CN116910751A - Information security detection methods, devices, electronic equipment and storage media - Google Patents

Abstract

Embodiments of the present disclosure provide an information security detection method, which is executed by a webpage client containing a preset plug-in. The method includes: when monitoring a first type of operation event acting on a first webpage, obtaining a target area on the first webpage. Corresponding target text; wherein, the target area is the web page area where the first type of operation event acts on the first web page; send the target text to the server through the preset plug-in; receive the return from the server risk assessment information; according to the risk assessment information, before jumping to the second web page based on the second type of operation acting on the target area, the risk prompt information is output. Here, compared with the user manually copying the text of the first webpage and querying and analyzing the risks of the first webpage, webpage risks can be automatically detected and warned, which reduces manual operations, improves the efficiency and accuracy of webpage risk detection, and improves user browsing The security of the web and the intelligence of browsing the web.

Description

Information security detection methods, devices, electronic equipment and storage media

Technical field

The present disclosure relates to but is not limited to the field of network security technology, and in particular, to an information security detection method, device, electronic equipment and storage medium.

Background technique

With the rapid development of network technology, individuals and enterprises are using web pages more and more widely, and the risks faced by accessing web pages are also increasing.

In existing web page information security detection methods, we often manually copy web page information to a threat analysis platform for detection and analysis to determine information security, or by calling application programming interfaces to detect and analyze information security. The efficiency of detecting information security by manually copying web page information is low, while detecting information security by calling application programming interfaces is highly professional and has a small scope of application.

Contents of the invention

In view of this, embodiments of the present disclosure disclose an information security detection method, device, electronic device, and storage medium.

According to a first aspect of an embodiment of the present disclosure, an information security detection method is provided, which is executed by a web client containing a preset plug-in. The method includes: when monitoring a first type of operation event acting on a first web page, obtain The target text corresponding to the target area on the first web page; wherein the target area is the web page area of the first web page on which the first type of operation event acts;

Send the target text to the server through the preset plug-in;

Receive risk assessment information returned by the server;

According to the risk assessment information, risk prompt information is output before jumping to the second web page based on the second type of operation acting on the target area.

In one embodiment, when monitoring the first type of operation event acting on the first web page, obtaining the target text corresponding to the target area on the first web page includes: when monitoring the first type of operation event acting on the first web page. When a type operation event occurs, the target method for obtaining the target text is determined based on the event information of the first type operation event; and the target text is obtained according to the target method.

In one embodiment, when monitoring the first type of operation event acting on the first web page, determining the target method of obtaining the target text based on the event information of the first type of operation event includes: when monitoring When acting on the cursor hover event or cursor selection event of the first web page, extract the text contained in the web page tag corresponding to the cursor hover of the first web page or the text selected by the cursor.

In one embodiment, when monitoring the first type of operation event acting on the first web page, determining the target method of obtaining the target text based on the event information of the first type of operation event includes: when monitoring When acting on an operation event of a screenshot control on the first web page, a screenshot of the first web page is obtained; and based on the screenshot of the first web page, text in the screenshot of the first web page is identified and obtained.

In one embodiment, when a first type of operation event acting on the first web page is monitored, obtaining the target text corresponding to the target area on the first web page includes: when a first type of operation event acting on the first web page is monitored, In the first type of operation event, obtain the alternative text corresponding to the target area of the first web page; use a preset regular matching expression to match the alternative text, and obtain a text that successfully matches the preset regular matching expression. The target text.

In one embodiment, the preset regular matching expression includes: a domain name regular matching expression, used to extract domain names from the alternative text; an Internet protocol address regular matching expression, used to extract the domain name from the alternative text Extract the Internet protocol address from the alternative text; the email address regular matching expression, used to extract the email address from the alternative text; the communication identification regular expression, used to extract the communication identification from the alternative text; the file hash regular expression Expression used to extract the file's hash value from the alternative text.

In one embodiment, the method further includes: determining whether the preset plug-in has logged into the server; when the preset plug-in has logged into the server, obtain the preset plug-in and return after logging into the server. Authentication token; sending the target text to the server through the preset plug-in includes: sending the target text to the server through the preset plug-in according to the authentication token.

In a second aspect, embodiments of the present disclosure provide an information security detection method, which is executed by a server. The method includes:

Receive the target text sent by the default plug-in of the web client;

Perform threat analysis on the target text to obtain risk assessment information; wherein the risk assessment information is used for: the preset plug-in of the web client to output risk prompt information based on the risk assessment information;

Send the risk assessment information to the client.

