices access a target website, the target website information can be used to detect whether the target website is malicious, thereby improving the security of website access. At the same time, website fingerprint data and website feature data are not easy to modify, and malicious websites can be more accurately identified through immutable data, so as to reduce the situation where malicious URLs from the same origin can easily evade blocking by changing domain names.

[0033] Optionally, the target website's website fingerprint data includes at least one of the following: the target website's title or the target website's metadata.

[0034] In this way, the title and metadata of the target website can be uniquely identified, and different websites have different titles and metadata; this helps to accurately identify and distinguish different websites; in addition, since the title and metadata are usually in text format, the server can quickly match and compare them, improving matching efficiency.

[0035] Optionally, the website characteristic data of the target website includes information on the web page resources of the target website and the calling relationship between web page resources; the web page resources include at least one of the following: internal resources, external resources or backend interfaces called when accessing internal resources, wherein internal resources are resources with the same domain name as the domain name of the target website, and external resources are resources with a different domain name than the domain name of the target website; the information on the web page resources includes at least one of the following: web page resource name or web page resource directory; the web page resource directory is used to represent the storage location of the web page resources in the target website; the calling relationship between web page resources includes at least one of the following: internal resource storage hierarchy directory, backend interface information, external link information called when accessing the target website, or dynamic calling relationship of web page resources.

[0036] While a website's domain name is easily modified, the data in the website fingerprint and website feature data is not easily modified. Therefore, the website fingerprint and website feature data of the same website can be relatively fixed. When using website feature data to identify malicious websites, the identification results obtained by the server are more accurate.

[0037] Optionally, the interception instruction includes the website type and interception policy corresponding to the URL of the target malicious website; the electronic device stops accessing the target website according to the interception instruction, including: the electronic device cancels the display of the webpage of the target website and displays a prompt message; the prompt message is used to inform the user that the target website is a malicious website; the prompt message corresponds to the website type and interception policy corresponding to the URL of the target malicious website; the website type is used to characterize the risk level of the target malicious website, and the interception policy corresponds to the website type.

[0038] In this way, when the target website is malicious, the electronic device will stop accessing the target website and remind the user through a prompt message, thereby improving the security of website access.

[0039] Optionally, the target website's metadata includes at least one of the following: the target website's name attribute, http-equip attribute, or content attribute; the name attribute includes at least one of the following: the target website's keyword information, the target website's description information, the target website's author information, or the target website's generator; the http-equip attribute includes at least one of the following: content-type, refresh information, or expiration information.

[0040] Optionally, before the browser server adds the website fingerprint data and website feature data of the target website to the website feature database, the method further includes: the browser server performing statistics on the target website information to obtain website fingerprint data and website feature data of multiple target websites; the server adding the website fingerprint data and website feature data of the target website includes: within a preset time period, if the number of website fingerprint data and website feature data of the target website is greater than a preset number, the website fingerprint data of multiple target websites is the same, and the website fingerprint data of multiple target websites is the same, then the browser server adds the website fingerprint data and website feature data of the target website to the website feature database.

[0041] In this way, the correlation between website fingerprint data and website feature data and the target website can be improved by increasing the number of times and time, thereby improving the accuracy of data in the website feature database and the accuracy of subsequent website identification.

[0042] Thirdly, embodiments of this application provide a website identification method applied to a website identification system. The website identification system includes a server and an electronic device. The method includes: in response to an operation for accessing a target website, the electronic device collects target website information, wherein the target website information includes website fingerprint data and website feature data of the target website; the electronic device sends the target website information to the server; the server receives the target website information; if the website fingerprint data of the target website is the same as the website fingerprint data of a target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website, the server sends an interception command to the electronic device, the interception command being used to intercept the target website; the electronic device stops accessing the target website according to the interception command.

[0043] In this way, in the website identification system, when an electronic device accesses a target website, the server can detect whether the target website is a malicious website through the target website information, thereby improving the security of accessing the website; at the same time, website fingerprint data and website feature data are not easy to modify, and malicious websites can be more accurately identified through immutable data, so as to reduce the situation where malicious URLs from the same origin can easily evade blocking by changing domain names.

[0044] Fourthly, embodiments of this application provide a server including one or more processors and a memory, the memory for storing code instructions, and the processor for running the code instructions to perform the methods described in the first aspect or any possible implementation of the first aspect.

[0045] Fifthly, embodiments of this application provide an electronic device including one or more processors and a memory, the memory for storing code instructions, and the processor for executing the code instructions to perform the methods described in the second aspect or any possible implementation of the second aspect.

[0046] Sixthly, embodiments of this application provide a website identification system, which includes a server and an electronic device. The server is used to execute the method described in the first aspect or any possible implementation of the first aspect, and the electronic device executes the method described in the second aspect or any possible implementation of the second aspect.

[0047] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing a computer program or instructions that, when executed on a server, cause the server to perform the method described in the first aspect or any possible implementation thereof; or, when executed on an electronic device, cause the electronic device to perform the method described in the second aspect or any possible implementation thereof.

[0048] Eighthly, embodiments of this application provide a computer program product including a computer program, which, when run on a server, causes the server to perform the methods described in the first aspect or any possible implementation of the first aspect; or, when run on an electronic device, causes the electronic device to perform the methods described in the second aspect or any possible implementation of the second aspect.

[0049] Ninthly, this application provides a chip or chip system including at least one processor and a communication interface, the communication interface and the at least one processor being interconnected via a circuit, the at least one processor being used to execute computer programs or instructions to cause a server to perform the methods described in the first aspect or any possible implementation thereof; or to cause an electronic device to perform the methods described in the second aspect or any possible implementation thereof. The communication interface in the chip may be an input / output interface, pins, or circuits, etc.

[0050] In one possible implementation, the chip or chip system described above in this application further includes at least one memory storing instructions. The memory can be an internal storage unit of the chip, such as a register or cache, or it can be a storage unit of the chip itself (e.g., read-only memory, random access memory, etc.).

[0051] It should be understood that the third to ninth aspects of this application correspond to the technical solutions of the first or second aspects of this application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation are similar, and will not be repeated here. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of a website recognition system provided in an embodiment of this application.

[0053] Figure 2 This is a schematic diagram of the structure of the electronic device 100 provided in the embodiments of this application;

[0054] Figure 3 A software structure block diagram of the electronic device 100 provided in the embodiments of this application;

[0055] Figure 4 This is a schematic diagram of the structure of a browser server provided in an embodiment of this application;

[0056] Figure 5 A schematic diagram of the interface for the website identification method provided in this application embodiment;

[0057] Figure 6 A flowchart illustrating the website identification method provided in this application embodiment;

[0058] Figure 7 A schematic diagram illustrating the process of identifying malicious websites provided in an embodiment of this application;

[0059] Figure 8 A schematic diagram illustrating the process of updating the website blacklist database provided in this application embodiment;

[0060] Figure 9 A schematic diagram illustrating the process of creating or updating a website feature database as provided in this application embodiment;

[0061] Figure 10 A schematic diagram illustrating the process of updating the database provided in an embodiment of this application;

[0062] Figure 11 A flowchart illustrating the website identification method provided in this application embodiment;

[0063] Figure 12 This is a schematic diagram of the server structure provided in an embodiment of this application;

[0064] Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings. It should be understood that in the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0066] To facilitate understanding, the relevant terms and concepts involved in the embodiments of this application will be introduced below:

[0067] 1. Cascading Style Sheets (CSS): A computer language used to style documents such as HyperText Markup Language (HTML) or Extensible Markup Language (XML). CSS can not only statically format web pages, but also dynamically format various elements of a web page in conjunction with various scripting languages.

[0068] 2. JavaScript (JS): A dynamic programming language widely used in web development, primarily to enhance the interactivity and dynamism of web pages.

[0069] 3. Uniform Resource Locator (URL): A standardized address format used to specify the location of resources on the Internet. A URL can include the following information: protocol, domain name, port, path, query parameters, and / or fragment identifiers. For example, a URL could be https: / / www.xxxxxx.com.cn:8080 / path / to / resource?query=123#section; where the protocol can be https; the domain name identifies the server where the specified resource is located, such as www.xxxxxx.com.cn; the port can be 80; the path can be / path / to / resource; the query parameter can be ?query=123; and the fragment identifier can be #section.

[0070] 4. Electronic equipment

[0071] The electronic devices in this application embodiment can be referred to as user equipment (UE), terminal, etc. For example, electronic devices can be mobile phones, tablets, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices, in-vehicle devices or wearable devices, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in smart homes, etc. The form of the electronic devices is not specifically limited in this application embodiment.

[0072] In some implementations, when electronic devices access a target website, they may encounter a situation where the target website is malicious, causing disruption to the user's life and work.

[0073] In one possible implementation, malicious URLs could be identified through website domain names. For example, electronic devices or browser servers could maintain a blacklist of malicious websites, which might include the domain names of multiple manually configured malicious URLs. When an electronic device accesses a target website, it could obtain the target website's domain name and determine whether it's included in the blacklist. If the domain name is in the blacklist, the electronic device would block access to the target website; otherwise, it could safely access the target website.

[0074] Understandably, blacklists rely on manual configuration, which is inefficient. Furthermore, malicious websites can circumvent blacklists by changing their domain names; for example, if a malicious website domain like aaaaaa.com.com is on the blacklist, and it changes its domain to bbbbbb.com.com, electronic devices can no longer block it through the blacklist, making this blocking method easily circumvented.

[0075] In view of this, embodiments of this application provide a website identification method. When accessing a target website, an electronic device can obtain the website fingerprint data and website feature data of the target website and send this data to a browser server. The browser server can compare the website fingerprint data and website feature data of the target website with the website fingerprint data and website feature data of a malicious website. If they are the same, it indicates that the target website is a malicious website, and the electronic device can stop accessing the target website. If they are different, it indicates that the target website is not a malicious website, and the electronic device can safely access the target website. Website fingerprint data can be used for initial identification and rapid screening of malicious websites. For example, website fingerprint data may include at least one of the following basic information: website title or meta metadata in HTML. Website feature data can be used for further identification and screening of malicious websites. For example, website feature data may include at least one of the following website structure information: internal resources, external resources, API calls, or dynamic call relationships. It is understood that website fingerprint data and website feature data include immutable data, so they are not easily tampered with. Thus, when malicious URLs from the same origin can easily evade interception by changing domain names, malicious websites can be accurately identified through the immutable data in the basic information and website structure information, thereby improving the success rate of intercepting malicious websites, enhancing website security, and improving the user's online experience.

[0076] Let's combine the following... Figure 1The use cases of the network identification system in the embodiments of this application are described, such as... Figure 1 As shown:

[0077] The network identification system may include a browser client, a browser server, and a database; wherein, the browser client can be used to access the target website; the browser server can be used to detect the security of the target website; the database can be used to store relevant data of malicious websites, such as the domain name of the malicious website (or URL, which is not limited in this application embodiment), website fingerprint data and website feature data of the malicious website, etc.

[0078] Specifically, a browser client may include one or more electronic devices, such as mobile phones, tablets, and computers, that are capable of accessing the internet. For example, electronic device 1 may be a mobile phone, and electronic device 2 may be a computer. The browser client can communicate with a website server to access the target website; the browser client can also communicate with a browser server to send relevant information about the target website to the browser server.

[0079] The database may include a website blacklist and a website signature database. The website blacklist may include the URLs of multiple malicious websites; the website signature database may include website fingerprint data and website feature data of multiple malicious websites. The database can communicate with a browser server to provide the browser server with the URLs, website fingerprint data, and website feature data of malicious websites. In this embodiment, the database can be an internal database integrated into the browser server; alternatively, the database can be an external database, with the browser server communicating with it via a specific protocol, thereby enabling data storage and retrieval. This embodiment does not impose any limitations on this.

[0080] A browser server may include one or more servers, and multiple servers can form a server cluster, such as Server 1 and Server 2. The browser server can communicate with browser clients and a database to detect the security of a target website. For example, the browser server can obtain data such as the target website's URL, website fingerprint data, and website characteristic data from the browser server, and obtain data such as the URL, website fingerprint data, and website characteristic data of malicious websites from the database; the browser server compares the two sets of data to determine whether the target website is malicious; if the target website is malicious, the browser server restricts the browser client's access to the target website.

