Security gateway and method for forwarding webpage by using security gateway

Abstract

The invention discloses a security gateway and a method for forwarding a webpage by using the security gateway. The method comprises the following steps of: attaching a pre-generated mobile code to a Web page to be forwarded after the Web page requested by a client is acquired from a server; setting the mobile code to ensure that a corresponding document object model corresponding to the web page to which the mobile code is attached is traversed, extracting a uniform resource locator (URL) from a specified hypertext markup language (HTML) label and matching the extracted URL with a preset malicious URL set during execution; adding a command statement into the Web page to which the mobile code is attached; setting the command statement to ensure that the execution of the mobile code is triggered when the Web page is loaded; and forwarding the Web page to which the mobile code is attached and into which the statement is added to the client. By the method, malicious URL hidden in the Web page can be accurately detected under the condition that computation overhead of the security gateway is not increased.

Description

Technical field [0001] The invention relates to the field of network security, in particular to a security gateway and a method for forwarding web pages. Background technique [0002] After nearly two decades of development, the scale of the current Internet has become very large, and in particular, the Web business, one of the main Internet businesses, has developed rapidly, which has brought great convenience to people in obtaining information. At the same time, the security status of those Web sites that provide people with Web services is worrying. The most common security problem is that the web pages of the Web sites are linked by hackers. At present, more than 90% of Trojan horses and viruses are spread using horse-hanging web pages. Early web page hanging horses were implemented by directly embedding IFRAME or Object objects in the web page. For example, hackers directly embedded the following code on the home page of the victim website www.abc.com: [0003] <iframe sr...

AI Technical Summary

Problems solved by technology

The main deficiencies in the honeypot-based webpage Trojan detection method are: 1) the honeypot inspection method is more dependent on the honeypot environment, and it cannot detect those webpage Trojans that do not meet the attack conditions. For example, InternetExplorer is used as a browser The honeypot of the browser cannot detect those webpage Trojan horses aimed at Mozilla browser vulnerabilities; 2) the honeypot detection method is a kind of active webpage Trojan detection method, which cannot realize the real-time detection of webpage Trojans; 3) Honeypot The detection method requires high computing resources and cannot be implemented on the web security gateway

[0015] The advantage of the web page hanging horse detection method based on the Web security gateway is that it is easy to implement, and the disadvantage is: due to the limitation of the computing power of the Web security gateway, the current Web security gateway does not provide the ability to explain and execute client scripts (such as Javascript or VBScript), so , the web security gateway cannot extract the malicious URLs generated by client-side scripts, so it cannot detect those web-mounted horse-mounted behaviors that use client-side scripts to mount webpages

Images