In a third aspect, an embodiment of the present disclosure provides an information security detection device, which includes:

An acquisition module configured to acquire the target text corresponding to the target area on the first web page when monitoring the first type of operation event acting on the first web page; wherein the target area is the area where the first type operation event acts on the first web page. The web page area of the first web page;

A sending module, used to send the target text to the server through a preset plug-in;

A receiving module, configured to receive the risk assessment information returned by the server;

An output module, configured to output risk prompt information according to the risk assessment information before jumping to the second web page based on the second type of operation acting on the target area.

In a fourth aspect, embodiments of the present disclosure provide an information security detection device, which includes:

The receiving module is used to receive the target text sent by the preset plug-in of the web client;

An acquisition module is used to perform threat analysis on the target text and obtain risk assessment information; wherein the risk assessment information is used for: the preset plug-in of the web client to output risk prompt information based on the risk assessment information;

A sending module is used to send the risk assessment information to the client.

In a fifth aspect, embodiments of the present disclosure provide an electronic device, the electronic device including: a processor and a memory for storing a computer program capable of running on the processor; wherein when the processor runs the computer program , perform the steps of the method described in one or more of the foregoing technical solutions.

In a sixth aspect, embodiments of the present disclosure provide a computer-readable storage medium that stores computer-executable instructions; after the computer-executable instructions are executed by a processor, one or more of the foregoing technical solutions can be implemented described method.

In the information security detection method provided by the embodiment of the present disclosure, a web client containing a preset plug-in obtains the target text of the first web page based on monitoring the first type of operation event, and obtains risk assessment information from the server through the target text. , thereby outputting risk warning information. Compared with the user manually copying the target text of the first webpage and manually querying and analyzing the risks of the first webpage, the plug-in can automatically obtain the target text of the first webpage and determine the risk assessment of the first webpage based on the server. Information can reduce manual operations, improve the efficiency and accuracy of detecting web page risks, and provide timely risk warning when there is a risk on the first web page, improving the security and intelligence of users browsing web pages.

Description of the drawings

Figure 1 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

Figure 2 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

Figure 3 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

Figure 4 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

Figure 5 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

FIG. 6 is a schematic diagram of a first web page provided by an embodiment of the present disclosure.

Figure 7 is a schematic diagram of a single sign-on method provided by an embodiment of the present disclosure.

Figure 8 is a schematic flowchart of an information security detection method provided by an embodiment of the present disclosure.

Figure 9 is a schematic diagram of an information security detection device provided by an embodiment of the present disclosure.

Figure 10 is a schematic diagram of an information security detection device provided by an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present disclosure. Those of ordinary skill in the art will not make any All other embodiments obtained under the premise of creative work belong to the scope of protection of this disclosure.

In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or a different subset of all possible embodiments, and Can be combined with each other without conflict.

In the following description, the terms "first\second\third" are only used to distinguish similar objects and do not represent a specific ordering of objects. It is understandable that "first\second\third" is used in Where permitted, the specific order or sequence may be interchanged so that the disclosed embodiments described herein can be practiced in other sequences than illustrated or described herein.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing embodiments of the disclosure only and is not intended to limit the disclosure.

As shown in Figure 1, an embodiment of the present disclosure provides an information security detection method, which is executed by a web client containing a preset plug-in. The method includes:

Step S101: When monitoring the first type of operation event acting on the first web page, obtain the target text corresponding to the target area on the first web page; wherein the target area is the place where the first type operation event acts. The web page area of the first web page;

Step S102: Send the target text to the server through the preset plug-in;

Step S103: Receive the risk assessment information returned by the server;

Step S104: According to the risk assessment information, before jumping to the second web page based on the second type of operation acting on the target area, output risk prompt information.

In one embodiment, the web page may be a text file in Hyper Text Markup Language (HTML) format, and a website may be constructed based on at least one web page; the web page client may include: an application program for reading and displaying web pages, such as browsing Devices etc.

In one embodiment, a plug-in may be a program running on a predetermined system platform, and may include: text plug-in, script plug-in or program plug-in, etc. The default plug-ins included in the web page client may include: browser plug-ins, etc.

In one embodiment, the first web page may be represented according to a Document Object Model (DOM, Document Object Model). The document object model may represent the first web page as a tree structure composed of at least one node; wherein the node may include: an element node, which may include a web page tag and the text contained in the web page tag; a text node, which may include The content text corresponding to the label; and/or, the attribute node, which can include the attributes of the label, etc. In one embodiment, the step S101 may include: monitoring the first type of operation event of the input device acting on the first web page through a default plug-in of the web client; when monitoring the first type of operation event of the first web page, When, the target text corresponding to the target area on the first web page is obtained.

