Website detection method and apparatus, and electronic device and readable medium

Abstract

Disclosed in the present application are a website detection method and apparatus, and an electronic device and a readable medium. The method comprises: in response to a target browser on an office terminal sending outwards, to a first website, a target file having a security protection attribute, acquiring website information of the first website; on the basis of the website information of the first website, determining whether the first website matches a pre-configured website design policy; and if the first website matches the pre-configured website design policy, generating an auditing result comprising the website information of the first website, wherein the auditing result is used for indicating that the behavior of sending outwards, over the target browser and to the first website, the target file having the security protection attribute has a potential security hazard.

Description

Website detection method, device, electronic device and readable medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese invention patent application number 202311092682.9, entitled “A website detection method, device, electronic device and readable medium”, filed on August 28, 2023, and the entire application is incorporated herein by reference. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to a website detection method, device, electronic device and readable medium. Background Art

[0004] When working, employees use office terminals. In many scenarios, they use browsers on these terminals to send files to websites. However, to ensure network and enterprise information security, it is often necessary to verify the security of these files. If the files are potentially unsafe, the security of the website from which they are sent must also be verified.

[0005] Currently, methods for detecting the security of websites that send out files include: traffic analysis and browser hacking. However, both methods affect the user experience and are detrimental to maintaining enterprise information security.

[0006] Based on this, there is an urgent need to provide a detection solution that is not perceived by users and maintains enterprise information security to detect whether the website that sends out files is safe.

[0007] Summary of the Invention

[0008] In order to solve the above technical problems, the present application provides a website detection method, device, electronic device and readable medium.

[0009] In order to achieve the above objectives, the technical solutions provided by this application are as follows:

[0010] In a first aspect, the present application provides a website detection method, which may include:

[0011] In response to an event of sending a target file through a target browser, obtaining website information of a first website from which the target file is sent; the target browser is a pre-configured detection-allowed browser, and the target file is a file pre-configured with a security protection attribute;

[0012] Based on the website information of the first website, determining whether the first website matches a pre-configured website audit policy; the website audit policy is used to indicate whether a website scope is allowed to be audited;

[0013] When the first website matches the website audit policy, an audit result is generated, where the audit result is used to indicate that there is a security risk on the target browser that the target file is leaked to the first website.

[0014] In some possible implementations, the method may further include:

[0015] Provide website audit policy configuration channel;

[0016] The website audit policy configured through the website audit policy configuration channel is received, wherein the website audit policy indicates a first category of websites that are to be skipped for auditing and / or indicates a second category of websites that must be audited.

[0017] In some possible implementations, the method may further include:

[0018] Two audit modes are provided, including a first audit mode and a second audit mode. The first audit mode is used to instruct auditing of all outbound activities on external websites; the second audit mode is used to instruct auditing of outbound activities on a specified website; the second audit mode supports configuration and updating of the specified website.

[0019] The selected audit mode is determined as the preconfigured website audit policy.

[0020] In some possible implementations, the method may further include:

[0021] Obtain events of operating files through the target browser, exclude events of performing predefined security operations through the target browser, and determine whether an event of the target browser sending the target file occurs; the security operation includes at least one of opening a local file in the browser, loading a browser plug-in, loading a browser extension, and sending to a local server.

[0022] In some possible implementations, obtaining the website information of the first website from which the target file is sent may include at least one of the following obtaining methods:

[0023] Obtaining website information of the first website based on user interface automation (UI Automation) callback information;

[0024] Calling an accessibility function to obtain website information of the first website;

[0025] Calling Core Graphics to obtain website information of the first website;

[0026] Parse a session file to obtain website information of the first website, wherein the session file is obtained through backup after monitoring the session update of the target browser.

[0027] In some possible implementations, the method may further include:

[0028] Provide a browser audit configuration channel; the browser audit configuration channel provides all browsers installed on the office terminal for selection and configuration;

[0029] The selected browser is determined as the detection-allowed browser.

[0030] In some possible implementations, the method may further include:

[0031] Generate an alarm and report it; the alarm includes website information of the first website, and the website information of the first website includes: at least one of a Uniform Resource Locator (URL), a website name, and a web page title.

[0032] In some possible implementations, the method may further include:

[0033] Blocking the response of the first website operating the target file on the target browser.

[0034] In some possible implementations, obtaining the website information of the first website from which the target file is sent may include:

[0035] When the event of sending the target file through the target browser is sensed to occur, the website information of the first website is triggered to be obtained after a preset time has passed.

[0036] In a second aspect, the present application further provides a website detection device, characterized in that the device comprises:

[0037] an acquiring unit, configured to acquire website information of a first website from which the target file is sent in response to an event in which a target file is sent via a target browser; the target browser is a pre-configured detection-allowed browser, and the target file is a file pre-configured with a security protection attribute;

[0038] A first determining unit is configured to determine whether the first website is a target audit website based on a preconfigured website audit policy and website information of the first website; the website audit policy is used to indicate whether a scope of websites to be audited is permitted;

[0039] The first generating unit is configured to generate an audit result when the first website is a target audit website, wherein the audit result is used to indicate that there is a security risk on the target browser that the target file is leaked to the first website.

[0040] In some possible implementations, the apparatus may further include:

[0041] A first providing unit is used to provide a website audit policy configuration channel;

[0042] The receiving unit is configured to receive the website audit policy configured through the website audit policy configuration channel, wherein the website audit policy indicates a first category of websites to be skipped for audit and / or indicates a second category of websites that must be audited.

[0043] In some possible implementations, the apparatus may further include:

[0044] The second providing unit is configured to provide two audit modes, the two audit modes including a first audit mode and a second audit mode, wherein the first audit mode is used to instruct to audit all outbound activities on external websites; the second audit mode is used to instruct to audit outbound activities on a designated website; the second audit mode supports configuration and update of the designated website;

[0045] The second determining unit is configured to determine the selected audit mode as the preconfigured website audit policy.

[0046] In some possible implementations, the apparatus may further include:

[0047] An exclusion unit is used to obtain events of operating files through the target browser, exclude events of performing predefined security operations through the target browser, and determine whether an event of the target browser sending the target file occurs; the security operation includes at least one of opening a local file by the browser, loading a browser plug-in, loading a browser extension, and sending to a local server.

