CN111782991A - Method, device, equipment and storage medium for detecting abnormal hidden link of website - Google Patents
Method, device, equipment and storage medium for detecting abnormal hidden link of website Download PDFInfo
- Publication number
- CN111782991A CN111782991A CN202010680389.4A CN202010680389A CN111782991A CN 111782991 A CN111782991 A CN 111782991A CN 202010680389 A CN202010680389 A CN 202010680389A CN 111782991 A CN111782991 A CN 111782991A
- Authority
- CN
- China
- Prior art keywords
- website
- current
- webpage content
- abnormal dark
- dark chain
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 157
- 238000000034 method Methods 0.000 title claims abstract description 57
- 238000001514 detection method Methods 0.000 claims abstract description 44
- 238000012216 screening Methods 0.000 claims description 26
- 238000004590 computer program Methods 0.000 claims description 11
- 230000008569 process Effects 0.000 claims description 7
- 238000001914 filtration Methods 0.000 claims description 5
- 230000002547 anomalous effect Effects 0.000 claims 2
- 230000009286 beneficial effect Effects 0.000 abstract description 5
- 239000013598 vector Substances 0.000 description 9
- 238000010586 diagram Methods 0.000 description 4
- 230000008859 change Effects 0.000 description 3
- 238000009877 rendering Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
- G06F16/9558—Details of hyperlinks; Management of linked annotations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
Landscapes
- Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The application discloses a method for detecting abnormal hidden links of a website, which comprises the following steps: acquiring a current source code of a website to be detected; respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection; if not, determining the abnormal dark chain in the website to be detected according to the current webpage content. Therefore, the method screens out the current source code which changes compared with the historical source code through the webpage structure and the webpage content, and only needs to detect the abnormal dark chain aiming at the current webpage content corresponding to the changed current source code, so that the operation times of detecting the abnormal dark chain can be greatly reduced, the time consumed by the abnormal dark chain is reduced, and the efficiency of detecting the abnormal dark chain of the website is improved. The application also discloses a detection device, equipment and a computer readable storage medium for the abnormal hidden link of the website, which have the beneficial effects.
Description
Technical Field
The present invention relates to the field of dark chain detection, and in particular, to a method, an apparatus, a device, and a computer-readable storage medium for detecting an abnormal dark chain of a website.
Background
"dark chain" is a hyperlink that is invisible or very easily ignored on a web page, as its name describes, and is set to avoid destroying the original structure of the web page as much as possible. However, after the website is attacked, the website may be inserted with abnormal dark chains, and these inserted abnormal dark chains will cause abnormal situations such as loss and leakage of data information, thereby bringing negative effects to the website.
In the prior art, the current source code of the website to be detected is directly detected and judged, and whether an abnormal dark chain exists in the website to be detected is determined. However, because the data volume of the current source code in the website to be detected is large, the operation required in each detection and judgment process is complex, a large amount of time is consumed, and the efficiency of detecting the abnormal dark chain of the website is low.
Therefore, how to improve the efficiency of detecting the abnormal dark chain of the website is a technical problem that needs to be solved by those skilled in the art.
Disclosure of Invention
In view of this, the present invention provides a method for detecting an abnormal dark chain of a website, which can improve the efficiency of detecting the abnormal dark chain of the website; another object of the present invention is to provide a device, an apparatus and a computer-readable storage medium for detecting abnormal dark chains of websites, all of which have the above advantages.
In order to solve the above technical problem, the present invention provides a method for detecting an abnormal dark chain of a website, comprising:
acquiring a current source code of a website to be detected;
respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection;
if not, determining the abnormal dark chain in the website to be detected according to the current webpage content.
Preferably, before the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further includes:
setting a corresponding screening rule according to the characteristics of the abnormal dark chain;
and screening the abnormal dark chains in the website to be detected by using the screening rule.
Preferably, before the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further includes:
screening out a first target URL preset in a white list in the current webpage content;
and detecting all URLs except the first target URL in the current webpage content to determine the abnormal dark chain.
Preferably, before the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further includes:
determining a second target URL with expired domain name registration time in the current webpage content;
judging whether the second target URL is an illegal user;
and if so, determining the second target URL as the abnormal dark chain.