In one embodiment, the input device may include but is not limited to: a mouse, a keyboard and/or a touch device, etc.

In one embodiment, the web client may include at least one web page, and the first web page may include: the first web page currently displayed; and/or the first web page currently acted upon by the input device.

The first type of operation event may include: a predetermined operation event that acts on the target area of the first web page to extract target text.

In one embodiment, the monitoring method may include: monitoring through a programming language. Exemplarily, the programming language may include: JavaScript programming language, through which operating events of the input device may be monitored. The operation events of the input device may include: mouse click events, mouse movement events, keyboard key press events and/or keyboard key release events, etc.

In one embodiment, the server may be configured to perform threat analysis on the target text and obtain risk assessment information. The server may include: a server of the threat intelligence platform. The threat intelligence platform can communicate with the server on the client side through the web page of the threat intelligence platform.

In one embodiment, the step S102 may include: the preset plug-in sends a request to the server, where the request carries the target text.

In one embodiment, the preset plug-in can send a request carrying the target text to the server by calling an interface of the server.

In one embodiment, the risk assessment information may be used to assess whether there is a risk in the first web page. The risk assessment information may include: whether threat information exists in the target text, threat information text, risk type and/or risk level. wait.

The risk types may include risks that may be caused by threat information. For example, the risk type may include: the presence of malicious links in the first web page, the presence of illegal information in the first web page, and/or the presence of malicious attack information in the first web page, etc.

The risk level may be used to indicate the importance and urgency of a risk. For example, the risk levels may include: high risk, medium risk, low risk, etc. For example, the urgency level can be divided into three levels: very urgent, urgent and not urgent.

In one embodiment, the second web page in step S104 may include: a second web page associated with the first web page, and the second type of operation may include a jump web page operation. For example, jumping to the second web page based on the second type of operation acting on the target area may include: the target area of the first web page contains a uniform resource locator (URL) of the second web page. , jumping to the second web page based on the operation of clicking the URL.

In one embodiment, the risk prompt information may include: risk prompt information displayed through the page or prompt box before jumping to the second web page based on the second type of operation acting on the target area; wherein, the Risk warning information may include: picture information and/or text information, etc.

In one embodiment, the step S104 may include: if it is determined in the risk assessment information that the first web page does not have a risk, outputting the first risk prompt information; wherein the first risk prompt information is used to indicate that the first web page There is no risk.

In one embodiment, step S104 may also include: if it is determined in the risk assessment information that the first web page has a risk, outputting second risk prompt information; wherein the second risk prompt information is used to indicate that the first web page There is a risk.

In one embodiment, the second risk prompt information may also be used to display information such as the threat information text, risk type and/or risk level in the risk assessment information.

For example, when the preset plug-in outputs the second risk warning information on the first web page, as shown in Figure 6, the text information of the risk warning can be displayed through a prompt box.

Here, the first type of operation event is monitored through the preset plug-in of the web client to obtain the target text of the first web page, and the risk assessment information is obtained from the server through the target text, thereby outputting the risk prompt information. Compared with the user Manually copy the target text of the first webpage and manually query and analyze the risk of the first webpage. The plug-in can automatically obtain the target text of the first webpage and determine the risk assessment information of the first webpage based on the server, which can reduce manual operations and improve the understanding of the webpage. The efficiency and accuracy of risk detection, and timely risk warning when there is a risk on the first web page, improve the security and intelligence of users browsing web pages.

As shown in Figure 2, in some embodiments, when monitoring the first type of operation event acting on the first web page, obtaining the target text corresponding to the target area on the first web page includes:

Step S201: When monitoring the first type of operation event acting on the first web page, determine the target method of obtaining the target text according to the event information of the first type of operation event;

Step S202: Obtain the target text according to the target mode.

In one embodiment, the type information of the text of the first web page may include: text text and/or picture text, etc.

In one embodiment, the first type of operation event may include: an operation event of obtaining text text and/or an operation event of obtaining picture text; if the operation event of the first type is an operation event of obtaining text text, determine the method of obtaining the target text. The target method is to obtain text text; if the first type of operation event is an operation event to obtain picture text, the method for obtaining the target text is determined to be: obtain picture text; extract the text text in the picture text.

In one embodiment, obtaining the image text may include: directly obtaining the image text and/or taking a screenshot to obtain the image text, etc.

