Website link security check method

Abstract

Embodiments of the present disclosure provide a website link security check method. The method comprises: adding a website link identified as being in a security state into a multi-level whitelist, and setting security levels of the website link and a check rule for each security level, wherein the check rule comprises check frequency and / or a check mode; and performing security check on the website link in the multi-level whitelist on the basis of the check rule corresponding to the security level of the website link, and on the basis of a check result, updating the security level of the website link or removing the website link from the multi-level whitelist.

Description

Security detection method for website links

[0001] Cross-references to related publications

[0002] This disclosure is based on Chinese Patent Publication No. 2023116078109, filed on November 27, 2023, entitled “Security Detection Method for Website Links,” and claims priority to the patent disclosure, all of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to the field of communications, and in particular to a method for detecting the security of a website link. Background Art

[0004] Related technologies often lag behind in identifying website risks, making it difficult to predict whether a website is risky. This process is also time-consuming, and some "risky websites" display varying content at different times of day, making accurate identification difficult. Despite rapid advancements in privacy and security technology for end-user products, illegal activities targeting consumers remain rampant, and various deficiencies remain in preventing online risk factors.

[0005] Summary of the Invention

[0006] The embodiment of the present disclosure provides a method for detecting the security of a website link.

[0007] According to one embodiment of the present disclosure, a method for detecting the security of website links is provided, comprising: adding website links identified as being in a secure state to a multi-level whitelist, and setting a security level of the website link and detection rules for each security level, wherein the detection rules include a detection frequency and / or a detection method; performing security detection on the website links in the multi-level whitelist according to the detection rules corresponding to the security level of the website link, and updating the security level of the website link or removing the website link from the multi-level whitelist according to the detection results.

[0008] According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when running.

[0009] According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] FIG1 is a hardware structure block diagram of a computer terminal according to a method for detecting the security of a website link according to an embodiment of the present disclosure;

[0011] FIG2 is a flow chart of a method for detecting the security of a website link according to Embodiment 1 of the present disclosure;

[0012] FIG3 is a flow chart of a method for detecting the security of a website link according to Embodiment 2 of the present disclosure;

[0013] FIG4 is a flow chart of a method for detecting the security of a website link according to Embodiment 3 of the present disclosure;

[0014] FIG5 is a structural block diagram of a device for detecting the security of a website link according to an embodiment of the present disclosure;

[0015] FIG6 is a flow chart of a method for detecting the security of a website link according to Embodiment 4 of the present disclosure;

[0016] FIG7 is a flow chart of a method for detecting the security of a website link according to the fifth embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in conjunction with embodiments.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0019] The method embodiments provided in the embodiments of the present disclosure can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking operation on a computer terminal as an example, FIG1 is a hardware structure block diagram of a computer terminal of a method for detecting the security of a website link in an embodiment of the present disclosure. As shown in FIG1 , the computer terminal may include one or more (only one is shown in FIG1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 configured to store data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input and output device 108 configured to have a communication function. It will be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the above-mentioned computer terminal. For example, the computer terminal may also include more or fewer components than those shown in FIG1 , or have a configuration different from that shown in FIG1 .

[0020] The memory 104 can be configured to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for detecting the security of website links in the embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0021] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by a communications provider of a computer terminal. In one embodiment, the transmission device 106 includes a network interface controller (NIC) that can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module that is configured to communicate with the Internet wirelessly.

[0022] In this embodiment, a method for detecting the security of a website link running on the above-mentioned computer terminal or network architecture is provided. FIG2 is a flow chart of the method for detecting the security of a website link according to the first embodiment of the present disclosure. As shown in FIG2 , the flow chart includes the following steps:

[0023] Step S202: adding website links identified as safe to a multi-level whitelist, and setting security levels for the website links and detection rules for each security level, wherein the detection rules include detection frequency and / or detection method;

[0024] Figure 3 is a flow chart of the method for security detection of website links according to embodiment (two) of the present disclosure. As shown in Figure 3, it includes: step S2021, obtaining the website link, and performing a website security detection on the website link if the website link is not on the multi-level whitelist; step S2022, marking the website link as safe and adding it to the multi-level whitelist if the website link passes the security detection.