[0081] The following uses the browser client as electronic device 100, combined with... Figure 2 The structure of the electronic device 100 will be described. For example... Figure 2As shown, electronic device 100 may include processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, subscriber identification module (SIM) card interface 195, and embedded secure element (eSE) chip 196, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0082] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0083] Processor 110 may include one or more processing units, such as application processors (APs), modem processors, graphics processing units (GPUs), image signal processors (ISPs), controllers, video codecs, digital signal processors (DSPs), baseband processors, and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors. In this embodiment, processor 110 can be used to execute information processing flows related to website identification methods.

[0084] The wireless communication function of electronic device 100 can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0085] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Mobile communication module 150 can provide wireless communication solutions, including 2G / 3G / 4G / 5G, for use on electronic device 100. Wireless communication module 160 can provide wireless communication solutions, including wireless local area networks (WLANs) (such as Wireless Fidelity (Wi-Fi) networks), Bluetooth (BT), Global Navigation Satellite System (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies, for use on electronic device 100.

[0086] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with networks and other devices via wireless communication technology. Wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. GNSS can include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0087] In this embodiment, the electronic device 100 can communicate with the website server via antenna 1, antenna 2, mobile communication module 150, and wireless communication module 160 to access the website. The electronic device 100 can also communicate with a browser server via antenna 1, antenna 2, mobile communication module 150, and wireless communication module 160 to identify the website.

[0088] The electronic device 100 implements display functions through a GPU, a display screen 194, and an application processor. The display screen 194 is used to display images, videos, etc. In this embodiment, the display screen 194 can be used to display website pages when accessing a website, as follows: Figure 5 The interface shown.

[0089] Internal memory 121 can be used to store executable program code, including instructions. Internal memory 121 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area may store data created during the use of electronic device 100 (such as audio data, phonebook, etc.). Furthermore, internal memory 121 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. Processor 110 executes various functional applications and data processing of electronic device 100 by running instructions stored in internal memory 121 and / or instructions stored in memory located within the processor.

[0090] The software system of electronic device 100 can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture, etc. This application embodiment uses the layered architecture Android system as an example to exemplify the software structure of electronic device 100.

[0091] Figure 3 This is a software structure block diagram of an electronic device provided in an embodiment of this application. For example... Figure 3 As shown, the software architecture of an electronic device can be a layered architecture. For example, the software can be divided into several layers, each with a clear role and division of labor. Layers communicate with each other through software interfaces. In some embodiments, the operating system is divided into four layers, from top to bottom: the application layer, the application framework layer (framework, FWK), the runtime and system libraries, and the kernel layer.

[0092] The application layer can include a series of application packages. For example... Figure 3 As shown, the application layer may include camera, calendar, map, phone, music, settings, email, video, browser, etc. In this embodiment, the electronic device can use a browser to access the network.

[0093] The application framework layer provides an application programming interface (API) and programming framework for applications in the application layer. The application framework layer can include some predefined functions. For example... Figure 3 As shown, the application framework layer may include a window manager, content provider, view system, phone manager, resource manager, and notification manager.

[0094] The window manager is used to manage windowed applications. It can retrieve screen size, determine the presence of a status bar, lock the screen, and capture screenshots, among other things.

[0095] Content providers store and retrieve data, making that data accessible to applications. This data can include videos, images, audio, phone calls made and received, browsing history and bookmarks, phone books, and more.

[0096] A phone manager is used to provide communication functions for electronic devices. For example, it manages call status (including connection and disconnection).

[0097] A view system includes visual controls, such as controls for displaying text and controls for displaying images. View systems can be used to build applications. A display interface can consist of one or more views. For example, a display interface including a text notification icon could include views for displaying text and views for displaying images.

[0098] The notification manager allows applications to display notifications in the status bar. These notifications can be used to deliver informational messages and can disappear automatically after a short pause, requiring no user interaction. For example, the notification manager can be used to notify users of completed downloads or message alerts. The notification manager can also display notifications as icons or scrolling text in the top status bar, such as notifications from background applications, or as dialog boxes on the screen. Examples include displaying text messages in the status bar, emitting sounds, vibrating electronic devices, and flashing indicator lights.

[0099] The file explorer provides applications with various resources, such as localized strings, icons, images, layout files, video files, and more.

[0100] The runtime includes the core libraries and the virtual machine. The runtime is responsible for the scheduling and management of the operating system.

[0101] The core library consists of two parts: one part contains the functionalities that the Java language needs to call, and the other part contains the core libraries of the operating system. The application layer and application framework layer run in the virtual machine. The virtual machine executes the Java files of the application layer and application framework layer as binary files. The virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0102] System libraries can include multiple functional modules. For example: surface manager, media libraries, 3D graphics processing libraries (e.g., OpenGL ES), 2D graphics engines (e.g., SGL), image processing libraries, etc.

[0103] The Surface Manager is used to manage the display subsystem and provides the blending of 2D and 3D layers for multiple applications.

[0104] The media library supports playback and recording of various common audio and video formats, as well as still image files. It supports multiple audio and video encoding formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG.

[0105] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0106] A 2D graphics engine is a graphics engine for 2D drawing.

[0107] The kernel layer is the layer between hardware and software. The kernel layer contains at least the display driver, camera driver, audio driver, and sensor driver.

[0108] The hardware layer can include various types of sensors, such as accelerometers, gyroscopes, and touch sensors.

[0109] It should be noted that, Figure 2 and Figure 3 The structure shown is merely an example of an electronic device provided in this application embodiment and is not intended to limit the electronic device provided in this application embodiment in any way. In specific implementations, the electronic device may have more than Figure 2 or Figure 3 The structure shown may contain more or fewer devices or modules.

[0110] For example, Figure 4 This is a schematic diagram of the structure of a browser server provided in one embodiment of this application.

[0111] The browser server includes at least one processor 401, a communication line 402, a memory 403, and at least one communication interface 404. The memory 403 may also be included within the processor 401.

[0112] The processor 401 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0113] Communication line 402 may include a path for transmitting information between the aforementioned components.

[0114] Communication interface 404 is used for communication with other devices. In this embodiment, the communication interface can be a module, circuit, bus, interface, transceiver, or other device capable of communication functions, used for communication with other devices. Optionally, when the communication interface is a transceiver, the transceiver can be a separately configured transmitter used to send information to other devices, or it can be a separately configured receiver used to receive information from other devices. The transceiver can also be a component that integrates sending and receiving information functions; this embodiment does not limit the specific implementation of the transceiver.

[0115] The memory 403 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processor via communication line 402. The memory may also be integrated with the processor.

[0116] The memory 403 stores computer execution instructions for implementing the solution of this application, and its execution is controlled by the processor 401. The processor 401 executes the computer execution instructions stored in the memory 403, thereby implementing the website identification method provided in the following embodiments of this application.

[0117] Optionally, the computer execution instructions in the embodiments of this application may also be referred to as application code, instructions, computer program or other names, and the embodiments of this application do not specifically limit them.

[0118] In a specific implementation, as one example, processor 401 may include one or more CPUs, for example... Figure 4 CPU0 and CPU1 in the CPU.

[0119] In a specific implementation, as one example, a browser server may include multiple processors, for example... Figure 4Processors 401 and 405 are described herein. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0120] In this embodiment, after the browser server receives target website information sent by the electronic device through the communication interface 404, it can match the target website information with information about malicious websites through the processor 401 to identify whether the target website is malicious. If the target website is malicious, the processor 401 can generate an interception command and send the interception command to the electronic device through the communication interface 404 to intercept the target website.

[0121] Figure 4 The structure shown is merely an example of a browser server provided in this application embodiment and should not be construed as limiting the browser server provided in this application embodiment. In specific implementations, the browser server may have more than Figure 4 The structure shown may contain more or fewer devices or modules.

[0122] Taking a mobile phone as an example, a scenario where a browser server intercepts a browser client's access to a malicious website could be as follows: Figure 5 As shown:

[0123] Electronic devices can launch browser applications and display such as Figure 5 The interface shown in 'a' may include a search box 501. Taking a user entering a website URL as an example, search box 501 may include the website domain name entered by the user, such as bbbbbb.com. The domain name bbbbbb.com may be a domain with the same origin URL as the malicious website domain aaaaaa.com, and aaaaaa.com may be included in the blacklist.

[0124] exist Figure 5 In the interface shown as 'a', when a trigger action (such as a click) is received on the search control, the electronic device may attempt to access the website corresponding to the domain name in the search box. It should be understood that since aaaaaa.com and bbbbbb.com are domains with the same origin URL, meaning the website fingerprint and website feature data corresponding to aaaaaa.com are identical to those corresponding to bbbbbb.com, the electronic device can identify bbbbbb.com as a malicious website. At this point, the electronic device may display a website blocking interface, such as... Figure 5 The interface shown in b is shown in the image.

[0125] Figure 5The interface shown in b may include a risk warning control 502, a risk warning message 503, and a return control 504. The risk warning control 502 can be used to view details of website blocking. The risk warning message 503 is used to remind the user that accessing the current website poses a risk; for example, the risk warning message 503 could be "Access to this webpage has been stopped." The return control 504 can be used to return to the previous page, for example, to... Figure 5 The interface shown in Figure 'a'.

[0126] Understandably, in response to a trigger action on a search control, an electronic device may request network access from a website server, and the electronic device may instruct a browser server to perform a security check on a target website.

[0127] In some embodiments, the browser server's security checks are faster than the electronic device's network access process, allowing the electronic device to intercept the website access process before it successfully accesses the site. For example, in response to a trigger action on a search control, the electronic device may display something like... Figure 5 The website blocking interface shown in b is shown in the image.

[0128] In other embodiments, the browser server's security check of a website is slower than the electronic device's access to the network. The electronic device can successfully access the website first, and then block the access process after detecting that the target website is malicious. For example, in response to a trigger action on a search control, the electronic device can display a webpage corresponding to, for example, bbbbbb.com; subsequently, the electronic device can display, for example, ... Figure 5 The interface shown in b is not limited in this embodiment.

[0129] exist Figure 5 In the interface shown in b, when a trigger operation is received for the risk warning control 502, the electronic device can display a risk warning pop-up window 505, such as... Figure 5 The interface shown in c is as follows. The risk warning pop-up 505 may include malicious website information 506, risk warning information 507, and multiple security controls 508.

[0130] Malicious website information 506 may include the domain name and URL of the malicious website, such as the domain name of the malicious website being "bbbbbb.com" and the URL being https: / / bbbbbb.com. Risk warning information 507 can be used to remind users that visiting the current website poses a risk; for example, risk warning information 507 could be "This website poses a security risk. For the security of your personal information, please visit with caution."

[0131] Multiple security controls 508 may include at least one of the following: an ad-filtering control, a control to block tracking cookies, a control to block unauthorized webpage downloads, or a control to block unauthorized webpage redirects. An ad-filtering control indicates the number of times advertising websites are blocked, reducing ad interference. A control to block tracking cookies indicates the number of times tracking cookie websites are blocked, preventing users' online behavior from being tracked and protecting user privacy. A control to block unauthorized webpage downloads indicates the number of times software downloads and installations are blocked, preventing malicious or unwanted software from being installed on electronic devices without the user's knowledge. A control to block unauthorized webpage redirects indicates the number of times unauthorized webpage redirects are blocked, protecting electronic devices from malicious websites.

[0132] It should be noted that the electronic device in this application embodiment can execute different blocking strategies based on the website type of the malicious website. The website type describes the risk level of the malicious website; for example, for a malicious website with a high risk level, the electronic device can block access to that malicious website. Figure 5 The relevant descriptions in the illustrated embodiments are as follows. For malicious websites with low risk levels, the electronic device can prompt the user that the malicious website poses a risk, allowing the user to choose whether to continue accessing the malicious website (not shown in the figure). This application embodiment does not impose any limitations on this.