Preferably, the step of respectively determining whether the current web page structure and the current web page content of the current source code are the same as the historical web page structure and the historical web page content of the historical source code obtained in the last detection further includes:
judging whether preset sensitive words exist in the current webpage content or not;
if yes, determining the abnormal dark chain according to the preset sensitive words existing in the current webpage content.
Preferably, before the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further includes:
and filtering invalid hidden links and/or hidden links belonging to the local domain in the website to be detected.
Preferably, after the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further includes:
and outputting the determined abnormal dark chain.
In order to solve the above technical problem, the present invention further provides a device for detecting an abnormal hidden link of a website, including:
the acquisition module is used for acquiring the current source code of the website to be detected;
the first judgment module is used for respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection; if not, executing a first detection module;
and the first detection module is used for determining the abnormal dark chain in the website to be detected according to the current webpage content.
In order to solve the above technical problem, the present invention further provides a device for detecting an abnormal hidden link of a website, including:
a memory for storing a computer program;
and the processor is used for realizing the steps of any one of the above detection methods for the abnormal dark chain of the website when the computer program is executed.
In order to solve the above technical problem, the present invention further provides a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the method for detecting an abnormal dark chain of a website is implemented.
The invention provides a method for detecting abnormal hidden links of a website, which comprises the steps of acquiring a current source code of the website to be detected; respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection; if not, determining the abnormal dark chain in the website to be detected according to the current webpage content. Therefore, the method screens out the current source code which changes compared with the historical source code through the webpage structure and the webpage content, and only needs to detect the abnormal dark chain aiming at the current webpage content corresponding to the changed current source code, so that the operation times of detecting the abnormal dark chain can be greatly reduced, the time consumed by the abnormal dark chain is reduced, and the efficiency of detecting the abnormal dark chain of the website is improved.
In order to solve the technical problems, the invention also provides a device and equipment for detecting the abnormal dark chain of the website and a computer readable storage medium, which have the beneficial effects.
Drawings
In order to more clearly illustrate the embodiments or technical solutions of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
Fig. 1 is a flowchart of a method for detecting an abnormal dark chain of a website according to an embodiment of the present invention;
FIG. 2 is a block diagram of an apparatus for detecting abnormal dark chains of a website according to an embodiment of the present invention;
fig. 3 is a structural diagram of a detection device for detecting an abnormal dark chain of a website according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The core of the embodiment of the invention is to provide a method for detecting the abnormal dark chain of the website, which can improve the efficiency of detecting the abnormal dark chain of the website; another core of the present invention is to provide a device, an apparatus and a computer-readable storage medium for detecting abnormal dark chains of websites, all of which have the above advantages.
In order that those skilled in the art will better understand the disclosure, the invention will be described in further detail with reference to the accompanying drawings and specific embodiments.
Fig. 1 is a flowchart of a method for detecting an abnormal dark chain of a website according to an embodiment of the present invention. As shown in fig. 1, a method for detecting an abnormal dark chain of a website includes:
s10: and acquiring the current source code of the website to be detected.
In this embodiment, first, the current source code of the website to be detected needs to be acquired. The method for acquiring the current source code of the website to be detected may be acquiring through a browser, or acquiring through a preset acquisition tool, which is not limited in this embodiment.
S20: respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection;
s30: if not, determining the abnormal dark chain in the website to be detected according to the current webpage content.
After the current source code of the website to be detected is obtained, further obtaining a historical webpage structure corresponding to the historical source code in the last detection, and then comparing whether the current webpage structure is the same as the historical webpage structure; if the webpage structure of the current source code is inconsistent with the webpage structure of the historical source code, the current webpage source code is changed compared with the historical source code in the last detection, so that an abnormal dark chain in the website to be detected needs to be determined according to the current webpage content; if the current webpage content of the current source code is consistent with the historical webpage content of the historical source code, whether the current webpage content of the current source code is the same with the historical webpage content of the historical source code needs to be further judged; if the current source code is different from the previous detection source code, the current source code is changed compared with the historical source code detected last time, and therefore abnormal dark chain detection needs to be carried out on the current webpage content.
It should be noted that the process of obtaining the current web page structure corresponding to the current source code includes: extracting the structure of the obtained current source code, and obtaining the structure of the website to be detected according to the HTML tag of the website to obtain the current webpage structure; wherein, the HTML label comprises < HTML >, < div >, < p >, < body >, < css >, < style >, < a >, < dl >, < dt > and the like; the web page structure is a structure composed of tags in HTML in sequence.