[0025] For website security testing, you can use the MD5 data corresponding to the website's JavaScript code. MD5 is an algorithm used to calculate the hash value of a file. It converts the file content into a fixed-length string, which is often used to verify the integrity and security of the file. The MD5 data corresponding to the website's JavaScript represents the MD5 hash value of the JavaScript file, which is used to verify the file's integrity and detect whether the file has been tampered with or damaged.

[0026] Step S204 , performing security detection on the website links in the multi-level whitelist according to the detection frequency and detection method corresponding to the security level of the website links, and updating the security level of the website links or removing the website links from the multi-level whitelist according to the detection results.

[0027] For website links removed from the low-level whitelist, the website links will be marked as "identified as risky websites" based on the detection results, added to the blacklist, and blocked from users.

[0028] In step S204 of the embodiment of the present disclosure, at least one of the following is included: performing a security check on a website link of a first security level according to a first detection frequency and a first detection method, and if the number of times the website link of the first security level passes the security check reaches a first preset threshold, updating the website link of the first security level to a website link of a second security level; if the website link of the first security level fails the security check, removing the website link of the first security level from the multi-level whitelist; performing a security check on a website link of the first security level according to the first detection frequency and the first detection method, and if the website link of the first security level passes the security check within a first preset time period, updating the website link of the first security level to a website link of the second security level; if the website link of the first security level fails the security check, removing the website link of the first security level from the multi-level whitelist.

[0029] It should be noted that for website links at the first security level, multiple security checks will be conducted at different time periods according to preset rules. For website links that have reached the preset number of security checks and passed the security checks in all time periods, the website link's level can be updated from the first security level to the second security level. Because the detection time period is preset, the website links added to the whitelist can be guaranteed to be safe at different time periods, avoiding the possibility of risky websites displaying different content at different time periods being unidentified.

[0030] In step S204 of the embodiment of the present disclosure, Figure 4 is a flow chart of the security detection method for website links according to embodiment (three) of the present disclosure, as shown in Figure 4, including: step S2041, performing a security detection on the website link of the second security level according to the second detection frequency and the second detection method; step S2042, if the website link of the second security level fails the security detection, removing the website link of the second security level from the multi-level whitelist.

[0031] In an exemplary embodiment, the security level of the website link in the multi-level whitelist that maintains the first security level within a preset time period is updated to the second security level.

[0032] A website link that has been at the first security level for a preset period of time in the multi-level whitelist indicates that the link has undergone multiple security tests and passed all of them, and its security has been guaranteed to a certain extent. Therefore, it can be updated to the second security level. After the update, the detection rules of the security test will change accordingly.

[0033] In an exemplary embodiment, the security level of the website link in the multi-level whitelist that maintains the second security level within a preset time period is updated to the third security level.

[0034] In an exemplary embodiment, the security detection of the website link of the second security level according to the second detection frequency and the second detection method includes: detecting whether the change of the website page corresponding to the website link of the second security level exceeds a second preset threshold according to the second detection frequency, and performing a security detection on the website page if it is determined that the change of the website page exceeds the second preset threshold.

[0035] It should be noted that since website links at the second security level have undergone multiple security checks and are relatively secure, they do not require frequent, complete checks. Instead, they only need to check for significant page changes at a certain frequency. If the page changes exceed a second preset threshold, this indicates a significant page change and requires a complete check. If the page changes remain the same, a complete check of the page corresponding to the website link is not required, thus conserving resources while ensuring the security of the whitelisted website links.

[0036] In an exemplary embodiment, the authenticated website link is added to the multi-level whitelist, and the security level of the website link is set to the third security level.