[0133] In this way, even if the domain name of the malicious website is not included in the blacklist, electronic devices can search for malicious websites with the same origin as the target website in the blacklist, thereby identifying the target website as malicious. This reduces the chances of malicious websites circumventing blocking by changing their domain names, thus increasing the success rate of blocking malicious websites, improving the security of accessing websites, and enhancing the user's online experience.

[0134] The website identification method provided in this application will be described below with reference to specific embodiments. These embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0135] Figure 6 This is a flowchart illustrating the website identification method provided in an embodiment of this application. (Refer to...) Figure 6 The website identification method provided in this application embodiment may include:

[0136] S601. In response to an operation for accessing a target website, the electronic device collects information about the target website.

[0137] Operations for accessing a target website can include, for example, a user entering the domain name or URL of the target website in the search box of a browser application and then clicking the search control; another example is a user entering keywords in the search box of a browser application and then clicking the search control, displaying search results on the electronic device, and then the user selecting the target website's search result from multiple search results; the keywords can be entered as text or spoken words. Yet another example is a user scanning a scannable code using an electronic device, where the scannable code corresponds to a website link of the target website. Yet another example is a user quickly accessing the target website through bookmarks or history in a browser application. This application does not limit these operations.

[0138] The target website information includes the target website's URL, website fingerprint data, and website feature data. The target website's URL may include its protocol, domain name, port, path, query parameters, and / or fragment identifiers. The target website's fingerprint data may include at least one of the following: the target website's title or meta metadata. The website feature data may include at least one of the following: information about the website's structure, such as internal resources, external resources accessed when accessing internal resources, API calls, or dynamic call relationships. The website fingerprint data and website feature data will be described in detail later in this application; they will not be elaborated upon here.

[0139] It should be noted that in this embodiment of the application, the domain name of the website is easy to modify, but the data in the website fingerprint data and website feature data is not easy to modify. Therefore, the website fingerprint data and website feature data of the same website can be relatively fixed.

[0140] S602. The electronic device sends the target website information to the browser server and instructs the browser server to perform URL detection.

[0141] The browser server can receive target website information and perform URL detection based on the target website information. The URL detection process is shown in step S603:

[0142] S603, The browser server uses the target website information to match data in the database.

[0143] The database may include a website blacklist and a website signature database. It is understood that target website information may include the target website's URL, website fingerprint data, and website signature data. In some embodiments, the browser server may detect whether a target website is malicious based on its URL. In other embodiments, the browser server may detect whether a target website is malicious based on both its website fingerprint data and its website signature data.

[0144] For example, in the first possible implementation, the browser server can detect whether the target website is a malicious website by using the target website's website fingerprint data and website feature data.

[0145] For example, a browser server can obtain website fingerprint data and website feature data of multiple malicious websites from a website feature database; it can then match the target website's website fingerprint data and website feature data with those of the multiple malicious websites; if they match, the target website is considered malicious; otherwise, if they do not match, the target website is not considered malicious.

[0146] In this way, malicious websites can be detected through website fingerprint data and website feature data, thereby improving the accuracy of website identification.

[0147] In the second possible implementation, the browser server can first detect whether the target website is a malicious website through the target website's URL; then, it can further detect whether the target website is a malicious website through the target website's website fingerprint data and website feature data.

[0148] For example, a browser server can retrieve the URLs of multiple malicious websites from a website blacklist database; compare the target website's URL with the URLs of the multiple malicious websites; if they match, the target website is a malicious website; or, if they do not match, the browser server can retrieve the website fingerprint data and website feature data of the multiple malicious websites from a website signature database; compare the target website's website fingerprint data and website feature data with the website fingerprint data and website feature data of the multiple malicious websites; if they match, the target website is a malicious website; or, if they do not match, the target website is not a malicious website.

[0149] In this way, even if the target website is malicious and its domain name has been modified, it can still be identified as a malicious website, improving the accuracy of website identification and enhancing the security of accessing the website; at the same time, it can reduce the number of times website fingerprint data and website feature data are matched, thereby improving the overall processing efficiency.

[0150] S604. If the database includes information about the target website, the browser server instructs the electronic device to stop accessing the target website.

[0151] The database may include target website information in the following ways: the target website's domain name is included in the website blacklist database, and / or the target website's website fingerprint data and website characteristic data are included in the website feature database. In this case, the browser server can determine that the target website is malicious and thus block the electronic device from accessing it. Afterwards, the electronic device can stop accessing the target website; for example, the electronic device may display... Figure 5 The interface shown in b is shown in the image.

[0152] Optionally, the S605 browser server writes the target website information into the database.

[0153] The browser server can supplement or update the data in the database.

[0154] For example, after identifying a target website as malicious, if the website blacklist database includes the target website's URL, but the website signature database does not include the target website's website fingerprint data and website signature data, then the browser server can add the target website's website fingerprint data and website signature data to the website signature database.

[0155] For example, after identifying a target website as malicious, if the website signature database includes the target website's website fingerprint data and website feature data, but the website blacklist database does not include the target website's URL, then the browser server can add the target website's URL to the website blacklist database.

[0156] Alternatively, after identifying the target website as a malicious website, if the website blacklist database includes the target website's URL, and the website feature database includes the target website's website fingerprint data and website feature data, then the browser server may not execute step S605, i.e., step S605 is an optional step.

[0157] For example, the website identification method provided in this application embodiment can achieve the following effects, as shown in Table 1:

[0158] Table 1 Expected Results

[0159]

[0160]

[0161] For example, the same website may correspond to multiple URLs at different times by changing its domain name; however, these multiple URLs are all from the same origin. The website blacklist database includes https: / / aaaaaa.com, but not https: / / bbbbbb.com or https: / / cccccc.com / . If only domain-based malicious website detection is used, the browser server can only detect the target website with the domain name aaaaaa.com, and cannot detect the target websites with the domain names bbbbbb.com and cccccc.com. Electronic devices may access these malicious websites, increasing the risk of network access problems. However, in this embodiment, based on website fingerprint data and website feature data, bbbbbb.com and cccccc.com can be identified as websites from the same origin as aaaaaa.com, thereby determining bbbbbb.com and cccccc.com as malicious URLs and controlling electronic devices to stop accessing bbbbbb.com and cccccc.com.

[0162] Thus, during the process of electronic devices accessing target websites, the security of accessing websites can be improved by detecting whether the target website is a malicious website through target website information. At the same time, website fingerprint data and website feature data are not easy to modify, and malicious websites can be more accurately identified through immutable data, so as to reduce the situation where malicious URLs from the same origin can easily evade blocking by changing domain names.

[0163] The following is combined Figure 7 The website identification method in the embodiments of this application will be further described. For example... Figure 7 As shown:

[0164] S701, In response to an operation for accessing a target website, the electronic device collects the URL of the target website, the website fingerprint data of the target website, and the website feature data of the target website.

[0165] When accessing a target website, electronic devices can collect the website's HTML source code's Meta metadata and website title as website fingerprint data; and electronic devices can collect information about web page resources loaded by the Request Initiator Chain and the calling relationships between web page resources as website feature data.

[0166] The web page resources can include at least one of the following: internal resources, external resources called when accessing internal resources, or backend interfaces, etc.; internal resources can be web page resources stored in a folder on the target website; external resources can be web page resources stored in a folder on an external website loaded when internal resources are called. Web page resources can be at least one of the following: CSS sample files, JS script files, images, audio, or video data, etc. The backend interface is used for communication between various components or functions within the target website.

[0167] To facilitate understanding of the website identification method provided in the embodiments of this application, the website fingerprint data and website feature data are described in detail below with reference to Tables 2 and 3.

[0168] Table 2 shows the information of the website fingerprint data shown in the embodiments of this application, as shown in Table 2:

[0169] Table 2. Information and examples of website fingerprint data.

[0170]

[0171] Website fingerprint data may include at least one of the following: website title or metadata. The website title can be used to define the name of a webpage; metadata may include at least one of the following: name attribute, http-equip attribute, or content attribute.

[0172] Specifically, the name attribute may include at least one of the following: keywords, description, author, generator, or others; keywords are used to specify the keywords of the website's web page content; description can be used to provide a brief description of the website's web page; author can be used to declare the author information of the website's web page; generator can be used to identify the tool or software that generated the web page; others may include other custom metadata for specific applications or needs.

[0173] The `http-equip` attribute can include at least one of the following: `content-type`, `refresh`, or `expire`. `content-type` specifies the Multipurpose Internet Mail Extensions (MIME) type and character encoding of the website's webpages; `refresh` can be used to automatically refresh or redirect the webpage; and `expire` defines the expiration time of the webpage content.

[0174] The `content` attribute is typically used in conjunction with the `name` or `http-equiv` attribute to specify the corresponding value. For example, in Table 2, the sample could be:

[0175] <meta name＝”keywords”content＝”关键词定义”>

[0176] <meta name＝”description”content＝”搜索网站描述”>

[0177] <meta name＝”Author”content＝”作者”>

[0178] <meta name＝”generator”content＝”all”>

[0179] <meta http-equiv＝”content-type”content＝”format＝wml；”>

[0180] <meta http-equiv＝”refresh”content＝”2”>

[0181] The website feature data shown in the embodiments of this application will be described below with reference to Table 3. Taking the target URL https: / / bbbbbb.com as an example, as shown in Table 3:

[0182] Table 3. Information and examples of website feature data.

[0183]

[0184] Website characteristic data may include information about web page resources and the calling relationships between these resources. Specifically, the information about web page resources can be used for static management, describing the file name of each resource and its storage location on the target website; the calling relationships between web page resources can be used for dynamic management, describing the calling relationships between multiple web page resources.

[0185] For example, information about web page resources may include a web page resource directory and web page resource name, etc. Web page resources may include at least one of the following: CSS sample files, JS script files, images, audio or video, etc. The calling relationship between web page resources can be the relationship between web page loading and referencing internal resources, external resources and backend interfaces; for example, at least one of the following: internal resource storage hierarchy directory, backend interface information called when accessing the target website, external link information called when accessing the target website, or dynamic calling relationship of web page resources, etc.

[0186] In this embodiment, the webpage resource name can be the filename of the webpage resource, and the webpage resource directory can be the storage location of the webpage resource on the target website. The webpage resource link (hereinafter referred to as the link) can reflect the filename and storage location of the webpage resource. That is, the filename and storage location of the webpage resource can be used as a type of website characteristic data.

[0187] Specifically, web page resources can be, for example, CSS sample files. CSS sample files can be used to set website styles, such as at least one of the following: page layout, colors, fonts, or spacing. The filename and storage location of the CSS sample file can be considered as website characteristic data. For example, in the link https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css, the CSS style file is named 2023homepro_pc_20240207.css, and it is stored in the directory structure / 2023homepro / css folder.

[0188] Web page resources can include, for example, JavaScript (JS) script files, which can be used to add dynamic functionality to a web page. The filename and storage location of a JS script file can serve as a website characteristic. For instance, in the link https: / / bbbbbb.com / global / js / pageCore.js, the JS script file is named pageCore.js and is stored in the directory structure / global / js folder. Similarly, in the link https: / / bbbbbb.com / 2023homepro / scripts / xhome.js, the JS script file is named xhome.js and is stored in the directory structure / 2023homepro / scripts folder.

[0189] Web page resources can include media resources such as images, audio, and video. The file name and storage location of media resources can be used as a website characteristic data. For example, if the media resource is an image, in the link https: / / bbbbbb.com / 2023homepro / images / icon-down.png, the image file name is icon-down.png, and the image is stored in the directory structure / 2023homepro / images folder. Similarly, in the link https: / / bbbbbb.com / 2023homepro / images / icon-wap.png, the image file name is icon-wap.png, and the image is stored in the directory structure / 2023homepro / images folder.

[0190] In addition to the information about the web page resources mentioned above, website feature data also includes the calling relationships between web page resources.

[0191] Specifically, the calling relationship between web page resources can be at least one of the following: the relationship between web page loading and referencing internal resources, external resources, or backend interfaces; for example, the hierarchical directory of internal resources, the backend interface information called when accessing the target website, the external link information called when accessing the target website, or the dynamic calling relationship of web page resources, etc.