In one embodiment, the method may include: setting a text acquisition control and a picture acquisition control in the preset plug-in, and when an operation of selecting a control in the preset plug-in is detected, determining how to obtain the target text. target way. Wherein, the picture acquisition control may include a screenshot control, etc.

In one embodiment, the method further includes: when monitoring that the loading of the first page is completed, determining the type information of the text in the first web page; and determining to obtain the target text according to the type information of the text in the first web page. target method.

When the text type of the first web page only includes text text or picture text, the target method of obtaining the target text may include: obtaining the text text according to the obtain text text operation event or obtaining the text text according to the obtain picture text operation event. Word text in picture.

When the text type of the first web page includes text text and picture text, the target method of obtaining the target text includes: obtaining text text events and/or obtaining picture text events, etc.

In one embodiment, when the text of the first web page is embedded in Portable Document Format (PDF, Portable Document Format) text, the target text text in the PDF file can be obtained according to the Get Text Text operation event. If the target text text in the PDF file is obtained according to the Get Text Text operation event, The event cannot obtain the text in the PDF file. You can obtain the target text in the PDF file through the Get Image Text operation event.

In one embodiment, when monitoring the first type of operation event acting on the first web page, determining the target method of obtaining the target text based on the event information of the first type of operation event may include: when monitoring When the first web page is loaded, all text of the first web page is extracted.

In one embodiment, the extracting all the text of the first web page may include: extracting the text in all nodes starting from the root element node in the first web page according to the document object model.

In some embodiments, when monitoring the first type of operation event acting on the first web page, determining the target method of obtaining the target text based on the event information of the first type of operation event includes:

When a cursor hover event or a cursor selection event acting on the first web page is monitored, the text contained in the web page tag corresponding to the cursor hover of the first web page or the text selected by the cursor is extracted.

In one embodiment, the cursor may include a cursor displayed by an input device.

In one embodiment, the cursor hovering event may include: when the cursor hovers within a target area of a webpage tag of the first webpage, extracting the text contained in the webpage tag corresponding to the cursor hovering.

In one embodiment, the web page tags may include HTML tags. The web page tags may include: title tags, paragraph tags and/or link tags, etc.

For example, when it is monitored that the cursor is hovering in the target area of the title tag of the first web page, the title text contained in the title tag is extracted.

In one embodiment, the cursor hovering event may further include: when the cursor is hovering in the target area of the webpage tag of the first webpage, determining the element node where the webpage tag corresponding to the cursor hovering is located according to the document object model, and extracting the element The text contained in the web page label corresponding to the cursor hovering in the node.

In one embodiment, the cursor selection event may include an event that text in the first web page is selected by the cursor. When a cursor selection event acting on the first web page is monitored, the text selected by the cursor of the first web page is extracted.

Exemplarily, the cursor selection event may include: pressing, moving and releasing the left mouse button; or, long pressing on the touch screen and dragging the cursor; or, on the keyboard Operation events such as mouse cursor click when the shift key is pressed.

Here, when the cursor selection event acting on the first web page is monitored, the text selected by the cursor is extracted, and the text selected by the cursor can be focused. In addition, incomplete text recognition or text recognition may occur during the extraction of the text of the first web page. When an error occurs, the correct text is selected for detection and analysis, which improves the accuracy and intelligence of obtaining the target text.

As shown in Figure 3, in some embodiments, when monitoring the first type of operation event acting on the first web page, the target method of obtaining the target text is determined based on the event information of the first type of operation event. ,include:

Step S301: When an operation event acting on the screenshot control on the first web page is monitored, obtain a screenshot of the first web page;

Step S302: According to the screenshot of the first web page, identify and obtain the text in the screenshot of the first web page.

In one embodiment, the screenshot control is included in the preset plug-in. In one embodiment, when a click operation on the screenshot control on the first web page is monitored, a screenshot operation is started, and a screenshot of the first web page is obtained according to the screenshot operation. In one embodiment, the screenshot operation may include: pressing, moving, and releasing operations of a mouse button. According to the starting coordinate position of the cursor when the mouse button is pressed during the screenshot operation and the end coordinate position of the cursor when the mouse button is released, the screenshot area in the first web page can be determined, and the screenshot area of the first web page can be obtained. A screenshot of the screenshot area.