[0048] In some possible implementations, the acquiring unit is specifically configured to perform at least one of the following acquiring methods:

[0049] Based on the UI Automation callback information, obtain website information of the first website;

[0050] Call Accessibility to obtain website information of the first website;

[0051] Call CoreGraphics to obtain the website information of the first website;

[0052] Parse the Session file to obtain website information of the first website, wherein the Session file is obtained through backup after monitoring the Session update of the target browser.

[0053] In some possible implementations, the apparatus may further include:

[0054] The third providing unit is used to provide a browser audit configuration channel; the browser audit configuration channel provides all browsers installed on the office terminal for selection and configuration;

[0055] The third determining unit is configured to determine the selected browser as the detection-allowed browser.

[0056] In some possible implementations, the apparatus may further include:

[0057] A second generating unit is configured to generate an alarm; the alarm includes website information of the first website, the website information of the first website including at least one of a URL, a website name, and a webpage title;

[0058] The sending unit is used to report the alarm.

[0059] In some possible implementations, the apparatus may further include:

[0060] A blocking unit is used to block the response of the first website operating the target file on the target browser.

[0061] In some possible implementations, the acquiring unit is specifically configured to:

[0062] When the event of sending the target file through the target browser is sensed to occur, the website information of the first website is triggered to be obtained after a preset time has passed.

[0063] It should be noted that the specific implementation method of the device and the technical effects achieved can be found in the relevant description of the method provided in the first aspect or any implementation method of the first aspect.

[0064] In a third aspect, the present application further provides an electronic device, the electronic device comprising: a processor and a memory;

[0065] The memory is used to store instructions or programs;

[0066] The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method provided by the above-mentioned target aspect or any one of the implementations of the target aspect.

[0067] In a fourth aspect, the present application also provides a readable medium, which stores instructions or programs. When the instructions or programs are run on a processor, the processor executes the method provided by the above-mentioned target aspect or any one of the implementations of the target aspect.

[0068] In a fifth aspect, the present application also provides a computer program product, comprising instructions, which, when executed by a processor, implement the method provided by the above-mentioned target aspect or any one of the implementations of the target aspect.

[0069] In the technical solution provided by the present application, the user's office terminal includes an audit client. If the user sends a target file through the target browser of the office terminal, the website information of the first website to which the target file is sent is obtained, wherein the target browser is a pre-configured browser that allows detection, and the target file is a pre-configured file with security protection attributes; then, based on the website information of the first website, it is determined whether the first website matches the pre-configured website audit policy, and the website audit policy is used to indicate whether the scope of the website allowed to be audited; when the first website matches the website audit policy, an audit result is generated, and the audit result is used to indicate that there is a security risk of the target file being leaked to the first website on the target browser. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0071] FIG1 is a flow chart of a website detection method provided in an embodiment of the present application;

[0072] FIG2 is a schematic diagram of a configuration page provided in an embodiment of the present application;

[0073] FIG3 is a schematic diagram of a customized selection page provided in an embodiment of the present application;

[0074] FIG4 is a schematic diagram of a new website page provided in an embodiment of the present application;

[0075] FIG5 is a schematic diagram of a detection process provided in an embodiment of the present application;

[0076] FIG6 is a schematic diagram of an audit client executing a detection process according to an embodiment of the present application;

[0077] FIG7 is a signaling diagram of an audit client executing a detection process according to an embodiment of the present application;

[0078] FIG8 is a schematic diagram of an overall process of website detection provided by an embodiment of the present application;

[0079] FIG9 is a schematic structural diagram of a website detection device 900 provided in an embodiment of the present application;

[0080] FIG10 is a schematic structural diagram of an electronic device 1000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] Employees often upload, download, and create files on their office terminals. Some files, such as employee and customer information, or confidential business data, need to be kept private. Public disclosure can impact employee or customer security at best, and even cause immeasurable damage to the company's competitiveness and social reputation. Therefore, monitoring employee behavior on office terminals is crucial.

[0082] In some cases, enterprise employees access various websites through browsers installed on their office terminals and send files to these websites, posing a security risk. Websites may include, but are not limited to, personal cloud storage, social forums, code hosting websites, or employee-owned network attached storage (NAS). This application embodiment studies current website detection solutions for this situation, and the identified deficiencies and related explanations are as follows.

[0083] Current website detection methods can be categorized into two types: Method 1, which involves analyzing traffic, and Method 2, which involves hacking into the browser. Method 1's approach can be summarized as follows: deploying a traffic detection system on office terminals or at network exits (i.e., the company's intranet gateway) to detect outbound requests for risky files or information. In some possible implementations of method one, it is necessary to replace the original Transport Layer Security (TLS) certificate on the browser of the office terminal with a trusted certificate. Not only will the replacement of the certificate be perceived by the user, but it will also affect the performance of the user accessing the website through the browser; in some other possible implementations of method one, it is necessary to hijack the traffic to the traffic detection system. Since the network environment in which the embodiment of the present application is applicable may be a company intranet, home broadband or public place wifi, when the network environment in which the office terminal is located is a non-company intranet environment, the traffic will not be hijacked to the detection gateway connected to the traffic detection system, and thus will not be detected by the traffic detection system; in some other possible implementations of method one, for office terminals in a non-company intranet environment, the traffic is introduced into the company intranet by configuring a proxy or tunnel on the office terminal. On the one hand, this implementation may conflict with other local network services of the office terminal, and on the other hand, it will generate additional traffic fees, affecting the user's office experience. The detection idea of ​​method two can be mainly summarized as follows: on the office terminal, the web page information of the website on the browser and the user's outbound operations are detected based on the browser. In some possible implementations of Method 2, detection is achieved by installing a plug-in or extension in the browser. In this implementation, the user can see the installation status of the browser plug-in or extension and manually uninstall the plug-in or extension. In other possible implementations of Method 2, detection is achieved by hooking the browser process. This implementation will affect the stability of the browser and may cause problems such as browser crashes, affecting the user's normal use of the browser. Moreover, due to the wide variety of browsers, Method 2 places high demands on the compatibility of plug-ins, extensions, or hooks, resulting in high upgrade and maintenance costs. Moreover, when obtaining website information of websites with security risks, the website information may only be used as supplementary information for the alarm, requiring operators to re-screen from the massive amount of alarms, which not only increases operation and maintenance costs but also makes it easy to miss security risks, which is not conducive to network security.