[0192] The calling relationship between web page resources can include the internal resource storage hierarchy directory. Internal resources can be understood as web page resources whose domain name in the link is the same as the domain name of the target website. For example, if the domain name of the link https: / / bbbbbb.com / global / js / pageCore.js is bbbbbb.com, which is the same as the domain name of the target website, then the pageCore.js file corresponding to this link is an internal resource, and this link reflects that the web page loads and references the internal resource pageCore.js file. As another example, if the domain name of the link https: / / bbbbbb.com / 2023homepro / scripts / xhome.js is bbbbbb.com, which is the same as the domain name of the target website, then the xhome.js file corresponding to this link is also an internal resource, and this link reflects that the web page loads and references the internal resource xhome.js file.

[0193] The internal resource storage hierarchy directory can be understood as the position of internal resources within the hierarchical structure of links. For example, the examples shown in Table 3 can be links to multiple web pages corresponding to the target website; there is a hierarchical relationship between multiple links. For example, https: / / bbbbbb.com / 2023homepro / images / icon-down.png can be a sub-link of https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css.

[0194] The calling relationships between web page resources can also include external link information invoked when accessing the target website. External links can be links corresponding to external resources; external resources can be understood as web page resources whose domain name in the linked web page is different from the domain name of the target website. In the example, for instance, the domain name of the external link http: / / a2.dddddd.com / js / xadndelayed.js is a2.dddddd.com, which is different from the domain name of the target website. Therefore, the xadndelayed.js file corresponding to this link is an external resource, and this link reflects that the web page loads and references the external resource xadndelayed.js file. For example, if the domain of the external link http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / 202303200424173763.jpg is a2.xinhuanet.com, which is different from the domain of the target website, then the image 202303200424173763.jpg corresponding to this link is also an external resource. This link can reflect that the webpage loads and references the external resource image 202303200424173763.jpg.

[0195] It is understandable that in the web page resource call relationship, when accessing the target website, relevant information of the external website will also be loaded. The correspondence between this external website information and the target website can also be regarded as the call relationship between web page resources; that is, the domain name of the external website and the directory level of the external resource storage in the external link loading content can all be regarded as the call relationship between web page resources.

[0196] The calling relationships between web page resources can also include information about the backend interfaces called when accessing the target website. Various components or functions within a website may communicate through interfaces; the definitions and calling methods of these interfaces can be considered website characteristic data. For example, in the link http: / / bbbbbb.com / 2023homepro / video / queryList?status=0&page=1&pagesize=10, the backend interface could be / 2023homepro / video / queryList, and the interface parameter keys could include status, page number, and page size.

[0197] The calling relationships between web page resources can also include dynamic calling relationships. Dynamic calling relationships can be understood as the web page resource corresponding to a link needing to load one or more sub-links' corresponding web page resources when a link is invoked. The calling relationships between multiple links in website feature data can have a hierarchical relationship. Hierarchical relationships can be, for example:

[0198] URL1→URL1-1

[0199] →URL1-2

[0200] →URL1-3→URL1-3-1

[0201] →URL1-3-2

[0202] →URL1-4→URL1-4-1

[0203] →URL1-5→URL1-5-1

[0204] →URL1-5-2

[0205] It is understandable that in the above hierarchical relationship, URL1-1, URL1-2, URL1-3, URL1-4, and URL1-5 are the next level after URL1; URL1-3-1 and URL1-3-2 are the next level after URL1-3; URL1-4-1 is the next level after URL1-4; and URL1-5-1 and URL1-5-2 are the next level after URL1-5. When accessing a webpage resource at a higher level, it is necessary to call the webpage resource in the link at the next lower level.

[0206] For example, web page resources can be internal or external. Taking internal resources as an example: https: / / bbbbbb.com / 2023homepro / images / icon-down.png and https: / / bbbbbb.com / 2023homepro / images / icon-wap.png are both sub-links of https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css. When the link https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css is called, the 2023homepro_pc_20240207.css file will navigate to the / 2023homepro / images folder on the target website based on the path provided by the sub-link, and load the icon-down.png and icon-wap.png images respectively.

[0207] Taking external resources as an example: http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / 202303200424173763.jpg and http: / / a2.dddddd.com / download / adcreatives / 2024 / 3 / 4 / 202403040410096477.jpg can be sub-links of http: / / a2.dddddd.com / is / xadndelayed.js. When the link http: / / a2.dddddd.com / is / xadndelayed.js is called, the xadndelayed.js file will navigate to the / download / adcreatives folder of the external website based on the path provided by the sub-link, and load the images 202303200424173763.jpg and 202403040410096477.jpg respectively.

[0208] It is understood that in the embodiments of this application, website fingerprint data and website feature data can be collected simultaneously or sequentially. The embodiments of this application do not restrict the order in which website fingerprint data and website feature data are collected.

[0209] It should be noted that the embodiments of this application are merely specific examples to explain the website fingerprint data and website feature data shown in the embodiments of this application, but these examples do not limit the website fingerprint data and website feature data shown in the embodiments of this application. This application will not repeat this statement.

[0210] It should be noted that in some embodiments, in response to an operation to access a target website, the electronic device can also communicate with a network server to access the target network. That is, step S701 and subsequent steps for detecting the target website can be performed asynchronously with the process of accessing the target website. Taking a malicious website as an example, if the process of detecting the target website is faster than the process of accessing the target website, the electronic device will display the following before loading the target website: Figure 5 The interface shown in b; if the process of accessing the target website is faster than the process of detecting the target website, the electronic device will display the following during the process of accessing the target website: Figure 5 The interface shown in b is an example. This reduces the time users spend waiting for pages to load while browsing the internet, thus improving the user experience.

[0211] In other embodiments, the electronic device may first instruct the browser server to detect the security of the target website. Only if the target website is not malicious will the electronic device access it. This avoids the electronic device accessing malicious websites and improves security. This application does not impose any restrictions on the order of detecting and accessing the target website.

[0212] S702, The electronic device sends the URL of the target website, the website fingerprint data of the target website, and the website feature data of the target website to the browser server.

[0213] S703, the browser server cleans the variable data in the website fingerprint data and website feature data of the target website.

[0214] This process can be used to remove variable data from the target website's website fingerprint data and website feature data, retaining immutable data, and determining whether the target website is malicious based on the immutable data.

[0215] For example, the website fingerprint data and website feature data of the target website obtained by the browser server from the electronic device can be shown in Table 4, and the cleaned website fingerprint data and website feature data can be shown in Table 5:

[0216] Table 4. Website fingerprint data and website feature data of the target website before cleaning.

[0217]

[0218] Table 5. Website fingerprint data and website feature data after cleaning

[0219]

[0220]

[0221] Table 4 shows the website fingerprint data and website feature data before cleaning, and Table 5 shows the website fingerprint data and website feature data after cleaning. A comparison shows that:

[0222] Website fingerprint data may not include variable data, and the browser server may not need to clean the website fingerprint data. It should be noted that when electronic devices report data, other data may also be carried in the website fingerprint data. The browser server may clean the other data in the website fingerprint data, retaining the multiple data items shown in the above embodiments as the website fingerprint data. Alternatively, in practical applications, the browser server may also use some of the multiple data items shown in the above embodiments as the website fingerprint data; or, the browser server may also use other immutable data besides some of the multiple data items shown in the above embodiments as the website fingerprint data. This application does not impose any limitations on this.

[0223] The following section provides a detailed explanation of the website feature data cleaning process.

[0224] 1) CSS style files in internal resources are used to set website styles. The file content, file name, and storage location of CSS style files are immutable, while the domain name and query parameter values ​​of the target website are variable. Here, the domain name and query parameter values ​​of the corresponding link of the CSS style file can be removed.

[0225] For example, the link before cleaning was: https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css?v=20230828001; the link after cleaning is: / 2023homepro / css / 2023homepro_pc_20240207.css. During the cleaning process, the domain name bbbbbb.com and the query parameter value ?v=20230828001 were removed.

[0226] 2) JS script files in internal resources are used to add dynamic functions to web pages. The file content, file name, and storage location of JS script files are immutable, while the domain name of the target website and the values ​​of query parameters are variable. Here, the domain name and query parameter values ​​of the corresponding link of the JS script file can be removed.

[0227] For example, the link before cleaning was: https: / / bbbbbb.com / global / js / pageCore.js?202409271100943; the link after cleaning is: / global / js / pageCore.js. During the cleaning process, the domain bbbbbb.com and the query parameter value ?202409271100943 were removed.

[0228] 3) Media resources within the internal resources are used to display images, audio, and video content on the webpage. The domain name and query parameter values ​​of media resources are variable, and the file name of media resources is easily modified, thus they can be considered variable data; the storage location of media resources is immutable. Here, the domain name, query parameter values, and file name can be removed from the media resource link.

[0229] For example, the link before cleaning was: https: / / bbbbbb.com / 2023homepro / images / icon-down.png; the link after cleaning is: / 2023homepro / images / . The cleaning process removes the domain name bbbbbb.com and the file name icon-down.png.

[0230] It is understood that the link to a webpage resource may or may not include the value of the query parameter. For example, if the query parameter value is included in rules 1) and 2), then the query parameter value will be removed. If the query parameter value is not included in rule 3), then only the domain name will be removed. This application does not impose any restrictions on this.

[0231] 4) Among the external resources called, the domain name of the external website and the directory to which the external resource belongs cannot be changed, but the value of the query parameter when loading the external resource and the file name of the external resource can be changed; here, the value of the query parameter and the file name of the external resource in the link can be removed.

[0232] For example, the link before cleaning is http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / 202303200424173763.jpg; the link after cleaning is: http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / .

[0233] It should be noted that, in this embodiment of the application, during the process of cleaning website feature data, the browser server only removes the domain names of internal resources, for example, removing https: / / bbbbbb.com. The domain names of external resources can be used to reflect the external resource call relationships when accessing the target website, so they are retained, for example, http: / / a2.dddddd.com. Furthermore, when the external resource is a media resource, the browser server removes it, for example, the filename of the image 202303200424173763.jpg.

[0234] 5) The query parameters of the backend interface can include key-value pairs (key and value); where the key is immutable data and the value is mutable data. For example, in https: / / bbbbbb.com / 2023homepro / video / queryList?status=0&page=1&pagesize=10, the key can be defined as status, page, and pagesize, and the value can be 0, 1, or 10. The cleaned link can be: / 2023homepro / video / query List?status=&page=&pagesize=. Here, the values ​​of the query parameters from the backend interface have been removed.

[0235] 6) Dynamic calling relationships between web page resource links, that is, based on the above cleaning rules, the hierarchical structure of the original website feature data is preserved.

[0236] Taking internal resources as an example: https: / / bbbbbb.com / 2023homepro / images / icon-down.png and https: / / bbbbbb.com / 2023homepro / images / icon-wap.png are both sub-links of https: / / bbbbbb.com / 2023homepro / css / 2023homepro_pc_20240207.css. After cleaning the data according to the above rules, in the hierarchy, / 2023homepro / images / and / 2023homepro / images / are still the next level below / 2023homepro / css / 2023homepro_pc_20240207.css.

[0237] Taking external resources as an example: http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / 202303200424173763.jpg and http: / / a2.dddddd.com / download / adcreatives / 2024 / 3 / 4 / 202403040410096477.jpg are sub-links of http: / / a2.dddddd.com / is / xaddelayed.js. After cleaning the data according to the above rules, in the hierarchical relationship, http: / / a2.dddddd.com / download / adcreatives / 2023 / 3 / 20 / and http: / / a2.dddddd.com / download / adcreatives / 2024 / 3 / 4 / are still at the next level below http: / / a2.dddddd.com / is / xadndelayed.js.

[0238] As can be seen from the above cleaning rules, after obtaining website feature data, the browser server can remove at least one of the following variable data: the value of query parameters, the domain name of internal resources, or the file name of media resources in web page resources. The cleaned website feature data is then immutable.