[0037] It should be noted that the authentication method for website links at the third security level can be manual or official authentication. Website links at the second security level can also be updated to the third security level through manual or official authentication, eliminating the need for automatic security checks for websites at the third security level. Because some officially or manually authenticated websites have undergone rigorous security testing and are considered highly secure, they can be trusted without requiring multiple security checks and can be set to a higher security level. This method of setting or updating security levels is relatively flexible.

[0038] In an exemplary embodiment, the identification status of the website link is displayed in real time in the local website identification queue, wherein the identification status includes: unidentified, identifying, identified as a safe website, and identified as a risky website.

[0039] In an exemplary embodiment, when a user requests to open a website link in a local identification queue whose identification status is unidentified, a message is sent to the user indicating that the identification status of the website link is unidentified; when a user requests to open a website link in a local identification queue whose identification status is a risky website, the user is prevented from opening the website link with the identification status as a risky website.

[0040] In an exemplary embodiment, the website link identified as a risky website is added to a blacklist; when a request for appeal against the website link in the blacklist is received, the website link in the blacklist is automatically or manually detected; if the automatic detection or manual detection passes, the website link in the blacklist is removed.

[0041] The disclosed embodiment not only performs security checks on website links in the whitelist, but also re-checks website links identified as risky websites and added to the blacklist, and determines whether to remove the website links in the blacklist based on the test results, thereby providing a scientific and reliable website link detection method.

[0042] In an exemplary embodiment, the security levels of the website links in the multi-level whitelist are displayed in real time in the local website identification queue.

[0043] Since the embodiment of the present disclosure adds the website links identified as safe to the whitelist and conducts subsequent security testing, it avoids the problem of not paying attention to the potential security risks that may be caused after identifying risky websites that display different content at different time periods as safe. At the same time, in order to rationally utilize resources and efficiently detect website links, the embodiment of the present disclosure sets different security levels for different website links, and each security level corresponds to different detection rules, and the detection rules include detection frequency and / or detection method. The security level of the website link is not fixed. After the website link is security-tested according to the detection rules corresponding to the security level of the website link, it is determined based on the test results whether the security level of the website link needs to be updated, or directly removed from the multi-level whitelist. Therefore, the problem that a website link that is detected as safe once may cause security risks due to the lack of continuous security testing can be solved, thereby achieving the effect of more accurately identifying unsafe website links through a complete website link security detection method.

[0044] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0045] This embodiment also provides a device for detecting the security of website links. The device is configured to implement the above-mentioned embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0046] FIG5 is a structural block diagram of a device for detecting the security of a website link according to an embodiment of the present disclosure. As shown in FIG5 , the device includes: a setting module 10 and a detection module 20 .

[0047] A setting module 10 is configured to add website links identified as safe to a multi-level whitelist, and to set the security level of the website links and detection rules for each security level, wherein the detection rules include detection frequency and / or detection method;

[0048] The detection module 20 is configured to perform security detection on the website links in the multi-level whitelist according to the detection rules corresponding to the security levels of the website links, and update the security levels of the website links or remove the website links from the multi-level whitelist according to the detection results.

[0049] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0050] FIG6 is a flow chart of a method for detecting the security of a website link according to Embodiment 4 of the present disclosure. As shown in FIG6 , the flow includes the following steps:

[0051] Step S401, obtaining a website link;

[0052] Specifically, the terminal reads and analyzes website links from social media chat messages and text messages, adds them to the local website recognition queue, and marks them as "unrecognized." When you try to open them, you'll be notified that the website hasn't been recognized yet and move it to the top of the queue for recognition priority.

[0053] Step S402, determining whether the website link is in the whitelist;

[0054] Specifically, the website link is compared with the server-side whitelist. If the website link is in the whitelist, the process proceeds to step S403. If the website link is not in the whitelist, the process proceeds to step S404.

