Systems and methods for detecting false code
View Patent ↗Systems and methods for detecting false code in web pages linked to a web site are provided. One system includes a web server for administering the web site and a surveillance server for collecting generated or updated web pages from among the web pages linked to the web site, selecting tags of a given tag type included in the collected web pages, determining whether the selected tags comprise false code, and providing the determination result to an administrator terminal such that an administrator can check the determination result. One method includes collecting web pages that were generated or updated within a set time period from among the web pages linked to the web site, determining whether tags included in the collected web pages comprise false code, and providing the determination result to an administrator terminal such that an administrator can check the determination result.
1. A method comprising:
requesting, by a surveillance server, from a web server having a plurality of pages accessible to user terminals over a network, a list of addresses of pages from the plurality of pages that have been generated or updated within a pre-specified period of time;
receiving, by the surveillance server, from the web server, the list of addresses of pages that have been generated or updated within the pre-specified period of time;
loading, by the surveillance server, from the web server, at least some of the pages having an address in the list of addresses, each of the loaded pages having, in a body area, a part of a page including a network address that is different than that loaded page's address from the list of addresses;
determining, by the surveillance server, whether network addresses included in the loaded pages are malicious based on the network addresses matching malicious network addresses in a false code list; and
determining, by the surveillance server, whether network addresses included in the loaded pages are normal based on the network addresses matching network addresses in a normal code list; and
blocking network access of the user terminals to the part of the page comprising the network address based on the network address appearing in the false code list.
2. The method of claim 1 , wherein the body area of each loaded page comprises a plurality of different markup language tags, the part of the page that includes the network address being a pre-selected markup language tag from the plurality of different markup language tags; and wherein the method further comprises:
searching within the pre-selected markup language tag of the loaded pages for network addressees.
3. The method of claim 2 , wherein the plurality of markup language tags are Hypertext Markup Language (HTML) tags.
4. The method of claim 2 , wherein the plurality of markup language tags include one or more of: an iframe tag, a script tag, an object tag, an embed tag, a div tag, or a span tag.
5. The method of claim 2 , wherein the each of the plurality of markup language tags include at least two different classes of tag types, each of the tag types selectable through a user interface element.
6. The method of claim 1 , wherein the addresses in the list of addresses and the network addresses are Uniform Resource Locators (URLs).
7. The method of claim 1 , further comprising:
determining whether network addresses included in the loaded pages are normal based on the network addresses matching normal network addresses in a normal code list.
8. The method of claim 7 , further comprising:
storing separately, in a data store, a first set of network addresses determined to be normal based on appearing in the normal code list and a second set of network addresses determined to be malicious based on appearing in the false code list.
9. The method of claim 1 , further comprising:
in response to determining that some of the network addresses in the loaded pages are malicious, generating a notification indicating a quantity of the network addresses that have been determined to be malicious.
10. The method of claim 1 , wherein addresses of pages that have not been generated or updated not within the pre-specified period of time are not included in the list of addresses.
11. The method of claim 1 , wherein pages that have not been generated or updated not within the pre-specified period of time are not loaded.
12. The method of claim 1 , further comprising:
determining that one or more network addresses found in the loaded pages are not in the false code list nor in a normal code list, the normal code list comprising a list of addresses designated as being normal; and
responsive to determining that the one or more network addresses are not in the false code list nor the normal code list, storing the one or more network addresses in a database for later manual inspection.
13. A system comprising:
one or more processors of a machine;
a memory comprising instructions that when executed by the one or more processors perform operations comprising:
request, by a surveillance server, from a web server having a plurality of pages accessible to user terminals over a network, a list of addresses of pages from the plurality of pages that have been generated or updated within a pre-specified period of time;
receive, from the plurality of pages, from the web server, the list of addresses of pages that have been generated or updated within the pre-specified period of time;
load, by the surveillance server, from the web server, at least some of the pages having an address in the list of addresses, each of the loaded pages having, in a body area, a part of a page including a network address that is different than that loaded page's address from the list of addresses;
determine, by the surveillance server, whether network addresses included in the loaded pages are malicious based on the network addresses matching malicious network addresses in a false code list; and
determine, by the surveillance server, whether network addresses included in the loaded pages are normal based on the network addresses matching network addresses in a normal code list; and
block network access of the user terminals to the part of the page comprising the network address based on the network address appearing in the false code list.
14. The system of claim 13 , wherein the body area of each loaded page comprises a plurality of different markup language tags, the part of the page that includes the network address being a pre-selected markup language tag from the plurality of different markup language tags; and wherein the operations further comprise:
search within the pre-selected markup language tag of the loaded pages for network addressees.
15. The system of claim 14 , wherein the plurality of markup language tags are Hypertext Markup Language (HTML) tags.
16. The system of claim 14 , wherein the plurality of markup language tags include one or more of: an iframe tag, a script tag, an object tag, an embed tag, a div tag, or a span tag.
17. The system of claim 13 , wherein the addresses in the list of addresses and the network addresses are Uniform Resource Locators (URLs).
18. The system of claim 13 , the operations further comprising:
determining whether network addresses included in the loaded pages are normal based on the network addresses matching normal network addresses in a normal code list.
19. The system of claim 18 , the operations further comprising:
storing separately, in a data store, a first set of network addresses determined to be normal based on appearing in the normal code list and a second set of network addresses determined to be malicious based on appearing in the false code list.
20. The system of claim 13 , the operations further comprising:
in response to determining that some of the network addresses in the loaded pages are malicious, generate a notification indicating a quantity of the network addresses that have been determined to be malicious.
21. A machine-readable storage device having instruction data to cause a machine to perform operations comprising:
request, by a surveillance server, from a web server having a plurality of pages accessible to user terminals over a network, a list of addresses of pages from the plurality of pages that have been generated or updated within a pre-specified period of time;
receive, by the surveillance server, from the web server, the list of addresses of pages that have been generated or updated within the pre-specified period of time;
load, by the surveillance server, from the web server, at least some of the pages having an address in the list of addresses, each of the loaded pages having, in a body area, a part of a page including a network address that is different than that loaded page's address from the list of addresses;
determine, by the surveillance server, whether network addresses included in the loaded pages are malicious based on the network addresses matching malicious network addresses in a false code list; and
determine, by the surveillance server, whether network addresses included in the loaded pages are normal based on the network addresses matching network addresses in a normal code list; and
block network access of the user terminals to the part of the page comprising the network address based on the network address appearing in the false code list.
22. The machine-readable storage device of claim 21 , wherein the body area of each loaded page comprises a plurality of different markup language tags, the part of the page that includes the network address being a pre-selected markup language tag from the plurality of different markup language tags; and wherein the operations further comprise:
search within a pre-selected markup language tag of the loaded pages for network addressees.
23. The machine-readable storage device of claim 21 , wherein the addresses in the list of addresses and the network addresses are Uniform Resource Locators (URLs).
24. The machine-readable storage device of claim 21 , wherein the plurality of markup language tags include one or more of: an iframe tag, a script tag, an object tag, an embed tag, a div tag, or a span tag.
25. The machine-readable storage device of claim 21 , the operations further comprising:
in response to determining that some of the network addresses in the loaded pages are malicious, generate a notification indicating a quantity of the network addresses that have been determined to be malicious.