[0239] S704. The browser server uses the target website's URL to match the URLs of multiple malicious websites in the website blacklist database.

[0240] The website blacklist database stores a blacklist of malicious websites. The blacklist includes the URLs of multiple malicious websites, along with the website type and blocking policy for each malicious website. The website type describes the risk level of the malicious website; the blocking policy executes appropriate blocking methods based on the risk level of the malicious website.

[0241] The data format of the website blacklist database is shown in Table 6:

[0242] Table 6. Data Format of Website Blacklist Database

[0243] URL Website Types Interception strategy https: / / aaaaaa.com Malicious websites with risk level 1 Access Denied https: / / www.xxxxxx.com.cn Malicious websites with risk level 2 Warning interception … … …

[0244] As shown in Table 6, different blocking strategies are employed for malicious websites with different risk levels. For example, for malicious websites with a high risk level, the browser server can implement a blocking strategy that prohibits access to the malicious website, preventing electronic devices from accessing the target website. For malicious websites with a relatively low risk level, the browser server can implement a blocking strategy that warns and blocks the malicious website, allowing electronic devices to display a warning interface, which may include, for example, a continue access control and a back control; the user can choose whether to continue browsing the malicious website. In practical applications, the types of websites in the blacklist can also be set according to the function of the website, and / or other blocking strategies can also be set in the blacklist, which will not be listed in detail in this embodiment.

[0245] The browser server can match the target website's URL with URLs in the blacklist. If they match, the target website is considered malicious, and the browser server can proceed to step S709. If they do not match, the target website may not be malicious, and the browser server can proceed to step S705 to further verify the target website's security.

[0246] S705. If the URL of the target website is not included in the website blacklist database, the browser server uses the cleaned website fingerprint data and cleaned website feature data of the target website to match the website fingerprint data and website feature data of multiple malicious websites in the website feature database.

[0247] If the target website's URL (https: / / bbbbbb.com) is not found among the URLs of multiple malicious websites in the website blacklist, then the browser server determines that the target website's URL is not in the blacklist. In this case, the browser server can use website fingerprint data and website feature data to determine whether the target website is malicious.

[0248] It is understood that in this embodiment, variable data in the collected website feature data is removed, but data related to the website fingerprint feature is not deleted. In practical applications, browser servers may also clean some data in the website fingerprint data, and this embodiment does not impose any restrictions on this.

[0249] Specifically, the website fingerprint data and cleaned website feature data of the target website can be shown in Table 5, for example. The specific format and cleaning rules of the website fingerprint data and website feature data of multiple malicious websites in the website feature library can be referred to the relevant descriptions in the embodiments shown in Table 5. For example, among the multiple malicious websites in the website feature library, there is a target malicious website whose website fingerprint data and website feature data are shown in Table 7:

[0250] Table 7. Website fingerprint data and website feature data of the target malicious website.

[0251]

[0252]

[0253] A comparison of Tables 5 and 7 shows that: the website fingerprint data of the target website is consistent with the website fingerprint data of the target malicious website, and the website feature data of the cleaned target website is consistent with the website feature data of the target malicious website. Therefore, the browser server can determine that the target website and the target malicious website are websites from the same origin; for example, https: / / bbbbbb.com and https: / / aaaaaa.com are both malicious websites. At this point, the browser server can continue to execute step S706.

[0254] In this embodiment, the browser server can first match the website fingerprint data of the target website with the website fingerprint data of the malicious website. If the website fingerprint data of the target website and the website fingerprint data of the malicious website are the same, the browser server can then match the website feature data of the target website with the website feature data of the malicious website. If the website feature data of the target website and the website feature data of the malicious website are the same, the browser server can determine that the target website is a malicious website. Alternatively, if the website fingerprint data of the target website and the website fingerprint data of the malicious website are different, the browser server can determine that the target website is not a malicious website.

[0255] It should be noted that in practical applications, the website fingerprint data of the target website may be the same as that of the malicious website, but the website feature data of the target website may be different from that of the malicious website; in this case, the target website is not considered a malicious website.

[0256] It is understandable that Table 7 only shows a portion of the website feature data. In practical applications, the number of links to a target website can be greater than the number shown in Table 7. In other words, the browser server is more efficient at identifying website fingerprint data than at identifying website feature data. The above step-by-step detection of target websites achieves the following effects: malicious websites can be initially screened out using website fingerprint data, reducing the number of times network feature data is traversed, thereby improving the efficiency of website identification; furthermore, the browser server simultaneously verifies the target website using both website fingerprint data and website feature data, improving the accuracy of website identification.

[0257] In other embodiments, if none of the malicious websites in the website signature database are identical to the website fingerprint data and website signature data shown in Table 7, the browser server determines that the target website is not a malicious website. Therefore, the browser server does not intercept the process of the electronic device accessing the target website, and the electronic device can continue to access the target network.

[0258] S706. When the website signature database includes cleaned website fingerprint data and cleaned website signature data of the target website, the browser server obtains the URL of the target malicious website from the website signature database.

[0259] The website signature database includes cleaned website fingerprint data and cleaned website signature data of the target website, as shown in Tables 5 and 7. Referring to Table 7, the URL of the target malicious website could be: https: / / aaaaaa.com.

[0260] S707. The browser server uses the URL of the target malicious website to search for the website type and blocking policy in the website blacklist database.

[0261] For example, the browser server uses the URL of the target malicious website to match the URLs of multiple malicious websites in the website blacklist; if the URL of the target malicious website is included in the website blacklist, the browser server obtains the website type and blocking policy corresponding to the URL of the target malicious website from the website blacklist.

[0262] Understandably, the URLs of malicious websites in the website blacklist are synchronized with the URLs of malicious websites in the website signature database. Further integration will be implemented later. Figure 8 and Figure 9 The illustrated embodiment describes the process of synchronizing (e.g., adding and updating) information about malicious websites in the website blacklist database and the website feature database, which will not be elaborated here.

[0263] The data format of the website blacklist database can be found in Table 6. The browser server can use the URL of the target malicious website to find the corresponding website type and blocking policy, and use it as the website type and blocking policy for the target website.

[0264] For example: The target malicious website is https: / / aaaaaa.com, which is a malicious website with a risk level of 1, and the blocking policy is to block access. Similarly, the target website is also a malicious website with a risk level of 1, and the blocking policy is also to block access.

[0265] S708: The browser server blocks the target websites accessed by electronic devices based on website type and blocking policies.

[0266] For example, if the target website is a malicious website with a risk level of 1, and the blocking policy is to block access, then the browser server can instruct the electronic device to stop accessing the target website. For example, the electronic device can display something like... Figure 5 The interface shown in b is shown in the image.

[0267] Therefore, when blacklists cannot block malicious websites that change their domain names, browser servers can further determine whether a target website is malicious based on website fingerprint data and website characteristic data, thereby improving the success rate of blocking malicious websites, enhancing website security, and improving the user's online experience.

[0268] Alternatively, after step S704, the method may further include:

[0269] S709. When the target website's URL is included in the website blacklist database, the browser server uses the target website's URL to look up the website type and blocking policy in the website blacklist database.

[0270] For example, if the user enters the URL of the target website as https: / / aaaaaa.com, the browser server can find https: / / aaaaaa.com in the blacklist database. Therefore, the browser server determines that the target website is a malicious website, and can find the website type corresponding to https: / / aaaaaa.com in the blacklist shown in Table 6 as a malicious website with a risk level of 1. The blocking policy is to prohibit access. Subsequently, the browser server can execute, for example, step S708.

[0271] It is understandable that, compared to directly using the target website's website fingerprint data and website feature data to verify malicious websites, the embodiments of this application can quickly identify malicious websites through a website blacklist database even if the malicious website has not modified its domain name. It should be understood that browser servers are faster at searching URLs in a website blacklist database than at searching website fingerprint data and website feature data in a website feature database; therefore, combining a website blacklist database and a website feature database can reduce the process of traversing the website feature database even if the malicious website has not modified its domain name, thereby improving the efficiency of malicious website identification, reducing the time electronic devices spend accessing malicious websites, and enhancing the security of users' online activities.

[0272] The following is combined with Figure 8 and Figure 9 The process of creating and updating data in the website blacklist database and website feature database in the embodiments of this application is described. For example... Figure 8 As shown:

[0273] In the first implementation, the browser server uses Figure 7 The illustrated embodiment provides a process for detecting a target website. Specifically, if the browser server does not find the target website's URL in the website blacklist, but does find the target website's website fingerprint data and website feature data in the website feature database; that is, if the browser server finds a malicious website originating from the same source as the target website, the browser server can add the target website's information to the website blacklist.

[0274] For example, see Figure 8 After step S708, the method further includes:

[0275] S801, The browser server adds the target website's URL, website type, and blocking policy to the website blacklist database.

[0276] It is understandable that the target website and the target malicious website are from the same origin, and the website type and blocking strategy of the target website are the same as those of the target malicious website. The data format of the website blacklist database after adding the target website's information is shown in Table 8:

[0277] Table 8. Data format of the updated website blacklist database

[0278] URL Website Types Interception strategy https: / / aaaaaa.com Malicious websites with risk level 1 Access Denied https: / / bbbbbb.com Malicious websites with risk level 1 Access Denied https: / / www.xxxxxx.com.cn Malicious websites with risk level 2 Warning interception … … …

[0279] This allows for timely updates to the URLs in the website blacklist. When a user subsequently accesses the target website again using an electronic device, the browser server can quickly detect the risk of the target website through the domain name of the URL in the website blacklist, thereby improving the efficiency of website identification and malicious website blocking.

[0280] In the second implementation, the browser server uses... Figure 7 The illustrated embodiment provides a process for detecting a target website. Specifically, the browser server can find the target website's URL in a website blacklist and determine that the target website is malicious. After determining that the target website is malicious, the browser server can add the target website's website fingerprint data and website feature data to a website feature database.

[0281] For example, see Figure 9 After detecting that the target website's URL is included in the website blacklist database, it also includes:

[0282] S901, the browser server uses the target website's URL, cleaned website fingerprint data, and cleaned website feature data to match the website fingerprint data and website feature data of multiple malicious websites in the website feature database.

[0283] The data matching process can be found in the relevant description in step S705, and will not be repeated here.

[0284] It should be noted that in step S901, the purpose of comparing the website fingerprint data and website feature data of the target website and the malicious websites in the website feature database is to check whether the target website's website fingerprint data and website feature data are included in the website feature database when the target website is on the blacklist. If they are included, it indicates that both the website blacklist database and the website feature database contain the relevant information of the target website. If they are not included, the target website's website fingerprint data and website feature data are added to the website feature database to achieve information synchronization between the website blacklist database and the website feature database.

[0285] It should be noted that step S901 can be executed simultaneously with step S709. Step S901 can also be executed after step S709 to improve the efficiency of blocking malicious websites. This application embodiment does not impose any limitations.

[0286] S902. If the target website's URL, cleaned website fingerprint data, and cleaned website feature data are not included in the website feature database, the browser server adds the target website's URL, cleaned website fingerprint data, and cleaned website feature data to the website feature database.

[0287] The website blacklist database contains multiple URLs of malicious websites. When a browser server detects a target website for the first time, the website blacklist database may include the target website's URL, while the website signature database may not include the target website's URL, website fingerprint data, or website signature data. For example, the target website could be https: / / aaaaaa.com. Upon first detection of https: / / aaaaaa.com, and if this URL is not included in the website signature database, the browser server can create a mapping between the target website's URL, website fingerprint data, and website signature data in the website signature database, as shown in Table 7.

[0288] In this way, the website fingerprint data and website feature data of malicious websites in the website blacklist can be automatically synchronized to the website feature database, so as to facilitate the subsequent interception of websites with the same origin as the malicious websites, thereby improving the accuracy of website identification.

[0289] In the third implementation method, the browser server adopts... Figure 7 The illustrated embodiment provides a process for detecting a target website. Specifically, the browser server can find the target website's URL in a website blacklist and determine that the target website is malicious. After determining that the target website is malicious, the browser server can update the target website's website fingerprint data and website feature data.