[0055] Step S403, marking the website link as a safe website;

[0056] Step S404: Perform website security testing;

[0057] Specifically, the identified websites are added to the local website identification queue, and the identification status is displayed in real time: unidentified, identifying, identified as a safe website, identified as a risky website, etc. For links that have been identified as safe websites, the whitelist level at which they are located can be further displayed when the detection is passed.

[0058] Step S405, determining whether the website is a safe website;

[0059] Specifically, by extracting the md5 data corresponding to the website's JavaScript or directly providing the website to the risk identification server, it is possible to determine whether the current website is a risky website. If the website is a safe website, the process proceeds to step S406; if the website is not a safe website, the process proceeds to step S407.

[0060] Step S406, marking the website link as safe;

[0061] Step S407: perform other corresponding marks on the website link.

[0062] Specifically, for unsafe websites, methods such as prompts, blocking, and blacklisting are included but not limited to handling. Users retain the right to file complaints against these websites. When users file complaints, the specific reasons why the website identified the problem are explained to the users. For websites whose complaints are released, the reasons for their release can be recorded and a release record report can be generated. FIG7 is a flow chart of a method for detecting the security of website links according to embodiment (five) of the present disclosure. As shown in FIG7 , the process includes the following steps:

[0063] Step S501: adding websites that have no problems in the initial security check to a low-level whitelist on the server side;

[0064] Specifically, for websites in the low-level whitelist, security checks will not be performed again when users visit them within a short period of time.

[0065] Step S502, performing multiple security checks at different time periods;

[0066] Step S503, determining whether the website passes the test;

[0067] Specifically, if the website detection reaches a certain number of times and a certain frequency, and at least meets the security detection requirements in each time period, the process proceeds to step S504; otherwise, the process proceeds to step S505;

[0068] Step S504, adding the website to the intermediate whitelist;

[0069] Specifically, for websites on the intermediate whitelist, security checks are performed at a lower frequency.

[0070] Step S505, removing the website from the low-level whitelist;

[0071] Specifically, based on the detection results, it is marked as "identified as a risky website", added to the blacklist, and access is blocked.

[0072] Step S506, determining changes in the website snapshot detection;

[0073] Specifically, for websites added to the intermediate whitelist, a simple snapshot detection is performed at a medium frequency. If a significant change is found on the website page, step S507 is entered. If no significant change occurs on the website, step S509 is entered.

[0074] Step S507, perform a complete security check;

[0075] Step S508, determining whether the website passes the test;

[0076] Specifically, if the detection is passed, proceed to step S509, otherwise proceed to step S510.

[0077] Step S509, maintain and record the detection situation;

[0078] Step S510: remove the website from the intermediate whitelist.

[0079] It should be noted that websites that have been on the intermediate whitelist for a long time or have passed manual / official verification will be added to the advanced whitelist and will no longer be automatically subject to security checks. The initial advanced whitelist can be issued by authoritative political and legal authorities.

[0080] An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0081] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0082] An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0083] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0084] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0085] In the related technology, network information (including website links) that may contain information about illegal activities sent in text messages or social software will be extracted and detected. However, for those that are deemed not to be risky websites after detection, no subsequent follow-up will be carried out. As a result, it is impossible to accurately identify websites with different characteristics such as different time periods and different displayed content, and it is impossible to establish a scientific and reliable whitelist mechanism. In the embodiment of the present disclosure, by extracting websites from terminal machine applications, they are analyzed and marked in advance. Based on the analysis results, a multi-level whitelist mechanism is established, and websites that are determined to have no problems after analysis are included in the multi-level whitelist. The higher the level of the whitelist, the simpler the security detection process is and the more convenient it is for users to use. It provides a complete security detection method for website links while ensuring user safety.

[0086] Obviously, those skilled in the art should understand that the modules or steps of the present disclosure described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any particular combination of hardware and software.

[0087] The foregoing description is merely a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Those skilled in the art will readily appreciate that various modifications and variations of the present disclosure are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present disclosure shall be included within the scope of protection of the present disclosure.