In one embodiment, the step S301 can be implemented by calling the Canvas API according to the preset plug-in. The screenshot area information of the first web page is determined according to the screenshot operation of the screenshot control in the preset plug-in, where the screenshot area information may include: the coordinate position of the starting point cursor, the coordinate position of the end cursor, and the width and height of the screenshot area; the preset It is assumed that the plug-in sends the screenshot area information to the canvas application through the canvas application interface; the preset plug-in receives the canvas application and generates a screenshot of the first web page based on the screenshot area information. Wherein, the canvas application can also encode the screenshot of the first web page using a encoding method based on 64 printable characters to represent binary data (Base64), and send the encoded screenshot of the first web page to the default plug-in .

In one embodiment, the step S302 may include: identifying the screenshot of the first web page through optical character recognition (OCR, OpticalCharacter Recognition), and obtaining the text in the screenshot of the first web page. In one embodiment, the step S302 may further include: identifying the screenshot of the first web page according to the OCR interface, and obtaining the text in the screenshot of the first web page.

Here, the screenshot of the first web page is obtained by monitoring the screenshot control, and the text in the screenshot is obtained through the screenshot recognition of the first web page. When a malicious website puts threat information in the picture, the threat information can also be detected and an early warning can be issued. Improved the accuracy and security of web page detection.

As shown in Figure 4, in some embodiments, when monitoring the first type of operation event acting on the first web page, obtaining the target text corresponding to the target area on the first web page includes:

Step S401: When monitoring the first type of operation event acting on the first web page, obtain the alternative text corresponding to the target area of the first web page;

Step S402: Use a preset regular matching expression to match the candidate text, and obtain the target text that successfully matches the preset regular matching expression.

In one embodiment, the alternative text corresponding to the first web page target area may include: text obtained according to the cursor hover event, cursor selection event, and/or according to the operation event of the screenshot control.

In one embodiment, the regular expression describes a string matching pattern, which can be used to check whether a string contains a certain substring, replace the matching substring, or extract a certain string from a certain string. Substrings of conditions, etc.

Here, a preset regular matching expression is used to match the target text obtained by matching the alternative text. Setting the regular matching expression can filter the target text in the alternative text that is more suitable for threat detection analysis. Compared with manually selecting the target text for detection, It can improve the efficiency of detecting threat information and obtain more accurate risk assessment information.

In some embodiments, the preset regular matching expression includes:

Domain name regular matching expression, used to extract domain names from the alternative text;

Internet protocol address regular matching expression for extracting Internet protocol addresses from the alternative text;

Email address regular matching expression used to extract email addresses from the alternative text;

Communication identification regular expression, used to extract communication identification from the alternative text;

File hash regular expression used to extract the hash value of a file from said alternative text.

In one embodiment, the preset regular matching expression may include: domain name regular matching expression, Internet protocol address regular matching expression, email address regular matching expression, communication identification regular expression and/or file hash regular expression. Expressions etc.

In one embodiment, the domain name in the alternative text may include: the domain name of the first web page and/or the domain name contained in the text of the first web page.

The Internet Protocol Address (Internet Protocol Address) in the alternative text may include: the Internet Protocol address of the first web page or the Internet Protocol address contained in the text of the first web page.

The communication identification may include: a number that identifies the user's communication information, such as a phone number, etc. The phone number may include: a mobile phone number, a fixed phone number, a satellite phone number and/or a virtual phone number, etc.

The file hash may include: a hash value obtained by calculating the file according to a hash algorithm, and the file may be encrypted or the integrity of the file may be verified based on the hash value of the file.

In some embodiments, the method further includes:

Determine whether the preset plug-in has logged in to the server;

When the preset plug-in logs in to the server, obtain the authentication token returned by the preset plug-in after logging in to the server;

The sending the target text to the server through the preset plug-in includes:

According to the authentication token, the target text is sent to the server through the preset plug-in.

In one embodiment, the server may include a server of a threat intelligence platform, and the client accesses the server through the threat intelligence platform.

In one embodiment, the authentication token (token) returned by the preset plug-in after logging into the server can be used for temporary identity authentication of the computer login system.

In one embodiment, sending the target text to the server through the preset plug-in according to the authentication token may include: the preset plug-in sends a request to the server, and the request carries the authentication token. Card with the target text. The authentication token may be carried in a request header (header) of the request or behind a Universal Resource Locator (URL) of the request.

In some embodiments, the method further includes:

When the preset plug-in has not logged into the server, send a login request to the server;

Receive and store the authentication token returned by the server based on the login request.

In one embodiment, when the preset plug-in has not logged into the server, a login request is sent to the server, where the login request may include user login identity information; the server generates an authentication token based on the user login identity information. and returns the authentication token; the preset plug-in receives and stores the authentication token returned by the server based on the login request.