[0290] For example, see Figure 9 Following S901, it also includes:

[0291] S903. If the website feature database includes the URL of the target website but does not include the cleaned website fingerprint data and cleaned website feature data, the browser server will update the cleaned website fingerprint data and cleaned website feature data of the target website to the website feature database.

[0292] The website blacklist database contains the URLs of multiple malicious websites, including the target website's URL. The browser server previously added the target website's website fingerprint and feature data to the website signature database based on steps S901 and S902; that is, the website signature database includes the target website's URL, website fingerprint, and website feature data. Subsequently, the website server may upgrade the target website, changing its website fingerprint and feature data. The browser server may then be unable to find the target website's website fingerprint and feature data in the signature database. In this case, the browser server can update the website signature database with the upgraded target website's website fingerprint and feature data.

[0293] For example, the website blacklist database includes the URL of the target website: https: / / aaaaaa.com; the website fingerprint data and website feature data of the target website before the upgrade stored in the website feature database can be shown in Table 7; the website fingerprint data and website feature data of the target website after the upgrade can be shown in Table 9.

[0294] Table 9. Website fingerprint data and website feature data of the target website after the upgrade.

[0295]

[0296] After comparing the website fingerprint data and website feature data of the target website in Table 9 with the original website fingerprint data and website feature data in the website feature database in Table 7, the browser server can determine that the URL fingerprint data and website feature data of https: / / aaaaaa.com have changed.

[0297] In some embodiments, the browser server may update the website fingerprint data and website feature data shown in Table 7 to the website fingerprint data and website feature data shown in Table 9. Alternatively, in other embodiments, the browser server may add the website fingerprint data and website feature data shown in Table 9 to the website feature database, while retaining the website fingerprint data and website feature data shown in Table 7, so that the data stored in the website feature database covers the feature information of multiple versions of the target website, improving the completeness of the relevant data of the target website. This application does not impose any limitations on this.

[0298] It is understood that, if the browser server can add the website fingerprint data and website feature data shown in Table 9 to the website feature database, and retain the website fingerprint data and website feature data shown in Table 7, the browser server can refer to the process described in the first embodiment above, without needing to determine whether the target website's URL is included in the website feature database. This application embodiment does not impose any limitations on this.

[0299] In this way, after the target website version is upgraded, the browser server can update the relevant information of the target website in the website feature database in a timely manner, ensuring the accuracy and timeliness of the data in the website feature database, so as to facilitate the subsequent interception of websites with the same origin as malicious websites; thereby improving the accuracy of website identification.

[0300] In another possible implementation, the browser server uses Figure 7 The illustrated embodiment provides a process for detecting a target website. The browser server can find the target website's URL in a website blacklist database and its website fingerprint and feature data in a website feature database. At this point, the browser server can determine that the data in the website blacklist database and the website feature database are synchronized, and there is no need to update the website feature database.

[0301] It should be noted that, in this embodiment of the application, in order to further improve the accuracy of the data in the website feature database, the browser server may use the following processing logic to filter the data when adding or updating website fingerprint data and website feature data:

[0302] If the URL of the target website is the URL of a malicious website, the browser server can obtain multiple website fingerprint data and multiple website feature data of the target website within a preset time. If the number of website fingerprint data and website feature data is greater than the preset number, and multiple website fingerprint data are the same, and the website feature data are the same, then the browser server can add or update the website fingerprint data and website feature data of the target website to the website feature database.

[0303] It should be noted that the browser server is responsible for the security of one or more electronic devices accessing websites. That is, within a preset time period, one or more electronic devices may access the same target website multiple times. The browser server can intercept these accesses multiple times, statistically analyzing the website's fingerprint and feature data to obtain multiple sets of website fingerprints and features. If the multiple website fingerprints and / or features are different, it may indicate malicious signature emulation or system upgrades. In this case, the website fingerprints and features are inaccurate, and the browser server can mark these as abnormal data and discard them, preventing them from being added to or updated in the website feature database.

[0304] Understandably, the preset time ensures the timeliness of website fingerprint data and website feature data. For data that exceeds the preset time, its accuracy decreases, and the browser server may choose not to use website fingerprint data and website feature data that have exceeded the preset time.

[0305] In this way, the correlation between website fingerprint data and website feature data and the target website can be improved by increasing the number of times and time, thereby improving the accuracy of data in the website feature database and the accuracy of subsequent website identification.

[0306] To facilitate understanding the database creation and update process, the following will combine... Figure 10 Please explain the process. For example... Figure 10 As shown:

[0307] For example, S1001, electronic device accesses URL1.

[0308] S1002. The browser server queries the website blacklist database, which includes ULR1, and the website feature database, which does not include ULR1 or URL1, for website fingerprint data and website feature data.

[0309] For example, when an electronic device accesses URL1 for the first time, the website blacklist database has ULR1 pre-defined, but the website feature database does not have any information related to ULR1, such as ULR1, URL1's website fingerprint data, and website feature data.

[0310] S1003. The browser server adds URL1, URL1's website fingerprint data, and website feature data to the website feature database.

[0311] The browser server adds the relevant information of URL1 to the website signature database. The website signature database subsequently includes URL1, the website fingerprint data of URL1, and website signature data.

[0312] S1004. Electronic devices access URL2, and URL2 and URL1 are from the same origin.

[0313] URL2 can be a URL that modifies the domain name in URL1.

[0314] S1005. Browser server queries website fingerprint data and website feature data that do not include ULR2 in the website blacklist database and website feature database that include ULR2.

[0315] The website blacklist database includes URL1 but excludes URL2; the website feature database includes URL1, its website fingerprint data, and its website feature data. Since URL2 and URL1 are from the same origin, the website fingerprint data and website feature data for URL2 are the same as those for URL1.

[0316] The browser server can obtain the corresponding URL1 from the website feature database based on the website fingerprint data and website feature data of URL1, thereby determining that URL2 and URL1 are the same origin URL.

[0317] S1006. The browser server adds URL2 to the website blacklist database.

[0318] The browser server searches its website blacklist for the website type and blocking policy associated with URL1. Then, it adds URL2, the website type of URL1, and the blocking policy to the blacklist. At this point, the blacklist includes both URL1 and URL2; the website signature database includes URL1, its website fingerprint data, and other website signature data.

[0319] S1007: The electronic device accesses ULR2 again, and the ULR2 website version is upgraded.

[0320] The website fingerprint data and website feature data of ULR2 have changed, becoming new website fingerprint data and new website feature data; the domain name of ULR2 has not changed.

[0321] S1008: The browser server found new website fingerprint data and new website feature data that include ULR2 in the website blacklist database and do not include ULR2 in the website feature database.

[0322] At this point, due to the ULR2 website version upgrade, the new website fingerprint data and new website feature data of ULR2 are no longer the same as the original ULR2 website fingerprint data and website feature data in the website feature database. The browser server can determine that ULR2 has been updated.

[0323] S1009. The browser server adds ULR2, new website fingerprint data, and new website feature data to the website feature library.

[0324] After adding the relevant data for URL2 to the website feature library, the website feature library can include URL1, the website fingerprint data and website feature data of URL1, as well as URL2, the new website fingerprint data and new website feature data of URL2.

[0325] Understandably, after adding new relevant data for ULR2, the browser server can retain the relevant data for ULR1. This is because different electronic devices may access different versions of malicious websites. For example, an older version of a malicious website can be accessed using ULR1 or other URLs originating from the same source as ULR1, while a newer version can be accessed using ULR2 or other URLs originating from the same source as ULR2. Retaining data for different versions of a malicious website helps to accurately identify malicious websites and improves the accuracy of website identification.

[0326] It should be noted that the steps S1001-S1009, which involve querying the target website information in the database, can be found in [reference needed]. Figure 7 The relevant descriptions in the illustrated embodiments, and the process of adding target website information to the database, can be found by referring to... Figure 8 and Figure 9 The relevant descriptions in the document will not be repeated here.

[0327] In this way, the browser server can automatically and in real time create or add data to the website feature database and website blacklist database based on website identification (e.g., the website identification process involves URL, website fingerprint data, and website feature data), realize data synchronization between the website feature database and website blacklist database, simplify the operation of manually configuring malicious website-related data, improve the timeliness of malicious website-related data, and improve the accuracy of website identification.

[0328] It should be noted that, in this embodiment, website fingerprint data and website feature data can also be applied to scenarios other than network identification. For example, after constructing multiple website feature data sets, a website structure template providing various capabilities can be automatically created based on the capabilities of the website feature data. Subsequently, developers can import page content templates or add page content information based on the website structure template, thereby quickly building a complete website and reducing website construction time.

[0329] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0330] Based on the above embodiments, this application provides a website identification method. For example, Figure 11 This is a flowchart illustrating a website identification method provided in an embodiment of this application.

[0331] like Figure 11 As shown: The website identification method may include the following steps:

[0332] S1101. In response to an operation for accessing a target website, the electronic device collects target website information. This target website information includes the target website's fingerprint data and its characteristic data.

[0333] It should be noted that the server can be understood as the browser server shown in the embodiments of this application.

[0334] An action used to access a target website could be, for example, a user entering the target website's domain name or URL into the search box of a browser application and then clicking the search control. Figure 5 The example shown in Figure 'a' illustrates the operation of entering bbbbbb.com in the search box 501; another example is the user entering keywords in the search box of a browser application and clicking the search control, after which the electronic device displays the search results interface, and the user selects the target website's search result from multiple search results. The keywords can be entered as text or spoken words. Yet another example is the user scanning a scannable code using an electronic device, where the scannable code corresponds to a website link for the target website. Yet another example is the user quickly accessing the target website through bookmarks or history in a browser application. This application's embodiments do not limit this.

[0335] The target website's website fingerprint data includes at least one of the following: the target website's title or the target website's metadata. The target website's metadata includes at least one of the following: the target website's name attribute, http-equip attribute, or content attribute; the name attribute includes at least one of the following: the target website's keyword information, the target website's description information, the target website's author information, or the target website's generator; the http-equip attribute includes at least one of the following: content-type, refresh information, or expiration information.

[0336] The target website's website characteristic data includes information about the target website's web page resources and the calling relationships between these resources. Web page resources include at least one of the following: internal resources, external resources called when accessing internal resources, or backend interfaces. Internal resources are those with the same domain name as the target website, while external resources are those with a different domain name. The information about web page resources includes the web page resource name and the web page resource directory. The web page resource directory represents the storage location of the web page resources on the target website. The calling relationships between web page resources include at least one of the following: the internal resource storage hierarchy directory, backend interface information, external link information called when accessing the target website, or the dynamic calling relationships of web page resources.

[0337] The website fingerprint data and website feature data of the target website can be found in the relevant descriptions in Tables 2 and 3 of step S701, and will not be repeated here.

[0338] S1102. Electronic devices send target website information to the server.

[0339] Electronic devices can send target website information to a server to instruct the server to identify whether the target website is malicious.

[0340] S1103. If the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website, the server sends an interception command to the electronic device. The interception command is used to intercept the target website.

[0341] The interception instruction may include the website type corresponding to the URL of the target malicious website and the interception policy. The website type corresponding to the URL of the target malicious website and the interception policy can be found in Table 6 in step S704.

[0342] If the target website's website fingerprint data is identical to that of the malicious target website, and the target website's website feature data is also identical to that of the malicious target website, it indicates that the target website and the malicious target website are from the same origin. Therefore, the target website is a malicious website, and there is a security risk in electronic devices accessing the target website. The server can block the target website through interception commands.

[0343] The following provides two matching processes for target websites and malicious websites:

[0344] The first type of matching process between the target website and the malicious website can be, for example, the server using the target website's website fingerprint data to match the website fingerprint data of multiple malicious websites, and using the target website's website feature data to match the website feature data of multiple malicious websites, wherein the multiple malicious websites include the target malicious website.

[0345] The website fingerprint data and website feature data of multiple malicious websites can be stored in a website feature database. The server can simultaneously use the website fingerprint data and website feature data to match the target website with multiple malicious websites to determine whether the target website and malicious websites are the same website or have the same origin, thereby improving the accuracy of website identification.