Claims

1. A method for detecting the security of a website link, comprising: Adding website links identified as being in a safe state to a multi-level whitelist, and setting the security level of the website links and detection rules for each security level, wherein the detection rules include detection frequency and / or detection method; The website links in the multi-level whitelist are subjected to security detection according to detection rules corresponding to the security levels of the website links, and the security levels of the website links are updated or the website links are removed from the multi-level whitelist according to the detection results.

2. The method according to claim 1, wherein: The step of adding the website link identified as being in a safe state to the multi-level whitelist comprises: Acquire the website link, and if the website link is not in the multi-level whitelist, perform a website security detection on the website link; In the case where the website link passes the security detection, the website link is marked as a safe state and added to the multi-level whitelist.

3. The method according to claim 1, wherein: The step of performing security detection on the website link according to the detection rule corresponding to the security level of the website link, and updating the security level of the website link or removing the website link from the multi-level whitelist according to the detection result includes at least one of the following: Performing a security test on a website link of a first security level according to a first test frequency and a first test method, updating the website link of the first security level to a website link of a second security level when the number of times the website link of the first security level passes the security test reaches a first preset threshold, and removing the website link of the first security level from the multi-level whitelist when the website link of the first security level fails the security test; A security check is performed on a website link of a first security level according to a first detection frequency and a first detection method; if the website link of the first security level passes the security check within a first preset time period, the website link of the first security level is updated to a website link of a second security level; if the website link of the first security level fails the security check, the website link of the first security level is removed from the multi-level whitelist.

4. The method according to claim 1, wherein: The method further comprises: The security level of the website link in the multi-level whitelist that maintains the first security level within a preset time period is updated to the second security level.

5. The method according to claim 1, wherein: The detecting the website link according to the detection rule corresponding to the security level of the website link, and updating the security level of the website link or removing the website link from the multi-level whitelist according to the detection result, includes: Performing security detection on the website link of the second security level according to the second detection frequency and the second detection method; If the website link at the second security level fails the security test, the second security level Remove the website link from the multi-level whitelist.

6. The method according to claim 5, wherein: The method further comprises: The security level of the website link in the multi-level whitelist that maintains the second security level within a preset time period is updated to the third security level.

7. The method according to claim 5, wherein: The performing security detection on the website link of the second security level according to the second detection frequency and the second detection method includes: The second detection frequency is used to detect whether the change of the website page corresponding to the website link of the second security level exceeds a second preset threshold. If it is determined that the change of the website page exceeds the second preset threshold, a security detection is performed on the website page.

8. The method according to claim 1, wherein: The method further comprises: The authenticated website link is added to the multi-level whitelist, and the security level of the website link is set to the third security level.

9. The method according to claim 1, wherein: The method further comprises: The identification status of the website link is displayed in real time in the local website identification queue, wherein the identification status includes: unidentified, identifying, identified as a safe website, or identified as a risky website.

10. The method according to claim 9, wherein: The method further comprises: When receiving a request from a user to open a website link in a local recognition queue whose recognition status is unrecognized, sending a message to the user indicating that the recognition status of the website link is unrecognized; When a user request to open a website link in the local identification queue whose identification status is a risky website is received, the user is prevented from opening the website link in the identification status as a risky website.

11. The method according to claim 9, wherein: The method further comprises: Adding the website link whose identification status is that it has been identified as a risky website to a blacklist; Upon receiving a request for appeal against the website links in the blacklist, automatically or manually checking the website links in the blacklist; When the automatic detection or manual detection passes, the website links in the blacklist are removed.

12. The method according to claim 1, wherein: The method further comprises: The security level of the website links in the multi-level whitelist is displayed in real time in the local website identification queue.

13. A computer-readable storage medium having a computer program stored therein, wherein: When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 12 are implemented.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of claims 1 to 12 when executing the computer program.

Images