[0084] In response to the situation where a website is accessed through a browser installed on an office terminal and files or information are sent to the website, an embodiment of the present application designs a website detection method that can solve the shortcomings of current website detection solutions. An audit client is installed on the user's office terminal. If the user sends a target file with security protection attributes to a first website through a target browser of the office terminal, then, in response to the event of sending the target file through the target browser, the audit client can obtain the website information of the first website that sent the target file, and the target browser is a pre-configured browser that allows detection; then, based on the website information of the first website, it is determined whether the first website matches the pre-configured website audit policy, and the website audit policy is used to indicate whether the scope of the website allowed to be audited; if the first website matches the website audit policy, the audit client generates an audit result, and the audit result is used to indicate that there is a security risk of the target file being leaked to the first website on the target browser.

[0085] In this way, without affecting the user's use of the browser on the office terminal, by installing an audit client on the office terminal and pre-configuring a website audit policy on the audit client to indicate whether the audited website scope is allowed, when a target file with security risks is sent to a website on a certain browser, the audit client can be triggered to obtain the website information of the website and determine whether the website matches the website audit policy. If it matches, the audit client can consider that there is a security risk in the behavior of sending the target file to the website through the browser, and thus generate an audit result to indicate that there is a security risk of file leakage to the website on the browser, thereby completing a security detection of the website, accurately detecting the website that has sent files with security risks through the browser, and providing a reliable basis for subsequent alarms and security maintenance.

[0086] It should be noted that the office terminal can refer to the terminal equipment used by enterprise employees for office work, such as a laptop or desktop computer. The office terminal can be understood as a terminal device that belongs to the enterprise and the enterprise has the right to supervise and manage. The monitoring and management behavior is an agreement between the enterprise and the enterprise employees, does not involve personal privacy, and is limited to maintaining the information security and network security of the enterprise, its employees and its customers. The operating system of the office terminal can be: Windows, macOS or Linux. The audit client can also be called a detection client, which refers to a client installed on the office terminal for detecting whether there are security risks in the behavior of sending files with security risks to a website through a browser. Management personnel or operation and maintenance personnel can configure the website audit policy in the interface connected to the audit server corresponding to the audit client. After the configuration of the website audit policy is completed, the audit client will always run in the background when the office terminal is turned on. The audit client performs website detection based on the website audit policy and finds that there is a security risk of files leaking to a website on the browser.

[0087] In the embodiment of the present application, a file can be understood as a summary of all content that can be sent out through a browser. For example, a file can include at least one of the following content forms: documents, image information, video information, text information, etc.

[0088] It should be noted that the subject implementing the website detection method can be the website detection device provided in the embodiments of the present application. The website detection device can include an audit client, or the website detection device can interact with the audit client, or the website detection device can be understood as the audit client itself. The website detection device can be carried in an electronic device or a functional module of an electronic device. The electronic device can be installed with an audit client, or can access the audit client.

[0089] Figure 1 is a flow chart of a website detection method provided in an embodiment of the present application. This method can be applied to a website detection device, such as website detection device 900 shown in Figure 9 below. Since the website detection device may include an audit client, interact with an audit client, or be the audit client itself, the method can also be considered to be applied to the audit client, and the office terminal where the audit client is located may also include at least a target browser.

[0090] As shown in FIG1 , the method may include, for example, the following S101 to S103:

[0091] S101, in response to an event of sending a target file through a target browser, obtaining website information of a first website from which the target file is sent; the target browser is a pre-configured detection-allowed browser, and the target file is a pre-configured file with security protection attributes.

[0092] The target file can be understood as a file with security protection attributes. The file with security protection attributes can be understood as containing data that needs to be kept confidential, such as personal information, customer information, internal codes, or other confidential business data. The security access attribute can be an attribute tag pre-marked for the file, which is used to indicate whether the file requires security protection, that is, whether it is allowed to be sent to an external website. The security protection attribute can also be determined based on the content contained in the file itself. For example, when the file contains a preset security attribute keyword, it is determined that the file has security protection attributes. Taking a mobile phone number as an example, in one case, the security protection attribute can be the attributes of the mobile phone number. For example, the security protection attribute can include: an 11-digit number and a specific symbol starting with 130, 131, 132, 135, 137, 138, 150, 152, etc. Then, if the outgoing file includes a part that matches the security protection attribute, then the outgoing file can be understood as a target file with security protection attributes. In another case, the security protection attribute can be the attribute tag of "mobile phone number". If the outgoing file includes the attribute tag of "mobile phone number", or if it is determined through content analysis of the outgoing file itself that the file can be added with the attribute tag of "mobile phone number", then the outgoing file can be understood as a target file with security protection attributes.

[0093] Here, outbound may refer to the action of opening and reading the target file.

[0094] To facilitate configuration by administrators or maintenance personnel, the audit server corresponding to the audit client provides an interface with a configuration page on which administrators or maintenance personnel can configure the website audit policy of the audit client. This configuration page includes at least configuration items for the website audit policy. Furthermore, the configuration page may also include configuration items for the browser audit policy.

[0095] As an example, the configuration page may also provide a selection of two audit modes, with the selected audit mode being determined as the preconfigured website audit policy. The two audit modes may include a first audit mode, where the first audit mode is used to audit all outbound activities on external websites, and a second audit mode, where the second audit mode is used to audit outbound activities on a specific website. The second audit mode supports configuration and updating of the specific website.

[0096] When the network audit policy corresponds to the second audit mode, a website audit policy configuration channel may be provided on the configuration page, and the audit client may receive the website audit policy configured through the website audit policy configuration channel. The website audit policy may indicate that first-category websites should be skipped for audit, and / or indicate that second-category websites must be audited. If only first-category websites are configured, then the designated websites under the second audit mode may be all external websites excluding first-category websites; if only second-category websites are configured, then the designated websites under the second audit mode may be second-category websites; if both first-category and second-category websites are configured, then the designated websites under the second audit mode may be websites that belong to the second category and do not belong to the first category.

