CN105610812B - Method and device for preventing webpage from being hijacked - Google Patents

Abstract

The present invention relates to a method and device for preventing hijacking of web pages, wherein the method includes: obtaining a user domain name request instruction; parsing the user domain name request instruction to obtain a first IP address and a second IP address; using the first IP address The IP address and the second IP address obtain reference indicators; according to the reference indicators, the client is notified to display the correct page, so as to prevent webpage hijacking.

Description

Method and device for preventing web page hijacking

technical field

The present invention relates to the technical field of network security, in particular to a method and device for preventing hijacking of webpages.

Background technique

With the popularization and development of the Internet and network applications, a large number of hacker attacks follow, especially network attacks against the Internet. Among them, tampering with web files is a common method of hacker attacks. Web page tampering attacks are often difficult to check in advance and prevent in real time. Due to the complex network environment, it is difficult to trace the responsibility, and the attack tools are simple and intelligent. Although firewalls, intrusion detection systems and other security devices are currently used as security prevention methods, web application attacks are different from other attack methods, and are difficult to be detected by traditional security devices, which can easily break through the protection of firewalls and intrusion detection. Simply relying on traditional network security devices such as firewalls and intrusion detection systems cannot effectively prevent web page tampering attacks.

SUMMARY OF THE INVENTION

The main purpose of the embodiments of the present invention is to provide a method and device for preventing hijacking of webpages, which overcomes common hijacking problems, such as DNS hijacking, page jumping, or operator advertisements appearing on the page.

To achieve the above purpose, the present invention provides a method for preventing hijacking of a webpage, comprising:

Get the user domain name request instruction;

Parse the user's domain name request instruction to obtain the first IP address and the second IP address;

Obtain the reference index by using the first IP address and the second IP address;

Display the correct page on the client side according to the reference index to prevent web page hijacking.

In one embodiment, the reference indicator is whether the first IP address and the second IP address are the same.

In one embodiment, the step of obtaining the reference index includes:

Obtain the first IP address from the business domain name server, and obtain the second IP address from the client;

Compare whether the first IP address and the second IP address are the same, and the comparison result is the reference index.

In one embodiment, the step of notifying the client to display the correct page according to the reference index is as follows:

When the first IP address is different from the second IP address, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, it is determined that the user domain name is not hijacked, and the client is notified to display the first IP address The webpage corresponding to the address or the webpage corresponding to the second IP address.

In one embodiment, the reference indicator is whether the webpage feature information corresponding to the second IP address is in the whitelist.

In one embodiment, the step of obtaining the reference index includes:

Scan the dom tree of the web page corresponding to the second IP address through the JavaScript engine;

The webpage feature information obtained by scanning is compared with the information in the whitelist to determine whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is the reference index.

In one embodiment, the step of notifying the client to display the correct page according to the reference index is as follows:

If the feature information of the webpage corresponding to the second IP address is not in the whitelist, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client is notified to display the webpage corresponding to the second IP address.

Correspondingly, in order to achieve the above purpose, the present invention also provides a device for preventing hijacking of webpages, including:

A domain name request obtaining unit, used to obtain a user domain name request instruction;

a domain name parsing unit, configured to parse the user domain name request instruction to obtain the first IP address and the second IP address;

a reference index obtaining unit, configured to obtain a reference index by using the first IP address and the second IP address;

The anti-hijacking unit is used to notify the client to display the correct page according to the reference index, so as to realize the anti-hijacking of the webpage.

In one embodiment, the reference indicator acquired by the reference indicator acquiring unit is whether the first IP address and the second IP address are the same.

In one embodiment, the reference index obtaining unit includes:

an initialization module, configured to obtain the first IP address from the service domain name server, and obtain the second IP address from the client;

The IP address comparison module is used to compare whether the first IP address and the second IP address are the same, and the comparison result is the reference index.

In one embodiment, the anti-hijacking unit is specifically used for:

When the first IP address is different from the second IP address, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, it is determined that the user domain name is not hijacked, and the client is notified to display the first IP address The webpage corresponding to the address or the webpage corresponding to the second IP address.

In one embodiment, the reference indicator acquired by the reference indicator acquiring unit is whether the feature information of the webpage corresponding to the second IP address is in the whitelist.

In one embodiment, the reference index obtaining unit includes:

The scanning module is used to scan the dom tree of the web page corresponding to the second IP address through the Java Script engine;

The webpage feature information comparison module is used to compare the webpage characteristic information obtained by scanning with the information in the whitelist, and determine whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is the reference index.

In one embodiment, the anti-hijacking unit is specifically used for:

If the feature information of the webpage corresponding to the second IP address is not in the whitelist, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client is notified to display the webpage corresponding to the second IP address.

The above-mentioned technical scheme has the following beneficial effects:

This technical solution compares the resolution result of the operator's domain name resolution server with the resolution result of the service domain name resolution server, and determines whether the user's DNS is hijacked, which can eliminate abnormal domain name resolution and avoid the situation that the user cannot access services normally when the user's DNS is hijacked. .

In addition, this technical solution can also scan the dom tree of the web page corresponding to the IP address through the Java Script engine; compare the information obtained by scanning with the information in the whitelist to determine whether the web page corresponding to the IP address is in the whitelist, so as to obtain Whether the page has been tampered with and hijacked can effectively prevent the page content from being tampered with.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other objects, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

FIG. 1 shows a flowchart of a method for preventing hijacking of a webpage;

Fig. 2 shows one of the flow charts of reference index acquisition steps;

FIG. 3 shows one of the anti-hijacking schematic diagrams of the present embodiment;

Fig. 4 shows the second flow chart of reference index acquisition steps;

FIG. 5 shows the second schematic diagram of hijacking in this embodiment;

6 shows a block diagram of a device for preventing hijacking of a webpage;

Fig. 7 shows one of the functional block diagrams of the reference index acquisition unit in the device;

Fig. 8 shows the second functional block diagram of the reference index acquisition unit in the device;

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Embodiments of the present invention provide a method and device for preventing web page hijacking. The present invention will be described in detail below with reference to the accompanying drawings.

An embodiment of the present invention provides a method for preventing hijacking of a webpage, as shown in FIG. 1 . include:

Step S101: obtaining a user domain name request instruction;

Step S102: parse the user domain name request instruction to obtain a first IP address and a second IP address;

Step S103: obtaining a reference index by using the first IP address and the second IP address;

Step S104: Notify the client to display the correct page according to the reference index, so as to realize webpage anti-hijacking.

Correspondingly, the present invention also provides a device for preventing hijacking of a webpage, as shown in FIG. 6 . include:

a domain name request obtaining unit 601, configured to obtain a user domain name request instruction;

a domain name parsing unit 602, configured to parse the user domain name request instruction to obtain a first IP address and a second IP address;

a reference index obtaining unit 603, configured to obtain a reference index by using the first IP address and the second IP address;

The anti-hijacking unit 604 is configured to notify the client to display the correct page according to the reference index, so as to realize the anti-hijacking of the webpage.

In one embodiment, the reference indicator is whether the first IP address and the second IP address are the same. As shown in Figure 2, it is one of the flow charts of the steps for obtaining the reference index. Steps include:

Step S1031: Obtain the first IP address from the service domain name server, and obtain the second IP address from the client;

Step S1032: Compare whether the first IP address and the second IP address are the same, and the comparison result is a reference indicator.

Correspondingly, the steps for displaying the correct page on the client side according to the reference indicators are as follows:

When the first IP address is different from the second IP address, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, it is determined that the user domain name is not hijacked, and the client is notified to display the first IP address The webpage corresponding to the address or the webpage corresponding to the second IP address.

Correspondingly, in the same embodiment, for the virtual device, the reference index obtained by the reference index obtaining unit 603 is whether the first IP address and the second IP address are the same. As shown in FIG. 7 , it is one of the functional block diagrams of the reference index obtaining unit in the apparatus. include:

The initialization module 6031 is used to obtain the first IP address from the service domain name server, and obtain the second IP address from the client;

The IP address comparison module 6032 is configured to compare whether the first IP address and the second IP address are the same, and the comparison result is the reference index.

Similarly, the anti-hijacking unit 604 is specifically used for:

When the first IP address is different from the second IP address, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, it is determined that the user domain name is not hijacked, and the client is notified to display the first IP address The webpage corresponding to the address or the webpage corresponding to the second IP address.

As shown in Figure 3, the user enters the domain name "M.haosou.com", the carrier DNS server and the service DNS server both obtain the domain name, and the carrier DNS server obtains the corresponding domain name "M.haosou.com" according to its own domain name resolution table The IP address is 127.0.0.1, the service DNS server obtains the IP address corresponding to the domain name "M.haosou.com" according to its own domain name resolution table as 125.88.193.213, and the service DNS server returns the resolved IP address to the carrier DNS server , and the carrier DNS server does not return the page corresponding to the IP address 125.88.193.213 to the client, but returns the web page corresponding to the IP address 127.0.0.1 to the client, and the secure domain name resolution server obtains the carrier DNS server The returned IP address is used to judge whether the IP address has been tampered with. The judgment process is: obtain the resolved IP address from the service DNS server, and compare the IP address obtained from the client with the IP address obtained from the service DNS server. If the IP addresses are the same, no DNS tampering has occurred, and if the IP addresses are not the same, DNS tampering has occurred. In this case, the secure domain name resolution server returns the IP address 125.88.193.213 to the client, and the client displays the web page corresponding to the IP address 125.88.193.213.

It can be seen from the above embodiments that the technical solution can provide the best resolution solution according to the IP obtained by the user, thereby ensuring the normal access of the user to the service and reducing the possibility of infringing the company's core interests.

In another embodiment, the reference indicator is whether the webpage feature information corresponding to the second IP address is in the whitelist. As shown in Figure 4, it is the second flow chart of the steps for obtaining the reference index. include:

Step S1031': scan the dom tree of the web page corresponding to the second IP address by the Java Script engine;

Step S1032': Compare the webpage characteristic information obtained by scanning with the information in the whitelist, and determine whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is the reference index.

Correspondingly, the steps for displaying the correct page on the client side according to the reference indicators are as follows:

If the feature information of the webpage corresponding to the second IP address is not in the whitelist, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client is notified to display the webpage corresponding to the second IP address.

Correspondingly, in the same embodiment, for the virtual device, the reference indicator acquired by the reference indicator acquiring unit 603 is whether the webpage feature information corresponding to the second IP address is in the whitelist. As shown in FIG. 8 , it is the second functional block diagram of the reference index obtaining unit in the device. The reference index obtaining unit 603 includes:

Scanning module 6031', for scanning the dom tree of the web page corresponding to the second IP address by the JavaScript engine;

The webpage characteristic information comparison module 6032' is used to compare the webpage characteristic information obtained by scanning with the information in the whitelist, and determine whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is the reference index.

Similarly, the anti-hijacking unit 604 is specifically used for:

If the feature information of the webpage corresponding to the second IP address is not in the whitelist, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client is notified to display the webpage corresponding to the second IP address.

For this embodiment, when the user searches "supercooling degree" in the search bar, a user domain name request instruction is generated according to the keyword, and the service domain name resolution server obtains the corresponding IP address according to the request instruction. On the client side, the corresponding web page is displayed according to the IP address. However, the webpage has actually been tampered with, and the webpage displayed on the client is shown in Figure 5. At this time, the front-end Java Script engine of the client scans the dom tree of the webpage corresponding to the IP address, compares the obtained webpage feature information with the information in the whitelist, and finds that the webpage information does not appear in the whitelist, so we can know that at this time The web page displayed by the client has been tampered with. In order to correct the displayed error result, the web page corresponding to the first IP address needs to be displayed on the client, so that normal web page information can appear.

As can be seen from the description of the above embodiments, this technical solution needs to scan the page information displayed by the client within the idle time after the page main body is loaded, and then perform error correction processing. In order to overcome this situation, after an anti-hijacking process, it can be seen that the web page feature information corresponding to the tampered second IP address is illegally tampered with, and the web page feature information scanned by the Java Script engine is directly used as the basis, and the “too cold” is generated later. When the domain name corresponding to the “degree” is resolved, it can directly determine whether the page has been tampered with in the past. When similar tampering occurs, the correct page information can be directly displayed on the client side without displaying the tampered page on the client side. In this way, not only the user's normal access to services is guaranteed, but also the user's experience and timeliness are improved.

