Real-Time Website Source Code Monitoring for Malicious Link Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current website security methods, relying on external crawling, suffer from non-real-time performance, leading to false negatives and positives, as they fail to detect malicious link injections into website source code in a timely manner, especially since website content cannot be crawled instantly, allowing infected pages to go undetected.
Innovation Solution
A method and apparatus that monitor modifications to website source code in real time, extract and analyze external links, and send alarms if suspicious or malicious links are detected, utilizing a code monitoring unit, link extracting unit, and security alarm unit to provide immediate alerts to system administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If external crawling technology is used to detect malicious code, then the detection method is simple to implement, but the detection is not real-time and produces false negatives and positives
Solution Approach 1:
Instead of crawling external website content to detect malicious code (outward detection), the patent inverts the approach by placing detection agents directly within the website server (inward detection). The server主动向 outwards sends security status information containing source code hash values and link information for detection, transforming the detection direction from external-to-internal to internal-to-external.
Solution Approach 2:
The patent introduces a security status information sending unit as an intermediary component that bridges the website server and external detection systems. This intermediary actively transmits structured security data (hash values, link information) to external detectors, enabling real-time detection without requiring continuous external crawling of the entire website content.
2Measurement precision
If website content is crawled externally to detect security issues, then the detection scope is comprehensive, but the detection cannot be performed in real-time due to the time required to crawl all content
Solution Approach 1:
The patent extracts only the critical security-related elements (source code hash values and external link information) from the complete website content and sends them for detection. This extraction approach maintains comprehensive detection coverage for security issues while dramatically reducing the time required compared to crawling and analyzing entire website contents.
Solution Approach 2:
The system performs preliminary processing by generating hash values of source code and extracting link information before transmission. This preliminary action prepares the data in advance for efficient detection, reducing the time required when actual security detection is needed.
3Reliability
If source code monitoring is implemented to detect malicious link injection, then real-time protection is achieved, but system performance is impacted
Solution Approach 1:
The patent extracts only essential monitoring data (source code hash values and link information) rather than monitoring and analyzing entire source code files continuously. This extraction minimizes the computational burden on the system while maintaining real-time detection capability for malicious link injection.
Data Source
AI summary
A method for monitoring malicious link injection into website source code, may include: monitoring a modification operation on a website source code file and obtaining a changed code segment; analyzing the changed code segment to extract an external link; determining whether the external link is a suspicious or malicious link; and sending an alarm message if it is determined that the external link is a suspicious or malicious link. According to the method for monitoring malicious link injection into website source code, changed content of source code can be monitored in real time, so as to effectively prevent a common type of virus transmission manner in which a malicious redirection website address is injected into page code of a legal website after a system write permission is obtained by using a vulnerability of an operating system or a third-party application. In addition, the present disclosure further provides a related apparatus.