Method and apparatus for monitoring malicious link injection into website source code

Patent metadata

Field	Value
Publication number	US-10148689-B2
Application number	US-201514709641-A
Country	US
Kind code	B2
Filing date	May 12, 2015
Priority date	Nov 21, 2012
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

A method for monitoring malicious link injection into website source code, may include: monitoring a modification operation on a website source code file and obtaining a changed code segment; analyzing the changed code segment to extract an external link; determining whether the external link is a suspicious or malicious link; and sending an alarm message if it is determined that the external link is a suspicious or malicious link. According to the method for monitoring malicious link injection into website source code, changed content of source code can be monitored in real time, so as to effectively prevent a common type of virus transmission manner in which a malicious redirection website address is injected into page code of a legal website after a system write permission is obtained by using a vulnerability of an operating system or a third-party application. In addition, the present disclosure further provides a related apparatus.

First claim

What is claimed is:

1. A method for monitoring malicious link injection into website source code, performed by a processor executing instructions stored in a memory, the method comprising:
monitoring in real-time a plurality of website source code files that are stored in a directory to identify a change to a website source code file and obtaining a changed code segment;
loading a code profiler corresponding to a programming language of the changed code segment and parsing the changed code segment using the code profiler to extract an external link;
determining whether the external link is a suspicious or malicious link by transmitting the external link to a verification service, and receiving a result indicating whether the external link is a suspicious or malicious link; and
sending an alarm message and starting a protection mechanism if the result indicates that the external link is a suspicious or malicious link,
wherein the monitoring comprises:
backing up the plurality of website source code files;
storing modification times of the backed up website source code files;
comparing a current modification time with the stored modification times to identify the change to the website source code file, and
comparing a backed up version and a current version of the identified website source code file to obtain the changed code segment.

2. The method according to claim 1 , further comprising:
starting a protection mechanism after it is determined that the external link is a suspicious or malicious link, so as to prevent a system file from being deleted maliciously and a service from being uninstalled or terminated maliciously.

3. The method according to claim 1 , wherein the determining whether the external link is a suspicious or malicious link comprises:
determining, according to whether the external link is a link located in a page element having a pixel value of 0, or a link composed in a page element whose coordinate location is obviously outside a screen, whether external link is a suspicious or malicious link.

4. An apparatus for monitoring malicious link injection into website source code, the apparatus comprising a memory and a processor communicating with the memory, the memory storing instructions that when executed by the processor configure the apparatus to:
monitor in real-time a plurality of website source code files that are stored in a directory to identify a change to a website source code file and obtain a changed code segment;
load a code profiler corresponding to a programming language of the changed code segment and parse the changed code segment using the code profiler to extract an external link;
determine whether the external link is a suspicious or malicious link by transmitting the external link to a verification service, and receiving a result indicating whether the external link is a suspicious or malicious link; and
send an alarm message and starting a protection mechanism if it the result indicates that the external link is a suspicious or malicious link,
wherein to monitor the plurality of website source code files, the instructions are further configured to:
back up the plurality of website source code files;
store modification times of the backed up website source code files;
compare a current modification time with the stored modification times to identify the change to the website source code file, and
compare a backed up version and a current version of the identified website source code file to obtain the changed code segment.

5. The apparatus for monitoring malicious link injection into website source code according to claim 4 , wherein the instructions are further configured to start a protection mechanism after it is determined that the external link is a suspicious or malicious link, so as to prevent a system file from being deleted maliciously and a service from being uninstalled or terminated maliciously.

6. The apparatus for monitoring malicious link injection into website source code according to claim 4 , wherein the instructions are further configured to: determine, according to whether the external link is a link located in a page element having a pixel value of 0, or a link comprised in a page element whose coordinate location is obviously outside of a screen, whether the external link is a suspicious or malicious link.

7. A non-transitory computer readable storage medium having stored therein one or more instructions, which, when executed by a computing device, cause the computing device to:
monitor in real-time a change to a website source code file a plurality of website source code files that are stored in a directory to identify and obtain a changed code segment;
loading a code profiler corresponding to a programming language of the changed code segment and parsing the changed code segment using the code profiler to extract an external link;
determine whether the external link is a suspicious or malicious link by transmitting the external link to a verification service, and receiving a result indicating whether the external link is a suspicious or malicious link; and
send an alarm message and starting a protection mechanism if the result indicates that the external link is a suspicious or malicious link,
wherein to monitor the plurality of website source code files, the instructions are further configured to:
back up the plurality of website source code files;
store modification times of the backed up website source code files;
compare a current modification time with the stored modification times to identify the change to the website source code file, and
compare a backed up version and a current version of the identified website source code file to obtain the changed code segment.

Assignees

• Tencent Tech Shenzhen Co Ltd

Inventors

• Lu Sixi

Classifications

• H04L67/18

  Electricity · mapped topic

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title