[0346] In some embodiments, the server uses the website fingerprint data of the target website to match the website fingerprint data of multiple malicious websites, wherein the multiple malicious websites include the target malicious website; if the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, the server uses the website feature data of the target website to match the website feature data of the target malicious website.

[0347] In the process of matching a target website with multiple malicious websites using website fingerprint data and website feature data, the server can perform step-by-step detection. For example, it can first match the target website's website fingerprint data with the website fingerprint data of multiple malicious websites. If they match, the server can further match the target website's website feature data with the website feature data of malicious websites (e.g., the target malicious website) that have the same website fingerprint data. In this way, malicious websites can be initially screened out using website fingerprint data, reducing the number of times network feature data is traversed, thereby improving the efficiency of website identification. In addition, the browser server simultaneously verifies the target website using both website fingerprint data and website feature data, improving the accuracy of website identification.

[0348] The above process can be referred to the first possible implementation in step S603. The specific matching process can be referred to the relevant description in step S705, which will not be repeated here.

[0349] The matching process between the second type of target website and malicious website can be found in [reference needed]. Figure 7 The process shown is as follows:

[0350] The target website information also includes: the target website's URL; the server's website blacklist database stores the URLs of multiple malicious websites; the methods also include:

[0351] The server matches the target website's URL against the URLs of multiple malicious websites in a website blacklist database;

[0352] The server uses the target website's website fingerprint data to match the website fingerprint data of multiple malicious websites, including: when the URL of the target website and the URLs of multiple malicious websites are all different, the server uses the target website's website fingerprint data to match the website fingerprint data of multiple malicious websites.

[0353] This process can correspond to the first possible implementation in step S603. The server first uses the URL of the target website to quickly determine whether it is a malicious website; if the URL of the target website is the same as the URL of a malicious target website, the target website is a malicious website, and the server can block the target website. Alternatively, if the URL of the target website is different from the URL of a malicious target website, the target website may be a website from the same origin as the malicious website, or it may be a normal website; the server can use website fingerprint data and website feature data to further identify the target website.

[0354] The specific implementation of this process can be as follows: the server matches the target website's website fingerprint data with the website fingerprint data of multiple malicious websites, and also matches the target website's website feature data with the website feature data of multiple malicious websites. Alternatively, the server can match the target website's website fingerprint data with the website fingerprint data of multiple malicious websites, where the multiple malicious websites include the target malicious website; if the target website's website fingerprint data matches the target malicious website's website fingerprint data, the server then matches the target website's website feature data with the target malicious website's website feature data. Refer to the relevant description of the second method of matching the target website and malicious websites.

[0355] In this way, even if the target website is malicious and its domain name has been modified, it can still be identified as a malicious website, improving the accuracy of website identification and enhancing the security of accessing the website; at the same time, it can reduce the number of times website fingerprint data and website feature data are matched, thereby improving the overall processing efficiency.

[0356] In the website blacklist database, each URL among multiple malicious websites corresponds to a website type and a blocking policy; the website type is used to characterize the risk level of a malicious website, and the blocking policy corresponds to the website type.

[0357] Regarding the matching process between the second type of target website and malicious website: before the server sends an interception command to the electronic device, the method includes:

[0358] The server matches the URL of the target malicious website with the URLs of multiple malicious websites in the website blacklist database; if the URL of the target malicious website is included in the website blacklist database, the server obtains the website type and blocking policy corresponding to the URL of the target malicious website from the website blacklist database; the server sends a blocking instruction to the electronic device, including: the server sends the website type and blocking policy corresponding to the URL of the target malicious website to the electronic device.

[0359] This process can be referred to in the relevant descriptions in steps S706 and S707. It is understood that when using website fingerprint data and website feature data to determine if a target website is a source website of the target malicious website, the server can use the website type and blocking policy of the target malicious website in the website blacklist as the website type and blocking policy of the target website.

[0360] In this way, when the website blacklist includes a website of the same origin as the target website (such as a malicious website), the server can handle the target website in the same way as it handles the malicious website. Thus, when the security of the target website cannot be determined by the URL in the website blacklist, the target website can be blocked by the website type and blocking policy of the same origin website, thereby improving the security of accessing the website.

[0361] Optionally, after the server sends the website type and blocking policy corresponding to the URL of the target malicious website to the electronic device, the method further includes: the server adding the URL of the target website, the website type corresponding to the URL of the target malicious website, and the blocking policy to the website blacklist database. This process can be referred to the relevant description in step S801.

[0362] When a target website is identified as a website originating from the same source as the malicious target website, the server can add the target website's URL, the website type corresponding to the malicious target website's URL, and the blocking policy to the website blacklist database. This allows for timely updates to the URLs in the website blacklist database. Subsequently, when a user accesses the target website again using an electronic device, the browser server can quickly detect the risk of the target website based on the domain name of the URL in the website blacklist database, thereby improving the efficiency of website identification and malicious website blocking.

[0363] Optionally, after the server receives the target website information sent by the electronic device, the method further includes: the server cleaning the variable data in the website feature data of the target website. The data cleaning process can be referred to the relevant description in step S703.

[0364] The specific data cleaning process can be as follows: The target website's website feature data is obtained based on the request initiator chain when an electronic device accesses the target website. The target website's website feature data includes multiple webpage resource links of the target website; the server cleans the variable data in the target website's website feature data, including:

[0365] The server removes variable data from multiple webpage resource links on the target website and retains immutable data. The variable data includes at least one of the following: the value of a query parameter in the multiple webpage resource links, the domain name of an internal resource, or the file name of a media resource within a webpage resource. The immutable data includes one or more of the following: the file name and storage location of a CSS style file, the file name and storage location of a JS script file, the storage location of a media resource, the domain name of an external link, or the dynamic calling relationship between multiple webpage resource links. The dynamic calling relationship between multiple webpage resource links is used to characterize the calling relationship between a webpage resource link and one or more child webpage resource links when accessing a webpage resource link.

[0366] In this way, after cleaning the website fingerprint data and website feature data, immutable data can be retained in the website fingerprint data and website feature data. Compared with the mutable data, this immutable data is more stable, and malicious websites cannot evade interception by modifying the website fingerprint data and website feature data, thereby improving the accuracy of malicious website identification and improving the security of users' online activities.

[0367] Optionally, the method further includes: the server matching the URL of the target website with the URLs of multiple malicious websites in a website blacklist database; if the URL of the target website is included in the website blacklist database, the server matching the website fingerprint data and website feature data of the target website with the website fingerprint data and website feature data of multiple malicious websites; if the website fingerprint data of the target website is different from the website fingerprint data of the target malicious website, or if the website feature data of the target website is different from the website feature data of the target malicious website, the server adding the website fingerprint data and website feature data of the target website.

[0368] This process can be referenced. Figure 9 The relevant description is as follows. When the target website's URL is included in the website blacklist, but the website fingerprint data and website feature data of the target website are not included in the website feature database, the server can synchronize the target website's website fingerprint data and website feature data from the website blacklist to the website feature database; this is to facilitate the subsequent identification of the target website's same-origin websites through the website fingerprint data and website feature data.

[0369] This automatically synchronizes the website fingerprint data and website feature data of malicious websites in the website blacklist to the website feature database, facilitating the subsequent interception of websites with the same origin as the malicious website, thereby improving the accuracy of website identification. Simultaneously, after the target website version is upgraded, the browser server can promptly update the relevant information of the target website in the website feature database, ensuring the accuracy and timeliness of the data in the website feature database, further enhancing the accuracy of website identification.

[0370] S1104. Electronic devices stop accessing the target website according to the interception instruction.

[0371] If the target website is malicious, the electronic device can receive an interception instruction; the electronic device can then intercept the target website according to the interception instruction.

[0372] Specifically, electronic devices can stop accessing target websites according to blocking instructions. This may include: the electronic device not displaying web pages of the target website, and displaying a prompt message; the prompt message is used to inform the user that the target website is a malicious website; the prompt message corresponds to the website type and blocking strategy corresponding to the URL of the target malicious website; the website type is used to characterize the risk level of the target malicious website, and the blocking strategy corresponds to the website type.

[0373] In some embodiments, the electronic device may receive an interception instruction after successfully loading a webpage from the target website; the electronic device may then stop displaying the webpage from the target website. Alternatively, the electronic device may receive an interception instruction even before loading a webpage from the target website; the electronic device may then stop loading the target website and not display the webpage from the target website (e.g., ...). Figure 5 (Scene shown).

[0374] The prompt message may be, for example Figure 5 The 503 risk warning message is related to the website type and blocking strategy corresponding to the target malicious website's URL. For example, for a high-risk malicious website, the browser server may implement a blocking strategy that prohibits access to the malicious website, preventing electronic devices from accessing the target website, and the warning message may be, for example, "Access to this webpage has been stopped." For a relatively low-risk malicious website, the browser server may implement a warning blocking strategy, and the electronic device may display a warning interface, which may include, for example, a continue access control, a back control, and a warning message; the warning message can inform the user that the target website is risky, and the user can choose whether to continue browsing the malicious website.

[0375] In this way, when electronic devices access a target website, the target website information can be used to detect whether the target website is malicious, thereby improving the security of website access. At the same time, website fingerprint data and website feature data are not easy to modify, and malicious websites can be more accurately identified through immutable data, so as to reduce the situation where malicious URLs from the same origin can easily evade blocking by changing domain names.

[0376] The above combination Figures 6-11 The website identification method provided in the embodiments of this application is described in detail below. Figure 12 Detailed description of the server provided in the embodiments of this application, and in conjunction with Figure 13 This application provides a detailed description of the electronic device provided in its embodiments.

[0377] Figure 12 This is a schematic diagram of the server structure provided in an embodiment of this application. Figure 12 As shown, server 1200 may include a transceiver unit 1201 and a processing unit 1202. Server 1200 can be used to implement the functions of the server involved in the above method embodiments.

[0378] Optionally, the transceiver unit 1201 is used to support the server 1200 in performing operations. Figure 6 S602 and S604 in the middle, Figure 7 S702 and S708 in the middle, Figure 10 S1001, S1004, and S1005, and Figure 11 S1102 and S1103 in the example.

[0379] Optionally, the processing unit 1202 is used to support the execution of the server 1200. Figure 6 S603 and S605 in the middle, Figure 7 S703-S707 or S709, Figure 8 S801 in Figure 9 S901-S903 in the middle, Figure 10 S1002, S1003, S1005, S1006, S1008 and S1009.

[0380] The transceiver unit may include a receiving unit and a sending unit, and may be implemented by a transceiver or transceiver-related circuit components, and may be a transceiver or transceiver module. The operation and / or function of each unit in server 1200 are respectively to implement the corresponding process of the website identification method shown in the above method embodiments. All relevant content of each step involved in the above method embodiments can be referred to the functional description of the corresponding functional unit, and will not be repeated here for the sake of brevity.

[0381] Optionally, Figure 12The server 1200 shown may also include a storage unit ( Figure 12 (not shown in the image), this storage unit stores a program or instruction. When the transceiver unit 1201 and the processing unit 1202 execute the program or instruction, it causes... Figure 12 The server 1200 shown can execute the website identification method shown in the above method embodiment.

[0382] Figure 12 The technical effects of the server 1200 shown can be referred to the technical effects of the website identification method shown in the above method embodiments, and will not be repeated here.

[0383] Besides being in the form of server 1200, the technical solution provided in this application can also be a functional unit or chip in a server, or a device used in conjunction with a server.

[0384] Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 13 As shown, the electronic device 1300 may include a transceiver unit 1301, a processing unit 1302, and a display unit 1303. The electronic device 1300 can be used to implement the functions of the user-side electronic device involved in the above method embodiments.

[0385] Optionally, the transceiver unit 1301 is used to support the electronic device 1300 in performing... Figure 6 S601 in Figure 7 S701 in, and Figure 10 S1001, S1004, and S1007.