It should be noted that the process of determining whether the current web page content of the current source code is the same as the historical web page content of the historical source code specifically includes: firstly, extracting a website structure sequence of a website to be detected according to a current source code; the website structure sequence is the webpage content corresponding to the HTML label; and then segmenting words of each website structure sequence to obtain effective feature vectors, setting a corresponding weight grade for each feature vector according to a preset rule, wherein the weight of each grade respectively represents the importance degree of each segmented word in the whole website structure sequence, the higher the grade is, the more important the segmented word is represented, and specifically, the weights of 1-5 grades and the like are set for each feature vector. Calculating the current hash value corresponding to each website structure sequence, specifically calculating the hash value of each feature vector through a hash function, wherein the hash value is a 01 binary code consisting of binary numbers, and weighting all the feature vectors, namely W is hash weight, and if 1 is met in the weighting calculation process, the hash value and the weight are multiplied positively; if 0 is met, the hash value and the weight are multiplied negatively; and accumulating the weighted result of each eigenvector to enable each eigenvector to become only one sequence string, setting the accumulated result of the binary signature to be 1 if the accumulated result is more than 0, and setting the accumulated result to be 0 if the accumulated result is not more than 0, thereby obtaining the hash value of the website structure sequence, namely obtaining the current hash value corresponding to each website structure sequence. After obtaining a current hash value corresponding to each website structure sequence in the current webpage content, judging whether the Hamming distance between the current hash value and a historical hash value corresponding to historical webpage content of a historical source code is larger than a preset threshold value or not; if yes, the current webpage content is different from the historical webpage content; the preset threshold is determined empirically, which is not limited in this embodiment. If the preset threshold value is 3, if the Hamming distance is within 3, the change of the webpage content does not exist in the website to be detected compared with the last detection, so that the detection of the abnormal dark chain does not need to be carried out on the website to be detected, and the detection result of the current abnormal dark chain is the same as the detection result of the previous abnormal dark chain; if the Hamming distance is beyond 3, the change of the webpage content of the website to be detected is indicated, and the detection of the abnormal dark chain needs to be carried out on the website to be detected again.
Specifically, in actual operation, the abnormal hidden link in the website to be detected is generally determined by a browser rendering and detecting the hidden link, and it should be noted that the browser rendering and detecting the hidden link is common knowledge of those skilled in the art, and details are not described here. Since the manner of rendering and detecting the dark chain by the browser consumes time, the present embodiment determines the change condition of the web page structure and the web page content of the website to be detected before this step.
The method for detecting the abnormal hidden link of the website, provided by the embodiment of the invention, comprises the steps of obtaining a current source code of the website to be detected; respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection; if not, determining the abnormal dark chain in the website to be detected according to the current webpage content. Therefore, the method screens out the current source code which changes compared with the historical source code through the webpage structure and the webpage content, and only needs to detect the abnormal dark chain aiming at the current webpage content corresponding to the changed current source code, so that the operation times of detecting the abnormal dark chain can be greatly reduced, the time consumed by the abnormal dark chain is reduced, and the efficiency of detecting the abnormal dark chain of the website is improved.
On the basis of the foregoing embodiment, the embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the method further includes:
setting a corresponding screening rule according to the characteristics of the abnormal dark chain;
and screening abnormal dark chains in the website to be detected by using a screening rule.
Specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the characteristics of the abnormal dark chain are obtained first, and then the corresponding screening rule is set according to the characteristics of the abnormal dark chain; and after the corresponding screening rule is set, screening the current webpage content in the website to be detected by using the determined screening rule, and determining the abnormal dark chain in the website to be detected. The features of the abnormal dark chain include hidden features of the label, hidden features of the position, hidden features of the color, hidden features of the relative position, hidden features of the boundary, and the like.
Therefore, according to the embodiment, the abnormal dark chains in the website to be detected are pre-screened according to the screening rule determined directly according to the characteristics of the abnormal dark chains, the screening operation is more convenient, and the efficiency of determining the abnormal dark chains in the website to be detected can be further improved.
On the basis of the foregoing embodiment, the embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the method further includes:
screening out a first target URL preset in a white list in the current webpage content;
and detecting all URLs except the first target URL in the current webpage content to determine an abnormal dark chain.
Specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, a white list is preset, and a URL determined as the normal dark chain is set in the white list; then, comparing the current webpage content according to a preset white list, determining a first target URL preset in the white list in the current webpage content, and then excluding the first target URL in the current webpage content, namely screening out a first target URL preset in the white list in the current webpage content; and detecting all URLs except the first target URL in the current webpage content to determine an abnormal dark chain. It should be noted that the URLs in the white list may be set according to the accumulated actual operation experience, or may be set according to the website link with strong public trust and high authority, which is not limited in this embodiment.
Therefore, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the normal dark chain in the current webpage content is further excluded in a manner of presetting a white list, and then the detection of the abnormal dark chain is performed on the remaining current webpage content, so that the efficiency of detecting the abnormal dark chain can be further improved.
On the basis of the foregoing embodiment, the embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the method further includes:
determining a second target URL with expired domain name registration time in the current webpage content;
judging whether the second target URL is an illegal user;
if so, determining that the second target URL is an abnormal dark chain.
The embodiment aims at the friendship link quoted by the website to be detected, and the domain name registration time of the friendship link is expired and possibly preempted by other illegal users for illegal activities. Specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current web page content, first obtaining each URL in the current web page content and domain name registration time corresponding to each URL, then judging whether the domain name registration time of each URL is expired, and determining a second target URL for which the domain name registration time is expired; judging whether the second target URL is an illegal user; if yes, determining that the second target URL is an abnormal dark chain; and then carrying out abnormal dark chain detection on the current webpage content of the website to be detected under the condition of excluding the determined abnormal dark chain.
Therefore, in the embodiment, before the abnormal dark chain in the to-be-detected website is determined according to the current webpage content, the second target URL which is expired in domain name registration time and is preempted by an illegal user in the current webpage content is further screened out, so that the operation times of subsequently determining the abnormal dark chain in the to-be-detected website according to the current webpage content can be reduced, and the efficiency of detecting the abnormal dark chain of the to-be-detected website can be further improved.
On the basis of the foregoing embodiment, this embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, a process of respectively determining whether the current web page structure and the current web page content of the current source code are the same as the historical web page structure and the historical web page content of the historical source code obtained in the last detection further includes:
judging whether preset sensitive words exist in the current webpage content or not;
if yes, determining an abnormal dark chain according to preset sensitive words existing in the current webpage content.
Specifically, in this embodiment, preset sensitive words representing that a dark chain is an abnormal dark chain are preset and stored, then, in the process of determining whether the current web page content is the same as the corresponding historical web page content in the last detection, after segmenting words for each website structure sequence to obtain effective feature vectors, the segmented content, that is, each feature vector is compared with the preset sensitive words, and if the feature vectors are the same as the preset sensitive words, the dark chain corresponding to the feature vectors is indicated as the abnormal dark chain.
Therefore, according to the embodiment, the abnormal dark chain in the current webpage content is determined by further using the preset sensitive words, so that the operation times of subsequently determining the abnormal dark chain in the to-be-detected website according to the current webpage content can be reduced, and the efficiency of detecting the abnormal dark chain of the to-be-detected website can be further improved.
On the basis of the foregoing embodiment, the embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, before determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the method further includes:
and filtering invalid hidden links and/or hidden links belonging to the local domain in the website to be detected.
In this embodiment, before determining the abnormal dark chain in the website to be detected according to the current webpage content, the invalid hidden link and/or the hidden link belonging to the local domain in the website to be detected are filtered, and then the remaining current webpage content is subjected to detection of the abnormal dark chain.
Specifically, the link characteristics or keywords of the invalid hidden link are preset, and then the current webpage content in the website to be detected is screened through the link characteristics or keywords, so as to determine the link corresponding to the link characteristics or keywords, that is, determine the invalid hidden link. Specifically, the hidden link of the local domain is determined by obtaining a URL corresponding to the hidden link of the local domain in advance, and then screening the current webpage content of the website to be detected according to the URL.
Therefore, after invalid hidden links and/or hidden links belonging to the main domain and the local domain in the website to be detected are filtered, abnormal dark chains in the website to be detected are determined according to the current webpage content, the detection steps can be further reduced, and the efficiency of detecting the abnormal dark chains of the website to be detected is further improved.
On the basis of the foregoing embodiment, the embodiment further describes and optimizes the technical solution, and specifically, in this embodiment, after determining the abnormal dark chain in the to-be-detected website according to the current webpage content, the method further includes:
and outputting the determined abnormal dark chain.