In one embodiment, the web client storing the authentication token may include: storing the authentication token in data (cookie) stored on the user's local terminal or in local storage (localStorage). In one embodiment, the authentication token can be stored in a local storage (localStorage) corresponding to the domain name.

In one embodiment, a single sign-on can be set up between the preset plug-in and the threat intelligence platform. The single sign-on (SSO, Single Sign On) means that in multiple application systems, users only need to log in once to access all mutually trusted application systems. In one embodiment, a schematic diagram of single sign-on between the preset plug-in and the threat intelligence platform is shown in Figure 7.

In one embodiment, the method for the preset plug-in to log in to the server further includes: sending a login request to the server on the threat intelligence platform of the web client; and the web client receiving and storing the login request based on the server's request. The returned authentication token; when the preset plug-in has not logged into the server, obtain the authentication token returned by the threat intelligence platform stored in the web client after logging into the server; according to the threat intelligence platform Log in the authentication token returned by the server, and send the target text to the server through the preset plug-in.

In this way, when the threat intelligence platform has logged into the server but the preset plug-in has not logged into the server, the preset plug-in can log in to the server according to the authentication returned by the threat intelligence platform without logging in again according to the single sign-on. The token communicates with the server, which improves the communication efficiency between the preset plug-in and the server, and can improve the efficiency of the preset plug-in in obtaining risk assessment information.

In one embodiment, when the preset plug-in has logged into the server and the threat intelligence platform has not logged into the server, the threat intelligence platform can log in all the information returned by the server according to the stored preset plug-in. Authentication token.

In one embodiment, the web client may include: installing the preset plug-in. In one embodiment, the web page client can send a request to obtain the default plug-in to the server, receive the default plug-in returned by the server, and install the default plug-in returned by the server.

As shown in Figure 5, an embodiment of the present disclosure provides an information security detection method, which is executed by a server. The method includes:

Step S501: Receive the target text sent by the default plug-in of the web client;

Step S502: Perform threat analysis on the target text to obtain risk assessment information; wherein the risk assessment information is used for: the default plug-in of the web client to output risk prompt information based on the risk assessment information;

Step S503: Send the risk assessment information to the client.

In one embodiment, the server may include a server for threat analysis, and the server may provide a page of the threat intelligence platform that the user accesses on the client.

In one embodiment, the server may receive a request sent by a preset plug-in of a web client, and the request includes the target text.

In one embodiment, the server may include a threat intelligence database. Wherein, the threat intelligence database is used to store threat intelligence information. The threat intelligence may include but is not limited to: threat identification information, which may include: malicious IP address, domain name, email address, file hash value, and program running path. and/or registry keys, etc.; or, information on threatening activities such as data leakage, data tampering, security attacks, unauthorized activities and/or the installation and operation of malware.

In one embodiment, step S502 may include: the server may query the threat intelligence database according to the target text to determine whether threat intelligence information exists in the target text; if threat intelligence information exists in the target text , determine the risk type and risk level that may be caused by the existing threat intelligence; generate risk assessment information according to whether the target text is threat information, threat information text, risk type and/or risk level.

In one embodiment, the method further includes: receiving a login request sent by a client preset plug-in or a threat intelligence platform; generating an authentication token based on the user login identity information in the login request; wherein the authentication token Used to temporarily authenticate identity in client login; return the authentication token to the client.

In one embodiment, the method further includes: receiving a request carrying an authentication token and target text sent by the client's preset plug-in; verifying the authentication token; if the authentication token passes the verification, Perform threat analysis on the target text, obtain risk assessment information, and send a response carrying the risk assessment information to the client; if the authentication token fails to pass the verification, send a denial of service response to the client.

In one embodiment, an information security detection process can be shown in Figure 8, and the steps can include:

Step a. The browser plug-in of the web client monitors the first type of operation event that the user acts on the first web page according to the listener; wherein said step a may include: step a1, monitoring the cursor hover event according to the hover listener; step a2. The cursor selection listener monitors the cursor selection event; step a3, monitor the operation event of the screenshot control according to the screenshot listener;

Step b. When the browser plug-in monitors the first type of operation event acting on the first web page, obtain the target text corresponding to the target area on the first web page; wherein, the step b may include:

Step b1: When a cursor hover event acting on the first web page is monitored, obtain the text contained in the web page tag corresponding to the cursor hover of the first web page;

Step b2: When the cursor selection event acting on the first web page is monitored, obtain the text selected by the cursor;

Step b31: When an operation event acting on the screenshot control on the first web page is monitored, obtain a screenshot of the first web page;

Step b32: According to the screenshot of the first web page, obtain the text in the screenshot of the first web page through optical character recognition OCR.

Step c. Perform regular matching on the obtained text to obtain the target text; wherein the target text includes: domain name, IP address, email address, communication identifier, file hash, etc.;

Step d. The browser plug-in sends the target text to the server;

Step e. The server receives the target text;

Step f. The server performs query and analysis through the threat intelligence database according to the target text, obtains risk assessment information, and sends the risk assessment information to the browser plug-in;

Step g. The browser plug-in receives the risk assessment information and outputs risk prompt information based on the risk assessment information.

As shown in Figure 9, an embodiment of the present disclosure provides an information security detection device, which includes:

The acquisition module 10 is configured to: when monitoring the first type of operation event acting on the first web page, obtain the target text corresponding to the target area on the first web page; wherein the target area is the first type of operation event. Acting on the web page area of the first web page;

Sending module 20, configured to: send the target text to the server through a preset plug-in;

The receiving module 30 is used to receive the risk assessment information returned by the server;

The output module 40 is configured to: according to the risk assessment information, before jumping to the second web page based on the second type of operation acting on the target area, output risk prompt information.

In one embodiment, the device further includes: a determining module 50 and an obtaining module 60; the determining module 50 is configured to: when listening for a first type of operation event acting on the first web page, according to the first type The event information of the operation event is used to determine the target mode for obtaining the target text; the obtaining module 60 is used to: obtain the target text according to the target mode.

In one embodiment, the device further includes: an extraction module 70; the extraction module 70 is configured to: when a cursor hover event or a cursor selection event acting on the first web page is monitored, extract the first The text contained in the web page tag corresponding to the cursor hovering on the web page or the text selected by the cursor.

In one embodiment, the acquisition module 10 is also configured to: acquire a screenshot of the first web page when an operation event acting on the screenshot control on the first web page is monitored; the acquisition module 60 is also configured to: Yu: according to the screenshot of the first web page, identify and obtain the text in the screenshot of the first web page.

In one embodiment, the acquisition module 10 is further configured to: when monitoring a first type of operation event acting on the first web page, acquire the alternative text corresponding to the target area of the first web page; the obtaining Module 60 is further configured to: use a preset regular matching expression to match the candidate text, and obtain the target text that successfully matches the preset regular matching expression.

In one embodiment, the determination module 50 is also used to determine whether the preset plug-in has logged into the server; the acquisition module 10 is also used to determine whether the preset plug-in has logged into the server. When, obtain the preset plug-in and log in to the server and return an authentication token; the sending module 20 is also used to: send the target text to the preset plug-in according to the authentication token. server.

In one embodiment, the sending module 20 is also configured to send the login request to the server when the preset plug-in has not logged in to the server; the receiving module 30 is also configured to receive and Store the authentication token returned by the server based on the login request.

As shown in Figure 10, an embodiment of the present disclosure provides an information security detection device, which includes:

The receiving module 110 is used to receive the target text sent by the default plug-in of the web client;

Obtain module 120, configured to perform threat analysis on the target text and obtain risk assessment information; wherein the risk assessment information is used for: the default plug-in of the web client to output risk prompt information based on the risk assessment information. ;

The sending module 130 is used to send the risk assessment information to the client.

It should be noted that those skilled in the art can understand that the methods provided in the embodiments of the present disclosure can be executed alone or together with some methods in the embodiments of the present disclosure or some methods in related technologies.

An embodiment of the present disclosure also provides an electronic device. The electronic device includes: a processor and a memory for storing a computer program that can be run on the processor. When the processor runs the computer program, it executes one or more of the foregoing The steps of the method described in the technical solution.

Embodiments of the present disclosure also provide a computer-readable storage medium that stores computer-executable instructions. After the computer-executable instructions are executed by the processor, the method described in one or more of the foregoing technical solutions can be implemented. .

The computer storage medium provided in this embodiment may be a non-transient storage medium. In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components may be combined, or can be integrated into another system, or some features can be ignored, or not implemented. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be electrical, mechanical, or other forms. of.

The units described above as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present disclosure can be all integrated into one processing module, or each unit can be separately used as a unit, or two or more units can be integrated into one unit; the above-mentioned integration The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

In some cases, if any two of the above technical features do not conflict, they can be combined into a new method and technical solution.