[0386] Optionally, the processing unit 1302 is configured to support corresponding responses based on the interception instruction. For example, if the interception policy in the interception instruction is to deny access, the processing unit 1302 may instruct to stop access to the target website. If the interception policy in the interception instruction is to issue a warning, the processing unit 1302 may instruct to stop access to the target website; if the user chooses to continue accessing, the processing unit 1302 may instruct to restore access.

[0387] Optionally, the display unit 1303 is used to support the display of electronic device 1300, for example... Figure 5 The interface shown.

[0388] The transceiver unit may include a receiving unit and a transmitting unit, and may be implemented by a transceiver or transceiver-related circuit components, and may be a transceiver or transceiver module. The operation and / or function of each unit in the electronic device 1300 are respectively for implementing the corresponding process of the website identification method shown in the above method embodiments. All relevant content of each step involved in the above method embodiments can be referred to the functional description of the corresponding functional unit, and for the sake of brevity, it will not be repeated here.

[0389] Optionally, Figure 13 The illustrated electronic device 1300 may also include a storage unit ( Figure 13 (not shown in the image), this storage unit stores a program or instruction. When the transceiver unit 1301, processing unit 1302, and display unit 1303 execute the program or instruction, it causes... Figure 13 The electronic device 1300 shown can perform the website identification method shown in the above method embodiment.

[0390] Figure 13 The technical effects of the electronic device 1300 shown can be referred to the technical effects of the website identification method shown in the above method embodiments, and will not be repeated here.

[0391] In addition to being in the form of electronic device 1300, the technical solution provided in this application can also be a functional unit or chip in an electronic device, or a device used in conjunction with an electronic device.

[0392] This application provides an electronic device, which includes a processor and a memory; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, causing the electronic device to perform the above-described method.

[0393] This application provides a chip. The chip includes a processor, which is used to call a computer program in memory to execute the technical solutions in the above embodiments. Its implementation principle and technical effects are similar to those in the related embodiments described above, and will not be repeated here.

[0394] This application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, it implements the methods described above. The methods described in the above embodiments can be implemented wholly or partially by software, hardware, firmware, or any combination thereof. If implemented in software, the functionality can be stored as one or more instructions or code on or transmitted over the computer-readable medium. The computer-readable medium can include computer storage media and communication media, and can also include any medium that can transfer a computer program from one place to another. The storage medium can be any target medium accessible by a computer.

[0395] In one possible implementation, a computer-readable medium may include random access memory (RAM), read-only memory (ROM), compact discread-only memory (CD-ROM) or other optical disc storage, magnetic disk storage or other magnetic storage devices, or any other medium targeted to carry or to store required program code in the form of instructions or data structures, and accessible by a computer. Furthermore, any connection is appropriately referred to as a computer-readable medium. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. As used herein, disks and optical discs include optical discs, laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs optically reproduce data using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0396] This application provides a computer program product, which includes a computer program that, when run, causes a computer to perform the above-described method.

[0397] It should be noted that the modules or components shown in the above embodiments can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), etc. Furthermore, when a module is implemented through processing element scheduler code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processors capable of calling program code, such as a controller. Additionally, these modules can be integrated together to implement a system-on-a-chip (SOC).

[0398] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0399] The term "multiple" in this document refers to two or more. The term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Furthermore, the character " / " in this document generally indicates an "or" relationship between the preceding and following related objects; in formulas, " / " indicates a "division" relationship. Additionally, it should be understood that in the description of this application, words such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0400] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

[0401] It is understood that, in the embodiments of this application, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

Claims

1. A website identification method, characterized in that, Applied to a server, the method includes: The server receives target website information sent by the electronic device, wherein the target website information includes the website fingerprint data and the website feature data of the target website; If the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website, the server sends an interception command to the electronic device, and the interception command is used to intercept the target website.

2. The method according to claim 1, characterized in that, The website fingerprint data of the target website includes at least one of the following: the title of the target website or the metadata of the target website.

3. The method according to claim 1, characterized in that, The website feature data of the target website includes information about the web page resources of the target website and the calling relationships between the web page resources; the web page resources include at least one of the following: internal resources, external resources called when accessing the internal resources, or backend interfaces, wherein the internal resources are resources with the same domain name as the domain name of the target website, and the external resources are resources with a different domain name than the domain name of the target website; the information of the web page resources includes the web page resource name and the web page resource directory; the web page resource directory is used to characterize the storage location of the web page resources in the target website; the calling relationships between the web page resources include at least one of the following: the internal resource storage hierarchy directory, backend interface information, external link information called when accessing the target website, or the dynamic calling relationships of the web page resources.

4. The method according to any one of claims 1-3, characterized in that, After the server receives the target website information sent by the electronic device, the method further includes: The server uses the website fingerprint data of the target website to match the website fingerprint data of multiple malicious websites, and uses the website feature data of the target website to match the website feature data of the multiple malicious websites, wherein the multiple malicious websites include the target malicious website.

5. The method according to any one of claims 1-3, characterized in that, After the server receives the target website information sent by the electronic device, the method further includes: The server uses the website fingerprint data of the target website to match the website fingerprint data of multiple malicious websites, wherein the multiple malicious websites include the target malicious website; If the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, the server uses the website feature data of the target website to match the website feature data of the target malicious website.

6. The method according to claim 4 or 5, characterized in that, The target website information also includes: the URL of the target website, and the server's website blacklist database stores the URLs of the multiple malicious websites. The method further includes: The server uses the URL of the target website to match the URLs of the multiple malicious websites in the website blacklist database; The server uses the website fingerprint data of the target website to match the website fingerprint data of multiple malicious websites, including: When the URL of the target website and the URLs of the multiple malicious websites are all different, the server uses the website fingerprint data of the target website to match the website fingerprint data of the multiple malicious websites.

7. The method according to claim 6, characterized in that, In the website blacklist database, each URL among the URLs of the plurality of malicious websites corresponds to a website type and an interception policy; the website type is used to characterize the risk level of the malicious website, and the interception policy corresponds to the website type; Before the server sends the interception command to the electronic device, it includes: The server uses the URL of the target malicious website to match the URLs of the plurality of malicious websites in the website blacklist database; If the URL of the target malicious website is included in the website blacklist database, the server obtains the website type and blocking strategy corresponding to the URL of the target malicious website from the website blacklist database. The server sends an interception command to the electronic device, including: The server sends the website type and blocking policy corresponding to the URL of the target malicious website to the electronic device.

8. The method according to claim 7, characterized in that, After the server sends the website type and blocking policy corresponding to the URL of the target malicious website to the electronic device, the method further includes: The server adds the URL of the target website, the website type corresponding to the URL of the malicious target website, and the blocking policy to the website blacklist database.

9. The method according to any one of claims 1-8, characterized in that, After the server receives the target website information sent by the electronic device, the method further includes: The server cleans the variable data in the website feature data of the target website.

10. The method according to claim 9, characterized in that, The website feature data of the target website is obtained by loading the request launcher chain when the electronic device accesses the target website. The website feature data of the target website includes multiple web page resource links of the target website. The server cleans the variable data in the website feature data of the target website, including: The server removes variable data from multiple webpage resource links on the target website and retains immutable data; The variable data includes: the values ​​of query parameters in the plurality of web page resource links, the domain name of the internal resources, and the file name of the media resources in the web page resources; the immutable data includes one or more of the following: the file name and storage location of the CSS style file, the file name and storage location of the JS script file, the storage location of the media resources, the domain name of the external link, or the dynamic calling relationship between the plurality of web page resource links; the dynamic calling relationship between the plurality of web page resource links is used to characterize the calling relationship between the web page resource link and one or more sub-web page resource links when accessing the web page resource link.

11. The method according to any one of claims 1-10, characterized in that, The method further includes: The server uses the URL of the target website to match the URLs of multiple malicious websites in the website blacklist database; If the URL of the target website is included in the website blacklist database, the server uses the website fingerprint data and website feature data of the target website to match the website fingerprint data and website feature data of the multiple malicious websites. If the website fingerprint data of the target website differs from the website fingerprint data of the target malicious website, or if the website feature data of the target website differs from the website feature data of the target malicious website, the server adds the website fingerprint data and the website feature data of the target website.

12. The method according to any one of claims 1-11, characterized in that, The target website's metadata includes at least one of the following: the target website's name attribute, http-equip attribute, or content attribute; the name attribute includes at least one of the following: the target website's keyword information, the target website's description information, the target website's author information, or the target website's generator; the http-equip attribute includes at least one of the following: content-type, refresh information, or expiration information.

13. A website identification method, characterized in that, Applied to electronic devices, the method includes: In response to an operation to access a target website, the electronic device collects target website information, wherein the target website information includes website fingerprint data and website feature data of the target website; The electronic device sends the target website information to the server; The electronic device receives an interception instruction sent by the server. The interception instruction is used to intercept the target website. The interception instruction is sent by the server to the electronic device when the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website. The electronic device stops accessing the target website according to the interception instruction.

14. The method according to claim 13, characterized in that, The website fingerprint data of the target website includes at least one of the following: the title of the target website or the metadata of the target website.

15. The method according to claim 13, characterized in that, The website feature data of the target website includes information about the web page resources of the target website and the calling relationships between the web page resources; the web page resources include at least one of the following: internal resources, external resources called when accessing the internal resources, or backend interfaces, wherein the internal resources are resources with the same domain name as the domain name of the target website, and the external resources are resources with a different domain name than the domain name of the target website; the information of the web page resources includes the web page resource name and the web page resource directory; the web page resource directory is used to characterize the storage location of the web page resources in the target website; the calling relationships between the web page resources include at least one of the following: the internal resource storage hierarchy directory, backend interface information, external link information called when accessing the target website, or the dynamic calling relationships of the web page resources.

16. The method according to any one of claims 13-15, characterized in that, The interception instruction includes the website type and interception strategy corresponding to the URL of the target malicious website; The electronic device stops accessing the target website according to the interception instruction, including: The electronic device cancels the display of the webpage of the target website and displays a prompt message. The prompt message is used to inform the user that the target website is a malicious website. The prompt message corresponds to the website type and blocking strategy corresponding to the URL of the target malicious website. The website type is used to characterize the risk level of the target malicious website, and the blocking strategy corresponds to the website type.

17. The method according to any one of claims 13-16, characterized in that, The target website's metadata includes at least one of the following: the target website's name attribute, http-equip attribute, or content attribute; the name attribute includes at least one of the following: the target website's keyword information, the target website's description information, the target website's author information, or the target website's generator; the http-equip attribute includes at least one of the following: content-type, refresh information, or expiration information.

18. A website identification method, characterized in that, Applied to a website recognition system, the website recognition system including a server and electronic devices, the method includes: In response to an operation to access a target website, the electronic device collects target website information, wherein the target website information includes website fingerprint data and website feature data of the target website; The electronic device sends the target website information to the server; The server receives the target website information; If the website fingerprint data of the target website is the same as the website fingerprint data of the target malicious website, and the website feature data of the target website is the same as the website feature data of the target malicious website, the server sends an interception command to the electronic device, and the interception command is used to intercept the target website; The electronic device stops accessing the target website according to the interception instruction.

19. A server, characterized in that, The server includes: one or more processors and memory; The memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the server to perform the method as described in any one of claims 1-12.

20. An electronic device, characterized in that, The electronic device includes: one or more processors and memory; The memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the electronic device to perform the method as described in any one of claims 13-17.

21. A website identification system, characterized in that, The website identification system includes a server and an electronic device, wherein the server is used to perform the method as described in any one of claims 1-12, and the electronic device performs the method as described in any one of claims 13-17.

22. A chip system, characterized in that, The chip system includes one or more processors, which are configured to invoke computer instructions to cause a server to perform the method as described in any one of claims 1-12, or to cause an electronic device to perform the method as described in any one of claims 13-17.

23. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer instructions that, when executed on a server, cause the server to perform the method as described in any one of claims 1-12; or, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 13-17.

24. A computer program product, characterized in that, The computer program product includes computer program code that, when run on a server, causes the server to perform the method as described in any one of claims 1-12; or when run on an electronic device, causes the electronic device to perform the method as described in any one of claims 13-17.

Images