Specifically, in this embodiment, after the abnormal dark chain in the website to be detected is determined, the determined abnormal dark chain is further printed and output. It should be noted that, in actual operation, the determined abnormal dark chain may be output in the form of an image, a text, or a table; this embodiment is not limited to this.
Therefore, in the embodiment, after the abnormal dark chain in the website to be detected is determined according to the current webpage content, the determined abnormal dark chain is further output, so that the user can more intuitively and conveniently acquire the information of the abnormal dark chain, and the use experience of the user is further improved.
In addition, in actual operation, after determining the abnormal dark chain in the website to be detected according to the current webpage content, the preset prompting device may be further triggered to send out the corresponding prompting information, the type of the prompting information is not limited in this embodiment, for example, the prompting device such as a buzzer, an indicator light and/or a voice player may be used to send out the prompting information to achieve the purpose of prompting, so that the user can more intuitively know that the detection is currently completed.
The above detailed description is given to the embodiment of the method for detecting the website abnormal dark chain provided by the present invention, and the present invention further provides a device, an apparatus, and a computer-readable storage medium for detecting the website abnormal dark chain corresponding to the method.
Fig. 2 is a structural diagram of a device for detecting an abnormal dark chain of a website according to an embodiment of the present invention, and as shown in fig. 2, the device for detecting an abnormal dark chain of a website includes:
the acquisition module 21 is configured to acquire a current source code of a website to be detected;
a first judging module 22, configured to respectively judge whether a current web page structure and current web page content of the current source code are the same as a historical web page structure and historical web page content of the historical source code obtained in the last detection; if not, executing the first detection module 23;
the first detection module 23 is configured to determine an abnormal dark chain in the to-be-detected website according to the current webpage content.
The detection device for the abnormal dark chain of the website provided by the embodiment of the invention has the beneficial effect of the detection method for the abnormal dark chain of the website.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
the first setting module is used for setting a corresponding screening rule according to the characteristics of the abnormal dark chain;
and the first screening module is used for screening the abnormal dark chains in the website to be detected by using the screening rule.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
the second screening module is used for screening out a first target URL preset in a white list in the current webpage content;
and the second detection module is used for detecting all URLs except the first target URL in the current webpage content to determine an abnormal dark chain.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
the first determining module is used for determining a second target URL with expired domain name registration time in the current webpage content;
the second judgment module is used for judging whether the second target URL is an illegal user; if yes, calling a second determining module;
and the second determining module is used for determining that the second target URL is an abnormal dark chain.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
the third judgment module is used for judging whether preset sensitive words exist in the current webpage content; if yes, executing a third determining module;
and the third determining module is used for determining the abnormal dark chain according to the preset sensitive words existing in the current webpage content.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
and the filtering module is used for filtering the invalid hidden links and/or the hidden links belonging to the local domain in the website to be detected.
As a preferred embodiment, the apparatus for detecting abnormal dark chains of websites further comprises:
and the output module is used for outputting the determined abnormal dark chain after the abnormal dark chain in the website to be detected is determined according to the current webpage content.
Fig. 3 is a structural diagram of a device for detecting an abnormal dark chain of a website according to an embodiment of the present invention, and as shown in fig. 3, the device for detecting an abnormal dark chain of a website includes:
a memory 31 for storing a computer program;
and the processor 32 is used for implementing the steps of the method for detecting the abnormal dark chain of the website when executing the computer program.
The detection equipment for the abnormal dark chain of the website provided by the embodiment of the invention has the beneficial effect of the detection method for the abnormal dark chain of the website.
In order to solve the above technical problem, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for detecting an abnormal dark chain of a website are implemented.
The computer-readable storage medium provided by the embodiment of the invention has the beneficial effect of the method for detecting the abnormal dark chain of the website.
The method, device, equipment and computer readable storage medium for detecting abnormal dark chains of websites provided by the invention are described in detail above. The principles and embodiments of the present invention are explained herein using specific examples, which are set forth only to help understand the method and its core ideas of the present invention. It should be noted that, for those skilled in the art, it is possible to make various improvements and modifications to the present invention without departing from the principle of the present invention, and those improvements and modifications also fall within the scope of the claims of the present invention.
