Researchand Implementation Of Detection Modelof Webpage Defacements

With the development of Internet, more and more governments, schools, enterprises and institutions carry out the online business by websites. However, Because of the lack of effective tamper detection measures, there are a lot of websites been defaced and many websites go unnoticed for a long time after being defaced, which not only ruin the reputation of the website owner, but also hinder business smoothly, even threaten national security. Therefore, to detect defacements becomes very important in the field of web security.Nowadays, there are mainly two kinds of defacements detection technologys in the safety monitoring system. One is local detection and the other is remote detection. Local detection need to deploy detection program on website servers, although its results are accurate, but it is not suitable for large-scale testing. Remote detection rely on web crawler, and its deployment is simple, which is suitable for large scale monitor system. But it fails to monitor dynamic websites and has high rate of false positives, since it can’t effectively distinguish between normal page change and abnormal defacement. Therefore, in order to improve detection system of intelligent analysis, this paper designed and realized a webpage defacements detection model based on page variation characteristics. The main work includes four aspects:Firstly, this paper designed a representation method of webpage structure based on Xpath expression, which solved the problems of store of webpage structure.Secondly, on the basis of webpage structure representation method, this paper designed web structure difference algorithm and changed elements merging algorithm, which solved the recognition problem of webpage change.Thirdly, this paper introduced page variation characteristics to the detection and analysis of the webpage defacements, and designed a tamper detection mechanism based on page variation characteristics.The mechanism can effectively reduce the rate of false positives, and support to set the alarm level of web page defacements.Finally, based on block selection technology, this paper designed an extraction method of page variation characteristics, which supports users to set page variation characteristics from the semantic perspective.Experimental results show that the detection system can eliminate invalid tamper alarms on areas updated by scripts, thereby reducing the rate of false positives. Besides, it can better support users to deal with the webpage defacements by setting the alarm level.