In some cases, if any two of the above technical features do not conflict, they can be combined into a new equipment technical solution.

Those of ordinary skill in the art can understand that all or part of the steps to implement the above method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, It includes the steps of the above method embodiment; and the aforementioned storage media includes: mobile storage devices, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disks or optical disks, etc. A medium on which program code can be stored.

The above are only specific embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure. should be covered by the protection scope of this disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims (12)

1. An information security detection method, which is executed by a web client including a preset plugin, the method comprising:

when monitoring a first type of operation event acting on a first webpage, acquiring a target text corresponding to a target area on the first webpage; the target area is a webpage area of the first webpage acted by the first type of operation event;

the target text is sent to a server through the preset plug-in;

receiving risk assessment information returned by the server;

and according to the risk assessment information, outputting risk prompt information before skipping to a second webpage based on a second type of operation acting on the target area.

2. The method of claim 1, wherein the obtaining the target text corresponding to the target area on the first web page when monitoring the first type of operation event acting on the first web page comprises:

When monitoring a first type of operation event acting on a first webpage, determining a target mode for acquiring the target text according to event information of the first type of operation event;

and obtaining the target text according to the target mode.

3. The method according to claim 2, wherein determining, when monitoring a first type of operation event acting on a first web page, a target manner of acquiring the target text according to event information of the first type of operation event includes:

when a cursor suspension event or a cursor selection event acting on the first webpage is monitored, extracting a text or a cursor selected text contained in a webpage label corresponding to the cursor suspension of the first webpage.

4. The method according to claim 2, wherein determining, when monitoring a first type of operation event acting on a first web page, a target manner of acquiring the target text according to event information of the first type of operation event includes:

when an operation event acting on a screenshot control on the first webpage is monitored, acquiring a screenshot of the first webpage;

and identifying and obtaining texts in the screenshot of the first webpage according to the screenshot of the first webpage.

5. The method of claim 1, wherein when a first type of operation event acting on a first web page is monitored, the obtaining target text corresponding to a target area on the first web page comprises:

when a first type of operation event acting on the first webpage is monitored, acquiring an alternative text corresponding to a target area of the first webpage;

and matching the candidate text by using a preset regular matching expression to obtain the target text successfully matched with the preset regular matching expression.

6. The method of claim 5, wherein the pre-set regular matching expression comprises:

the regular matching expression of the domain name is used for extracting the domain name from the candidate text;

an internet protocol address regular matching expression for extracting an internet protocol address from the candidate text;

the mailbox address regular matching expression is used for extracting an email address from the alternative text;

the communication identification regular expression is used for extracting a communication identification from the candidate text;

and the file hash regular expression is used for extracting hash values of the files from the candidate texts.

7. The method according to claim 1, wherein the method further comprises:

Determining whether the preset plug-in is logged in the server;

when the preset plugin logs in the server, acquiring an authentication token returned after the preset plugin logs in the server;

the sending the target text to a server through the preset plug-in comprises the following steps:

and according to the authentication token, the target text is sent to the server through the preset plug-in.

8. A method of message security detection performed by a server, the method comprising:

receiving a target text sent by a preset plug-in of a webpage client;

threat analysis is carried out on the target text, and risk assessment information is obtained; wherein the risk assessment information is for: the preset plug-in of the webpage client outputs risk prompt information according to the risk assessment information;

and sending the risk assessment information to a client.

9. An information security detection device, the device comprising:

the acquisition module is used for acquiring a target text corresponding to a target area on a first webpage when monitoring a first type of operation event acted on the first webpage; the target area is a webpage area where the first type of operation event acts on the first webpage;

The sending module is used for sending the target text to a server through a preset plug-in;

the receiving module is used for receiving the risk assessment information returned by the server;

and the output module is used for outputting risk prompt information before jumping to a second webpage based on the second type of operation acting on the target area according to the risk assessment information.

10. An information security detection device, the device comprising:

the receiving module is used for receiving a target text sent by a webpage client preset plug-in;

the obtaining module is used for carrying out threat analysis on the target text to obtain risk assessment information; wherein the risk assessment information is for: the preset plug-in of the webpage client outputs risk prompt information according to the risk assessment information;

and the sending module is used for sending the risk assessment information to the client.

11. An electronic device, the electronic device comprising: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, performs the steps of the information security detection method of any of claims 1 to 8.

12. A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions; the computer executable instructions, when executed by a processor, enable the information security detection method of any one of claims 1 to 8.