The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
Claims (10)
1. A method for detecting abnormal dark chains of a website is characterized by comprising the following steps:
acquiring a current source code of a website to be detected;
respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection;
if not, determining the abnormal dark chain in the website to be detected according to the current webpage content.
2. The method according to claim 1, wherein before determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further comprises:
setting a corresponding screening rule according to the characteristics of the abnormal dark chain;
and screening the abnormal dark chains in the website to be detected by using the screening rule.
3. The method according to claim 1, wherein before determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further comprises:
screening out a first target URL preset in a white list in the current webpage content;
and detecting all URLs except the first target URL in the current webpage content to determine the abnormal dark chain.
4. The method according to claim 3, wherein before the determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further comprises:
determining a second target URL with expired domain name registration time in the current webpage content;
judging whether the second target URL is an illegal user;
and if so, determining the second target URL as the abnormal dark chain.
5. The method according to claim 1, wherein the process of respectively determining whether the current web page structure and the current web page content of the current source code are the same as the historical web page structure and the historical web page content of the historical source code obtained in the last detection further comprises:
judging whether preset sensitive words exist in the current webpage content or not;
if yes, determining the abnormal dark chain according to the preset sensitive words existing in the current webpage content.
6. The method according to claim 1, wherein before determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further comprises:
and filtering invalid hidden links and/or hidden links belonging to the local domain in the website to be detected.
7. The method according to any one of claims 1 to 6, wherein after determining the abnormal dark chain in the website to be detected according to the current webpage content, the method further comprises:
and outputting the determined abnormal dark chain.
8. A device for detecting abnormal dark chains of websites is characterized by comprising:
the acquisition module is used for acquiring the current source code of the website to be detected;
the first judgment module is used for respectively judging whether the current webpage structure and the current webpage content of the current source code are the same as the historical webpage structure and the historical webpage content of the historical source code acquired in the last detection; if not, executing a first detection module;
and the first detection module is used for determining the abnormal dark chain in the website to be detected according to the current webpage content.
9. A detection device for abnormal dark chains of websites is characterized by comprising:
a memory for storing a computer program;
a processor for implementing the steps of the method for detecting web site anomalous dark chains as claimed in any one of claims 1 to 7 when said computer program is executed.
10. A computer-readable storage medium, having stored thereon a computer program which, when being executed by a processor, carries out the steps of the method for detecting an anomalous dark chain of a web site as claimed in any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010680389.4A CN111782991A (en) | 2020-07-15 | 2020-07-15 | Method, device, equipment and storage medium for detecting abnormal hidden link of website |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010680389.4A CN111782991A (en) | 2020-07-15 | 2020-07-15 | Method, device, equipment and storage medium for detecting abnormal hidden link of website |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111782991A true CN111782991A (en) | 2020-10-16 |
Family
ID=72768824
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010680389.4A Pending CN111782991A (en) | 2020-07-15 | 2020-07-15 | Method, device, equipment and storage medium for detecting abnormal hidden link of website |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111782991A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113742622A (en) * | 2021-08-06 | 2021-12-03 | 广州坚和网络科技有限公司 | Webpage anomaly detection method and device |
| CN116361748A (en) * | 2023-04-03 | 2023-06-30 | 武汉金力软件有限公司 | Software supply chain safety detection method and device |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101694668A (en) * | 2009-09-29 | 2010-04-14 | 百度在线网络技术（北京）有限公司 | Method and device for confirming web structure similarity |
| CN104503962A (en) * | 2014-06-18 | 2015-04-08 | 北京邮电大学 | Method for detecting hidden link of webpage |