It can be seen from the above two embodiments that the technical solution can reduce the possibility of infringing the core interests of the company, and ensure the user's experience of normal access to services.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be construed as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, it will be understood by those skilled in the art that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the apparatus for locating image edges in the natural background according to embodiments of the present invention . The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

By now, those skilled in the art will recognize that, although various exemplary embodiments of the present invention have been illustrated and described in detail herein, the present invention may still be implemented in accordance with the present disclosure without departing from the spirit and scope of the present invention. The content directly determines or derives many other variations or modifications consistent with the principles of the invention. Accordingly, the scope of the present invention should be understood and deemed to cover all such other variations or modifications.

The above specific embodiments further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (8)

1. a method for preventing hijacking of webpage, is characterized in that, comprises: Get the user domain name request instruction; Parsing the user domain name request instruction to obtain a first IP address and a second IP address; Using the first IP address and the second IP address to obtain the reference index; wherein, the first IP address is obtained from the service domain name server, and the second IP address returned by the operator's domain name server is obtained from the client; Notify the client to display the correct page according to the reference indicator, so as to realize anti-hijacking of the webpage; Wherein, comparing whether the first IP address and the second IP address are the same, the obtained comparison result of whether the first IP address and the second IP address are the same is the reference index; Wherein, when the first IP address is different from the second IP address, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, it is determined that the user domain name is not hijacked, and the client is notified The webpage corresponding to the first IP address or the webpage corresponding to the second IP address is displayed. 2 . The method of claim 1 , wherein the reference indicator is whether the webpage feature information corresponding to the second IP address is in a whitelist. 3 . 3. The method of claim 2, wherein the step of obtaining a reference index by using the first IP address and the second IP address comprises: Scan the dom tree of the web page corresponding to the second IP address through the JavaScript engine; Comparing the webpage feature information obtained by scanning with the information in the whitelist, it is determined whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is a reference index. 4. The method according to claim 3, wherein the step of notifying the client to display the correct page according to the reference index is specifically: If the feature information of the webpage corresponding to the second IP address is not in the white list, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client displays the second IP address the corresponding webpage. 5. A device for preventing hijacking of webpages, comprising: A domain name request obtaining unit, used to obtain a user domain name request instruction; a domain name parsing unit, configured to parse the user domain name request instruction to obtain a first IP address and a second IP address; A reference index obtaining unit, configured to obtain a reference index by using the first IP address and the second IP address; the reference index obtaining unit includes: an initialization module, used for obtaining the first IP address from the service domain name server, from the client Obtain the second IP address returned by the operator's domain name server; An anti-hijacking unit, used for notifying the client to display the correct page according to the reference index, so as to realize webpage anti-hijacking; Wherein, the reference index obtaining unit further includes: an IP address comparison module, configured to compare whether the first IP address and the second IP address are the same, and the obtained comparison result of whether the first IP address and the second IP address are the same is that as a reference indicator; Wherein, the anti-hijacking unit is further configured to: when the first IP address and the second IP address are different, determine that the user domain name is hijacked, and notify the client to display the webpage corresponding to the first IP address; otherwise, determine the user domain name If not hijacked, notify the client to display the webpage corresponding to the first IP address or the webpage corresponding to the second IP address. 6 . The apparatus according to claim 5 , wherein the reference index obtained by the reference index obtaining unit is whether the webpage feature information corresponding to the second IP address is in a whitelist. 7 . 7. The apparatus according to claim 6, wherein the reference index obtaining unit comprises: The scanning module is used to scan the dom tree of the web page corresponding to the second IP address through the Java Script engine; The webpage characteristic information comparison module is used to compare the webpage characteristic information obtained by scanning with the information in the whitelist, and determine whether the webpage characteristic information corresponding to the second IP address is in the whitelist, and the comparison result is the reference index . 8. The device according to claim 7, wherein the anti-hijacking unit is specifically used for: If the feature information of the webpage corresponding to the second IP address is not in the whitelist, it is determined that the user domain name is hijacked, and the client is notified to display the webpage corresponding to the first IP address; otherwise, the client is notified to display the second IP The web page corresponding to the address.