[0097] As an example, the configuration page may also provide a browser audit configuration channel, which provides all browsers installed on the office terminal for selection and configuration. For example, the selected browser can be used as a browser allowed for detection. The audit client can receive the browsers allowed for detection configured through the browser audit configuration channel, which include the target browser in S101.

[0098] For example, Figure 2 shows a schematic diagram of a configuration page. As shown in Figure 2, the configuration page may include a configuration section for browsers that need to be detected, a configuration section for websites that need to be detected, and a configuration section for websites that do not need to be detected. In addition, the configuration page may also include a configuration section for browsers that do not need to be detected. Each configuration section may include at least one option and / or a "Customize" button. The user may check the option by clicking the selection box corresponding to the option or select the option by double-clicking the selection box corresponding to the option. The user may also enter the selection page for a custom browser or website by clicking the "Customize" button. Figure 3 shows a selection page for a custom website as an example. The selection page includes at least one saved custom website. Each custom website may include at least one of the following information: URL, web page title, or website name. The website name may be user-configured, and each custom website may be edited or deleted. In addition, the selection page shown in FIG3 may also include a "New Website" option. When the user clicks the "New Website" option, the selection page jumps to the new website page shown in FIG4. The user can enter at least one of the URL, webpage title, or website name of the website to be added on the new website page. By clicking the "OK" button, the new website creation action is completed, the new website page is closed, and the selection page shown in FIG3 is displayed. The new website then becomes a custom website maintained on the selection page shown in FIG3. To facilitate the user's selection of a custom website, the custom websites on the selection page shown in FIG3 can be arranged in chronological order according to the time at which the custom websites were created. For example, the newly created website can be displayed at the top.

[0099] For example, if the display page does not provide a browser audit configuration channel, that is, if the browser set configuration function is not available, the audit client may default to testing all browsers installed on the office terminal. In this case, in S101, the target browser can be any browser on the office terminal. That is, no matter which browser the user uses to send a target file to the first website, the acquisition of the website information of the first website will be triggered.

[0100] As another example, if a browser audit configuration channel is provided on the display page, i.e., it has the function of configuring a browser set, then S101 may include, for example, the following: in response to an event in which a target file is sent externally on a target browser, determining whether the target browser matches the browser set configured via the browser audit configuration channel; if so, obtaining the website information of the first website that sent the target file; if not, no longer obtaining the website information of the first website that sent the file, and subsequent steps S102 to S103 are performed, terminating the current detection. The browser set is used to indicate browsers that need to be detected. In one case, if the configuration page prompts you to configure a browser set that does not need to be detected, then all browsers included in the browser set are browsers that do not need to be detected. The browser set indirectly indicates browsers that need to be detected. The target browser's match with the browser set configured via the browser audit configuration channel may indicate that the target browser does not belong to the configured browser set. In another case, if the configuration page prompts you to configure a browser set that needs to be detected, then all browsers included in the browser set are browsers that need to be detected. The browser set directly indicates browsers that need to be detected. The target browser's match with the browser set configured via the browser audit configuration channel may indicate that the target browser belongs to the configured browser set. In another case, if the configuration page prompts that the configured browser set includes a first category of browsers that need to be detected and a second category of browsers that do not need to be detected, then the target browser matching the browser set configured through the browser audit configuration channel can mean that the target browser does not belong to the second category of browsers but belongs to the first category of browsers. In this way, the display page can flexibly design the function of configuring the browser set according to actual needs, implementing browser-specific detection filtering. The website detection method provided by the embodiment of the present application is only executed for the behavior of sending target files on browsers that match the browser set, making the website detection method more intelligent.

[0101] It should be noted that, in the embodiment of the present application, in order to make the website detection more accurate, after obtaining the event of operating the file through the target browser, the event of performing a predefined security operation through the target browser can be excluded to determine whether the event of the target browser sending the target file has occurred. If it is determined that the event of the target browser sending the target file has occurred, then the method provided in the embodiment of the present application is executed to achieve website detection; if it is determined that the event of the target browser sending the target file has not occurred, but it is a predefined security operation, then it is considered unnecessary to execute the method provided in the embodiment of the present application. Among them, the predefined security operation can include at least one of the browser opening a local file, loading a browser plug-in, loading a browser extension, and sending to a local server. For different types of security operations, the timing of executing the above exclusion steps can be flexibly set. For example, for the security operation of loading a browser plug-in or loading a browser extension, it can be executed before S101; for the security operation of the browser opening a local file or sending to a local server, it can be executed after S101 and before S102.

[0102] In some implementations, it is considered that operating the target file can not only be an outgoing action, but also an action of loading a browser plug-in caused by a plug-in or an action of loading a browser extension caused by an extension. Specifically, the browser's configuration file usually records the installation location of the installed plug-in or extension. When the browser loads the plug-in or extension, the path corresponding to the installation location of the plug-in or extension will be read. The action of reading the path corresponding to the installation location of the plug-in or extension may also be perceived by the audit client as an act of sending the target file to the first website on the target browser. Therefore, in order to improve the accuracy of website detection and avoid false positives due to extension or plug-in loading, after the audit client perceives the event of operating a file on the target browser, before obtaining the website information of the first website, the method may also include: based on the configuration file of the target browser, determining whether the operation belongs to the action of loading a browser plug-in or loading a browser extension; if so, then no longer obtaining the website information of the first website and the subsequent steps S102 to S103; if not, then triggering the execution of obtaining the website information of the first website.

[0103] The website information of the first website may include, but is not limited to, at least one of: a URL, a website name, and a webpage title.

[0104] In some implementations, the website information of the first website can be obtained from the cache information for the browser, for example. Since the cache information of the browser is near real-time rather than absolutely real-time, there is a certain delay. Therefore, in order to ensure that the website information of the first website obtained in S101 is not the website information of other websites previously cached, the website information of the first website obtained in S101 may include, for example: triggering the acquisition of the website information of the first website after a preset time (such as 2 seconds) has passed since the event of sending the target file through the target browser begins. In this way, it is possible to optimize the situation where the cache information may not match the website information of the first website to be detected, such as using "right-click-open" to open the browser, and overcome the problem of inaccurate website information of the first website obtained.

[0105] As an example, obtaining the website information of the first website in S101 includes at least one of the following methods: a. Based on UI Automation callback information, obtaining the website information of the first website, the registered UI Automation notifies the audit client to cache the callback information when the component of the target browser changes; b. Calling Accessibility to obtain the website information of the first website; c. Calling CoreGraphics to obtain the website information of the first website; d. Parsing the Session file to obtain the website information of the first website, the Session file is obtained through backup after monitoring the Session update of the target browser. Among them, UI Automation, Accessibility and CoreGraphics can be understood as interfaces opened by the operating system of the office terminal to the target browser, and the Session file can be understood as a type of file in the file system of the office terminal. Before the audit client starts to perform detection, the audit client will monitor the browser startup or exit events and register the UI Automation notification callback so that when the browser component changes, the audit client will be notified to cache the callback information. For a, the cached UI Automation callback information can be read directly; in addition, the audit client will also monitor the update of the Session file in the browser, and perform a backup operation after the update of the Session file in the browser is completed to record the current browsing status. For d, the Session file can be directly read and parsed to obtain the website information of the first website.

[0106] In a specific implementation, S101 can obtain the website information of the first website based on any one or more of the above methods a, b, c, and d. If the website information of the first website is obtained based on two or more methods, then a corresponding priority can be set for each method based on the accuracy of the website information obtained by the multiple methods to ensure that when the same information item (such as URL) is obtained by multiple methods but the specific information is different, the website information of the first website can be determined based on the priority corresponding to each method, and each information item in the determined website information has unique specific information. For example, the website information of the target website is obtained based on method a and method b, and the priority of b is higher than the priority of a. The URL 2 is obtained based on method a, and the URL 1 and web page title 1 are obtained based on method b. Then, the website information of the first website obtained based on method a and method b may include: URL 1 and web page title 1.

[0107] Moreover, the determined website information can be an information item of the website information obtained by each method used. For example, the website information of the first website is obtained based on method a and method b. The URL 1 and website name 1 of the first website are obtained based on method a, and the URL 1 and web page title 1 of the first website are obtained based on method b. Then, the website information of the first website obtained based on method a and method b can include: URL 1, web page title 1 and website name 1.

[0108] It can be seen that the website information of the first website obtained through S101 provides a data basis for implementing website detection based on the embodiment of the present application.

[0109] S102: Based on the website information of the first website, determine whether the first website matches a pre-configured website audit policy; the website audit policy is used to indicate whether a website scope for which audit is allowed.

[0110] In some implementations, considering that operating the target file on the target browser can be not only an outbound action, but also a local operation such as opening a local file or sending it to a local server. Specifically, the browser may be used as a reader for a certain file format (such as Portable Document Format (PDF)). In this case, the website information of the first website accessed may include the local path where the file in this format is stored locally. Alternatively, during the debugging phase of website development, a developer may open a local server on the browser to upload a file. Such local operations may also be perceived by the audit client as the operation of the target file on the first website on the target browser. Therefore, in order to improve the accuracy of website detection and avoid false positives due to local operations, after obtaining the website information of the first website, before step S102, based on the website information of the first website, it can be determined whether the event of operating the file through the target browser is a local operation event among the predefined security operations. If so, the subsequent steps S102 to S103 are not executed. If not, the execution of S102 is triggered.

[0111] As an example, if the website audit policy corresponds to the first audit mode, the display page may not have a website collection configured, and the audit client will default to checking all websites. In this case, the first website can be any website accessible on the target browser. That is, regardless of whether the user sends the target file to any website on the target browser of the office terminal, the result of the judgment in S102 is considered to be yes, and S103 can be continued.

[0112] As another example, if the website audit policy corresponds to the second audit mode, the function of configuring the website collection can be configured on the display page, and the website audit policy indicates whether the scope of websites that are allowed to be audited is based on the configured website collection. S102 may include, for example: based on the website information of the first website obtained, judging whether the first website matches the pre-configured website audit policy, if it matches, generating an audit result; if it does not match, then no longer executing the subsequent S103, terminating the execution of this detection. Among them, the website audit policy is used to indicate whether the scope of websites that are allowed to be audited is allowed. In one case, the configuration page prompts to configure the first category of websites that do not need to be detected (also known as needing to be excluded or skipped for audit), that is, the website audit policy indicates the first category of websites that are skipped for audit, the first category of websites indirectly indicates the websites that need to be detected, and the first website matching the website audit policy may mean that the first website does not belong to the first category of websites. In another case, the configuration page prompts to configure the second category of websites that need to be detected, that is, the website audit policy indicates the second category of websites that must be audited, the second category of websites directly indicates the websites that need to be detected, and the first website matching the website audit policy may mean that the first website belongs to the second category of websites. In another case, if the configuration page prompts you to configure a first-category website and a second-category website, then the first website's match with the website audit policy may mean that the first website does not belong to the first category but to the second category. In this way, the display page can flexibly design and configure the website collection function according to actual needs, implementing website-level detection and filtering. The website detection method provided in the embodiment of the present application is executed only for the behavior of websites that match the website collection configured in the website audit policy sending target files, making the website detection method more intelligent.

[0113] It can be seen that S102 uses the pre-configured website audit policy and the website information of the first website obtained by S101 to determine whether sending a target file that is not desired to be sent out to the first website is an act of security risks, sets detection rules (i.e., website audit policy) from the website dimension and performs detection, making the detection both convenient and accurate.

[0114] S103: When the first website matches the website audit policy, an audit result is generated, where the audit result is used to indicate that there is a security risk on the target browser that the target file is leaked to the first website.

[0115] In specific implementation, when it is determined that the first website matches the website audit policy, it can be determined that sending a target file that does not want to be sent out by the target browser to the first website is an act that poses a security risk. Therefore, an audit result is generated. The audit result may at least include the website information of the first website, which is used to inform the management personnel that the act of sending the target file has occurred, and the specific website where the act occurred is the first website.

[0116] In some possible implementations, in order to further alert the enterprise to the existence of this security risk, the method may also include: generating an alarm message based on the audit result, the alarm message may at least include the website information of the first website, the alarm message is used to indicate that the behavior of sending the target file with security protection attributes to the first website on the target browser has a security risk; and sending the alarm message to the audit server corresponding to the audit client. For example, the alarm message may include outgoing information, and the outgoing information may include: the URL of the first website, the web page title and the website name. In addition, the outgoing information may also include at least one of the following information: event identifier, outgoing time, reporting time, target browser, screenshot evidence, hit website audit policy or hit security protection attribute. In addition, the alarm message may also include file information, and the file information may include, for example, at least one of the following information: the file name of the target file, the file path, the file size, the file MD5 or the file type.

[0117] In some possible implementations, in order to further remind the enterprise of the security risk, in addition to issuing an alarm, the enterprise's network and information security can be improved more quickly and effectively by blocking the response of the first website operating the target file on the target browser.

[0118] It can be seen that in this method, under the premise of not affecting the user's use of the browser on the office terminal, by installing the audit client on the office terminal and pre-configuring the website audit policy on the audit client, when a target file with security protection attributes is sent to a website on a certain browser, the audit client can be triggered to obtain the website information of the website and determine whether the website matches the website audit policy. If it matches, the audit client can consider that there is a security risk in the behavior of sending the target file to the website through the browser, thereby generating an audit result including the website information of the website, completing a security check on the website, accurately detecting the website that has sent a security risk file through the browser and obtaining the website information of the website, and making preparations for realizing reliable alarm and security maintenance for this situation.

[0119] In order to make the method provided in the embodiment of the present application clearer, a possible specific implementation method is exemplarily described below with reference to the accompanying drawings.

[0120] In an embodiment of the present application, the audit client on the office terminal detects that the first website of the browser sends out a target file that does not want to be leaked, and extracts the website information of the first website (including the URL and / or web page title of the first website) in a non-invasive manner, and performs the detection of the first website according to the pre-configured website audit policy. If an audit result is generated, a corresponding alarm information is generated, and the audit client reports the alarm information to the audit server, and the audit server displays the alarm information to the management personnel.

[0121] The above process may include: configuring the website audit policy in the audit client backend and implementing the test in the audit client, as shown in Figure 5. The audit client backend may refer to an interface provided by the audit server corresponding to the audit client, which may provide a configuration page (for example, as shown in Figure 2).

[0122] Taking the website audit policy corresponding to the second audit mode as an example, as shown in FIG5 , the process of configuring the website audit policy in the audit client backend may include:

[0123] S11, determine whether to start browser detection, if yes, execute S12 and / or S13, otherwise end the process.

[0124] S12, selecting a website to be detected on the configuration page to obtain a second category of websites.

[0125] S13, selecting websites that do not need to be detected on the configuration page to obtain first-category websites.

[0126] Among them, the websites in S12 and S13 can be selected built-in websites, such as chat software, network disk, mailbox, cloud notes, cloud documents, code hosting or forum; or, they can be customized websites. When customizing a website, you need to configure the website URL and / or web page title, and you can also configure the website name. Among them, the URL supports regular matching.

[0127] It should be noted that Category 1 websites generally have a higher priority than Category 2 websites. That is, during the detection process, Category 1 websites are prioritized for matching. Category 2 websites are matched only if the first website does not belong to the Category 1. If the first website does belong to the Category 1, subsequent detection processes are not performed. If it is determined that the first website does not belong to the Category 1, then whether it belongs to the Category 2 is determined. If the first website does belong to the Category 2, subsequent detection processes are performed. If the first website does not belong to the Category 2, subsequent detection processes are not performed.

[0128] The above S12 to S13 can be considered as the configuration of the website audit policy.

[0129] Optionally, the process may further include configuration of filtering rules, for example, including the following S14 to S15:

[0130] S14, viewing and / or filtering outgoing websites and detailed website information.

[0131] Optionally, the process may also include:

[0132] S15: Configure filtering rules, where the filtering rules are used to filter local operations of the browser and / or loading of extensions (or plug-ins) of the browser.

[0133] As shown in FIG5 , the process of implementing the inspection by the audit client may include:

[0134] S21, determine whether the audit client has enabled browser detection, if so, execute S22, otherwise end the process.

[0135] S22, turn on browser behavior monitoring.

[0136] S23, triggering the browser to send outbound detection to obtain the website information of the first website (including the URL and the webpage title).

[0137] S24, performing a judgment on the website information of the first website according to the website audit policy and the filtering rules. If the judgment result is a match, generating corresponding audit results and warning information according to the website information of the first website.

[0138] Among them, "if the judgment result is a match" can be understood as: based on the website information of the first website, it is determined that the first website matches the website audit policy, and the behavior of sending the target file to the first website does not belong to the security operation indicated by the filtering rule.

[0139] S25, sends the alarm information to the audit server to provide a data basis for the execution of S14.

[0140] The detection process of the audit client on the office terminal is shown in FIG6 , and may include:

[0141] S31, after starting the website detection, the audit client performs the following: (1) monitoring the browser startup or exit events, registering the UI Automation notification callback, and notifying the audit client when the browser component changes; (2) monitoring the update of the browser session file, performing a backup operation after the update is written, and recording the current browsing status.

[0142] S32, when the user sends the target file through the first website, the audit client executes: (1) the browser opens or reads the target file, triggering the audit client to start the detection process; (2) the audit client determines that the website information of the first website (also called site information) needs to be obtained.

[0143] In step S33, the audit client obtains website information of the first website, including at least one of the following methods: (1) reading the currently cached UI Automation callback information to obtain relevant information of the active window or active tab; (2) calling Accessibility to check the window of the target browser to obtain the URL and webpage title of the first website; (3) calling CoreGraphics to check the window of the target browser to obtain the title of the window (i.e., the webpage title); (4) parsing the backed-up Session file to obtain relevant information of the active window or active tab. Among them, (1) to (4) in step S33 correspond to a to d in the method shown in FIG1 above, respectively.

[0144] S34, the audit client performs detection according to the website audit policy based on the website information of the first website obtained: (1) according to the priority, it matches the websites that need to be ignored (i.e., the first category of websites) and the websites that need to be detected (i.e., the second category of websites) in sequence; (2) if the website that needs to be ignored is hit, the current detection process is skipped; (3) if the website that needs to be detected is hit, the current detection process is continued and an alarm message is generated.

[0145] S35, when the audit client generates alarm information, it can fill the website information of the first website into the alarm information and report the alarm information to the audit server.

[0146] The detection process of the audit client on the office terminal is based on the signaling interaction process shown in FIG7 , and may include, for example:

[0147] S41, the user opens or switches the browser web page, and the browser executes: S411, notifies UI Automation of the UI change, UI Automation notifies the audit client of the change, and the audit client updates and caches; S412, updates the page information to the Session file, the Session file notifies the file operation to the file system event source, and the file system event source notifies the audit client to update and back up.

[0148] S42, the user sends the target file on the browser, and the browser uploads the target file on the website. The file system event source perceives that the target file is opened or read, and the file system event source notifies the audit client: the browser has opened or read the target file on the website.

[0149] S43, after performing general filtering, the audit client parses the backed-up Session file to obtain relevant information about the active page.

[0150] S44, the audit client requests Accessibility to obtain UI component information, Accessibility reads or enumerates components from the browser, the browser sends the target component field to Accessibility, and Accessibility returns relevant information about the active page to the audit client.

[0151] S45: The audit client determines that the first website is leaked, and filters the first website according to the website audit policy.

[0152] S46: When the audit client determines that there is a leakage risk, it generates and sends an alarm message to the audit server.

[0153] S47, the audit server saves the alarm information and displays it.

[0154] To make the website detection process clearer, the following describes the overall process involved in website detection with reference to Figure 8. As shown in Figure 8, the overall process of website detection may include:

[0155] S51: The audit client detects that the process of the browser to be detected performs an operation of opening or reading a file.

[0156] S52: Exclude the operation from loading a browser extension (or plug-in).

[0157] S53: Determine that the file is a file with security protection attributes.

[0158] S54: Obtain website information of the first website that performs the operation.

[0159] S55: Exclude the operation as a local operation based on the URL in the website information of the first website.

[0160] S56: According to the set of websites that need to be ignored, exclude the first website as a website that does not need to be detected.

[0161] S57: According to the set of websites that need to be detected, determine the first website as a website that needs to be detected.

[0162] S58, executing responses such as evidence collection or blocking.

[0163] S59, assemble the alarm and report it.

[0164] It should be noted that, in the process shown in FIG8 , S51, S53, S58 and S59 are general steps for website detection, S52 and S54 to S57 are steps designed for the website detection method provided in the embodiment of the present application (corresponding to the steps displayed with a gray background in FIG8 ), among which S54, S56 and S57 are steps that must be executed, and S52 and S55 are optional steps for implementing filtering rules.

[0165] It can be seen that through the website detection method designed in the embodiment of the present application, the audit client can obtain the website information of the website that is sending files in near real time without generating user perception and without affecting the user's browser experience. When there are multiple browsers, multiple browser windows, personal data or tabs at the same time, the website that is sending files can be accurately located. When a specific browser is detected to be sending files, the website information of the corresponding website is obtained, and the website audit policy configured by the website information and the administrator is matched. When the website that does not need to be detected is not hit, and the website that needs to be detected is hit, an alarm message including the website information of the website is generated and reported to the audit server. In addition, in order to obtain more accurate website detection results, the website detection method also includes the matching of filtering rules, that is, the browser's actions such as opening local files, loading plug-ins, loading extensions, and sending to the local server are distinguished from the outgoing files to avoid false positives.

[0166] Accordingly, the embodiment of the present application further provides a website detection device 900, as shown in FIG9 . The device 900 can be applied to an audit client of an office terminal, which also includes a target browser. The device 900 can include, for example:

[0167] The acquisition unit 901 is used to obtain the website information of the first website from which the target file is sent in response to the event of sending the target file through the target browser; the target browser is a pre-configured detection-allowed browser, and the target file is a pre-configured file with security protection attributes.

[0168] The first determining unit 902 is configured to determine whether the first website is a target audit website based on a preconfigured website audit policy and website information of the first website; the website audit policy is used to indicate whether a scope of websites to be audited is allowed.

[0169] The first generating unit 903 is configured to generate an audit result when the first website is a target audit website, wherein the audit result is used to indicate that there is a security risk that the target file on the target browser is leaked to the first website.

[0170] In some possible implementations, the apparatus 900 may further include:

[0171] A first providing unit is used to provide a website audit policy configuration channel;

[0172] The receiving unit is configured to receive the website audit policy configured through the website audit policy configuration channel, wherein the website audit policy indicates a first category of websites to be skipped for audit and / or indicates a second category of websites that must be audited.

[0173] In some possible implementations, the apparatus 900 may further include:

[0174] The second providing unit is configured to provide two audit modes, the two audit modes including a first audit mode and a second audit mode, wherein the first audit mode is used to instruct to audit all outbound activities on external websites; the second audit mode is used to instruct to audit outbound activities on a designated website; the second audit mode supports configuration and update of the designated website;

[0175] The second determining unit is configured to determine the selected audit mode as the preconfigured website audit policy.

[0176] In some possible implementations, the apparatus 900 may further include:

[0177] An exclusion unit is used to obtain events of operating files through the target browser, exclude events of performing predefined security operations through the target browser, and determine whether an event of the target browser sending the target file occurs; the security operation includes at least one of opening a local file by the browser, loading a browser plug-in, loading a browser extension, and sending to a local server.

[0178] In some possible implementations, the acquiring unit 901 is specifically configured to perform at least one of the following acquiring methods:

[0179] Based on the UI Automation callback information, obtain website information of the first website;

[0180] Call Accessibility to obtain website information of the first website;

[0181] Call CoreGraphics to obtain the website information of the first website;

[0182] Parse the Session file to obtain website information of the first website, wherein the Session file is obtained through backup after monitoring the Session update of the target browser.

[0183] In some possible implementations, the apparatus 900 may further include:

[0184] The third providing unit is used to provide a browser audit configuration channel; the browser audit configuration channel provides all browsers installed on the office terminal for selection and configuration;

[0185] The third determining unit is configured to determine the selected browser as the detection-allowed browser.

[0186] In some possible implementations, the apparatus 900 may further include:

[0187] A second generating unit is configured to generate an alarm; the alarm includes website information of the first website, the website information of the first website including at least one of a URL, a website name, and a webpage title;

[0188] The sending unit is used to report the alarm.

[0189] In some possible implementations, the apparatus 900 may further include:

[0190] A blocking unit is used to block the response of the first website operating the target file on the target browser.

[0191] In some possible implementations, the acquiring unit 901 is specifically configured to:

[0192] When the event of sending the target file through the target browser is sensed to occur, the website information of the first website is triggered to be obtained after a preset time has passed.

[0193] It should be noted that the specific implementation of the device 900 and the technical effects achieved can be found in the relevant description of the method shown in FIG1 .

[0194] In addition, an embodiment of the present application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device executes any implementation of the comment display method provided in the embodiment of the present application.

[0195] Referring to FIG10 , a schematic diagram of the structure of an electronic device 1000 suitable for implementing an embodiment of the present disclosure is shown. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. The electronic device shown in FIG10 is merely an example and should not limit the functionality and scope of use of the embodiments of the present disclosure.

[0196] As shown in FIG10 , the electronic device 1000 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1008 into a random access memory (RAM) 1003. Various programs and data required for the operation of the electronic device 1000 are also stored in the RAM 1003. The processing device 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0197] Typically, the following devices may be connected to the I / O interface 1005: an input device 1006 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1008 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device 1000 to communicate with other devices wirelessly or by wire to exchange data. Although FIG. 10 illustrates the electronic device 1000 with various devices, it should be understood that not all of the devices shown are required to be implemented or present. More or fewer devices may alternatively be implemented or present.

[0198] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1008, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0199] The electronic device provided by the embodiment of the present disclosure and the method provided by the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0200] An embodiment of the present application also provides a computer-readable medium, which stores instructions or computer programs. When the instructions or computer programs are executed on a device, the device executes any implementation of the comment display method provided in the embodiment of the present application.

[0201] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0202] In some embodiments, the client and server can communicate using any currently known or later developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or later developed network.

[0203] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0204] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device can perform the method.

[0205] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0206] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0207] The units involved in the embodiments described in this disclosure may be implemented in software or hardware, wherein the name of a unit / module does not, in some cases, limit the unit itself.

[0208] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0209] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0210] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems or devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0211] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0212] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0213] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0214] It should be noted that in the embodiments of the present application, user sensitive information is not involved, and user-related information is obtained, used and determined after user authorization. In one example, before obtaining user-related information, the corresponding interface displays prompt information related to obtaining data use authorization. This prompt information is based on relevant laws and regulations and informs the user of the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure in an appropriate manner, so that the user can determine whether to agree to the authorization based on the prompt information. It can be understood that the above-mentioned notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation method of this disclosure. Other methods that meet relevant laws and regulations can also be applied to the implementation method of this disclosure.

[0215] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A website detection method, comprising: In response to an event of sending a target file externally through a target browser, obtaining website information of a first website from which the target file is sent externally; The target browser is a pre-configured browser that allows detection, and the target file is a file that is pre-configured with a security protection attribute; Based on the website information of the first website, determining whether the first website matches a preconfigured website audit policy; the website audit policy is used to indicate whether the scope of the website to be audited is allowed; When the first website matches the website audit policy, an audit result is generated, where the audit result is used to indicate that there is a security risk that the target file on the target browser is leaked to the first website.

2. The method according to claim 1, further comprising: Provide website audit policy configuration channel; The website audit policy configured through the website audit policy configuration channel is received, wherein the website audit policy indicates a first category of websites that are to be skipped for auditing, and / or indicates a second category of websites that must be audited.

3. The method according to claim 1, further comprising: Two audit modes are provided, the two audit modes include a first audit mode and a second audit mode, the first audit mode is used to indicate that an audit is performed on all external website outbound behaviors; the second audit mode is used to indicate that an audit is performed on a designated website outbound behaviors; the second audit mode supports configuration and update of the designated website; The selected audit mode is determined as the preconfigured website audit policy.

4. The method according to claim 1, further comprising: Events of operating files through the target browser are obtained, and events of performing predefined security operations through the target browser are excluded, and it is determined whether an event of the target browser sending the target file occurs; the security operation includes at least one of opening a local file in the browser, loading a browser plug-in, loading a browser extension, and sending to a local server.

5. The method according to any one of claims 1 to 4, wherein the obtaining the website information of the first website from which the target file is sent externally comprises at least one of the following obtaining methods: Based on the UI Automation callback information, obtain the website information of the first website; Calling the Accessibility function to obtain website information of the first website; Call CoreGraphics to obtain website information of the first website; The session file is parsed to obtain the website information of the first website, wherein the session file is obtained through backup after monitoring the session update of the target browser.

6. The method according to any one of claims 1 to 5, further comprising: Provide browser audit configuration channel; The browser audit configuration channel provides all browsers installed on the office terminal for selection and configuration; The selected browser is determined as the detection-allowed browser.

7. The method according to any one of claims 1 to 6, further comprising: Generate and report alarms; The alarm includes website information of the first website, the website The website information includes at least one of a uniform resource locator (URL), a website name, and a web page title.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Blocking the response of the first website operating the target file on the target browser.

9. The method according to any one of claims 1 to 8, wherein obtaining the website information of the first website from which the target file is sent externally comprises: When the event of sending the target file through the target browser is sensed to occur, the website information of the first website is acquired after a preset time.

10. A website detection device, comprising: An acquisition unit, configured to acquire website information of a first website from which the target file is externally sent in response to an event in which the target file is externally sent through a target browser; The target browser is a pre-configured browser that allows detection, and the target file is a file that is pre-configured with a security protection attribute; A determination unit, configured to determine whether the first website is a target audit website based on a preconfigured website audit policy and website information of the first website; the website audit policy is used to indicate whether a website scope for audit is allowed; A generating unit is used to generate an audit result when the first website is a target audit website, wherein the audit result is used to indicate that there is a security risk that the target file on the target browser is leaked to the first website.

11. An electronic device, comprising: Processor and memory; The memory is used to store instructions or programs; The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method according to any one of claims 1 to 9.

12. A readable medium storing instructions or programs, which, when executed on a processor, enable the processor to execute the method according to any one of claims 1 to 9.

13. A computer program product comprising instructions, which when executed by a processor implement the method of any one of claims 1 to 9.

Images