| CN104767757A (en) * | 2015-04-17 | 2015-07-08 | 国家电网公司 | Multiple-dimension security monitoring method and system based on WEB services |
| CN107784107A (en) * | 2017-10-31 | 2018-03-09 | 杭州安恒信息技术有限公司 | Dark chain detection method and device based on flight behavior analysis |
| CN108304502A (en) * | 2018-01-17 | 2018-07-20 | 中国科学院自动化研究所 | Quick hot spot detecting method and system based on magnanimity news data |
| CN109450844A (en) * | 2018-09-18 | 2019-03-08 | 华为技术有限公司 | Trigger the method and device of Hole Detection |
| CN110532784A (en) * | 2019-09-04 | 2019-12-03 | 杭州安恒信息技术股份有限公司 | A kind of dark chain detection method, device, equipment and computer readable storage medium |
| CN110659439A (en) * | 2019-09-23 | 2020-01-07 | 杭州迪普科技股份有限公司 | Black chain protection method, device, equipment and storage medium |
| CN111262842A (en) * | 2020-01-10 | 2020-06-09 | 恒安嘉新（北京）科技股份公司 | Webpage tamper-proofing method and device, electronic equipment and storage medium |
-
2020
- 2020-07-15 CN CN202010680389.4A patent/CN111782991A/en active Pending
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101694668A (en) * | 2009-09-29 | 2010-04-14 | 百度在线网络技术（北京）有限公司 | Method and device for confirming web structure similarity |
| CN104503962A (en) * | 2014-06-18 | 2015-04-08 | 北京邮电大学 | Method for detecting hidden link of webpage |
| CN104767757A (en) * | 2015-04-17 | 2015-07-08 | 国家电网公司 | Multiple-dimension security monitoring method and system based on WEB services |
| CN107784107A (en) * | 2017-10-31 | 2018-03-09 | 杭州安恒信息技术有限公司 | Dark chain detection method and device based on flight behavior analysis |
| CN108304502A (en) * | 2018-01-17 | 2018-07-20 | 中国科学院自动化研究所 | Quick hot spot detecting method and system based on magnanimity news data |
| CN109450844A (en) * | 2018-09-18 | 2019-03-08 | 华为技术有限公司 | Trigger the method and device of Hole Detection |
| CN110532784A (en) * | 2019-09-04 | 2019-12-03 | 杭州安恒信息技术股份有限公司 | A kind of dark chain detection method, device, equipment and computer readable storage medium |
| CN110659439A (en) * | 2019-09-23 | 2020-01-07 | 杭州迪普科技股份有限公司 | Black chain protection method, device, equipment and storage medium |
| CN111262842A (en) * | 2020-01-10 | 2020-06-09 | 恒安嘉新（北京）科技股份公司 | Webpage tamper-proofing method and device, electronic equipment and storage medium |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113742622A (en) * | 2021-08-06 | 2021-12-03 | 广州坚和网络科技有限公司 | Webpage anomaly detection method and device |
| CN116361748A (en) * | 2023-04-03 | 2023-06-30 | 武汉金力软件有限公司 | Software supply chain safety detection method and device |
| CN116361748B (en) * | 2023-04-03 | 2023-09-15 | 武汉金力软件有限公司 | Software supply chain safety detection method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104462152B (en) | A kind of recognition methods of webpage and device | |
| CN103810425B (en) | The detection method of malice network address and device | |
| CN101964025B (en) | XSS detection method and equipment | |
| WO2012089005A1 (en) | Method and apparatus for phishing web page detection | |
| US20150324478A1 (en) | Detection method and scanning engine of web pages | |
| US20120159621A1 (en) | Detection system and method of suspicious malicious website using analysis of javascript obfuscation strength | |
| CN103577755A (en) | Malicious script static detection method based on SVM (support vector machine) | |
| CN104462509A (en) | Review spam detection method and device | |
| CN107370718B (en) | Method and device for detecting black chain in webpage | |
| CN106599242A (en) | Webpage change monitoring method and system based on similarity calculation | |
| CN111782991A (en) | Method, device, equipment and storage medium for detecting abnormal hidden link of website | |
| CN103927480A (en) | Method, device and system for identifying malicious web page | |
| CN109522494B (en) | Dark chain detection method, device, equipment and computer readable storage medium | |
| CN113221032A (en) | Link risk detection method, device and storage medium | |
| CN107784107B (en) | Dark chain detection method and device based on escape behavior analysis | |
| CN116015772B (en) | Malicious website processing method, device, equipment and storage medium | |
| CN101471781A (en) | Method and system for processing script injection event | |
| CN106789948A (en) | A kind of network web page method for detecting abnormality | |
| CN111654504A (en) | DGA domain name detection method and device | |
| CN111143722A (en) | Method, device, equipment and medium for detecting webpage hidden link | |
| CN110532784A (en) | A kind of dark chain detection method, device, equipment and computer readable storage medium | |
| CN111131236A (en) | Web fingerprint detection device, method, equipment and medium | |
| CN111125704B (en) | Webpage Trojan horse recognition method and system | |
| CN105653941A (en) | Heuristic detection method and system for phishing website | |
| CN113688346A (en) | Illegal website identification method, device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |