Research and analysis of website security detection products [background analysis, product functions, differences between similar products]

Website security detection product introduction

1. The necessity of website security testing

Websites are important windows for enterprises, governments, education, medical and other industries. They carry a large amount of business data and user information and are also the main target of hackers and network attackers. Once a website is attacked or tampered with, it will not only affect the normal operation of the website and user experience, but also cause serious consequences such as data leakage, brand damage, and legal risks.

Therefore, website security detection is a necessary measure to ensure the safe operation of the website. It can help website administrators promptly discover and repair loopholes, weaknesses, anomalies and risks on the website, prevent them from being exploited by hackers, and improve the security performance and credibility of the website.

2. Overview of website security detection products

2.1 Website monitoring service

Website monitoring service is a website security monitoring service based on a cloud platform and a team of security experts. It can provide users with real-time and accurate monitoring of website service quality, security events, security vulnerabilities and other multiple dimensions, helping users to quickly and accurately discover Dark links, black pages, phishing and other website tampering and counterfeiting events, as well as security vulnerabilities and security risks in business systems.

Website monitoring services include the following features:

• Vulnerability Detection: Identify security vulnerabilities in the website, provide proof and give repair suggestions:
  
• Security event monitoring: Analyze the page resources and fingerprint information of the website, and conduct comprehensive analysis and perception of various security events through monitoring technology, including tampering, dark links, and black pages , hanging horses, back doors, etc., and provide targeted security notifications to relevant departments and personnel.

How to detect:
Website security detection products can usually discover and report potential risks and threats by scanning the website's code, configuration, links, etc. Different products may have different detection methods and functions, but generally speaking, you can identify the existence of hidden links and Trojans on web pages through the following methods:

• Detect whether there are hidden iframe tags, script tags, style tags, etc. in the web page. These tags may be used to introduce hidden links or Trojans.

• Detect whether there are abnormal jumps, pop-ups, downloads and other behaviors in the web page. These behaviors may be manifestations of hidden links or malware.

• Detect whether there are links or resources in the webpage that are not part of the normal website content. These links or resources may be the source of hidden links or Trojans.

• Detect whether there is malicious code or content in the web page, which may be a carrier of hidden links or Trojans.

• Detect whether there are links or resources in web pages that have been marked as dangerous or unsafe by search engines. These links or resources may be the targets of hidden links or Trojans.

• Sensitive word monitoring: The cloud monitoring engine combines semantic analysis and cluster analysis to build a machine learning algorithm that can accurately identify sensitive words. Combined with the massive big data sample library accumulated over many years, it can efficiently identify variant sensitive words. Based on the customized model, multi-dimensional user portraits are established to efficiently identify sensitive words such as pornography, politics, violence, terrorism, and spam advertising. It also accepts flexible rule customization, supports custom keywords, and the number of keywords is unlimited.

tamper

Web page tampering refers to an attacker deliberately modifying files transmitted over the network, usually by intruding into the system, hijacking network connections, or inserting data to change the content or appearance of the website. Web page tampering may cause harm to the website's reputation, leakage of user information, and the spread of malware. In order to prevent web page tampering, we can take some of the following measures:

• Regularly back up website data so that it can be restored promptly in the event of tampering.
• Use secure password and permission management, avoid using default accounts and passwords, change passwords regularly, and restrict unnecessary access permissions.
• Install firewalls, anti-virus software and web page anti-tampering systems, update patches and rules in a timely manner, and monitor and intercept abnormal access and modifications.
• Check the code and configuration of the website to avoid vulnerabilities such as SQL injection, file inclusion, cross-site scripting, etc., and use the HTTPS protocol to encrypt data transmission.
• Enhance users' security awareness, do not click on links from unknown sources or download untrusted software, and use browser protection tools to lock the homepage.

Hidden link

Dark links refer to invisible links to other websites illegally implanted by hackers. They are usually used to promote illegal goods or services, such as gambling, pornography, drugs, etc., to improve the search engine rankings and traffic of these websites. There are roughly two ways to implant dark links: one is implanted in the application by web application developers, and the other is implanted after hackers invade the website. There are many methods of implanting dark links, and the common ones are as follows:

• Use the display attribute to hide content on the page;
• Use the color attribute to set the font background to the same color as the web page to make it visually invisible;
• Use attributes such as position to set the position of the dark link so that the content of the dark link is outside the visible range of the browser;
• Use iframe tags to embed pages on other websites, and set the width and height to 0 or very small;
• Use comment symbols to wrap dark links so that they do not appear on the page;
• Use JavaScript code to dynamically generate dark links and set their styles to be invisible or very small;
• Use CSS pseudo-element :before or :after to insert dark link content before and after the element, and set its style to be invisible or very small;
• Use the marquee tag to create scrolling text and set its speed to 0 or very fast so that it is not noticed;
• Use the attribute values ​​of title, meta and other tags to insert dark links, and set their content to be irrelevant or blank;
• Cloaking technology is used to present different content based on the visitor's User-Agent, Referer, IP address and other information, so that what the search engine sees is different from what the user sees;

The harm of dark links to websites mainly includes the following points:

• Reduce the credibility and weight of the website, affecting search engine rankings and traffic;
• Violating search engine rules and laws and regulations may result in the website being punished or banned;
• Occupy website resources and bandwidth, affecting website performance and speed;
• Increase the security risk of the website, which may lead to further attacks on the website or leakage of user information;

black pages

Black pages refer to the successful hacking pages left on the website after a successful hacker attack, used to show off the results of the attack. Black pages usually contain information such as the hacker's nickname, logo, slogan, contact information, and sometimes mock the security of the website or promote the hacker's ideas. The appearance of black pages will affect the normal operation of the website and user access, and will also damage the credibility and image of the website. Therefore, website administrators should promptly discover and remove black pages and strengthen website security protection.

• Website availability monitoring:
  
  For key websites with high real-time requirements, distributed nodes are used for data monitoring (similar to the picture above). In the form of multi-link and multi-point monitoring, we can discover the multi-line access availability of website systems in different regions. Real-time monitoring of website service quality provides domain name resolution availability, website service availability, and website content availability monitoring of the target site, enabling a more comprehensive and real-time understanding of website availability status.
• 24-hour security expert on duty: The security expert team provides 7*24-hour security on duty and emergency response services. If major security incidents such as availability and tampering are discovered during the monitoring period, the security expert team will respond immediately, verify the incident and assess the risk and impact scope, and assist users in emergency response to make security risks knowable, manageable and controllable. , reduce adverse effects and losses.

Security experts will respond to emergencies as soon as possible, verify the event and assess the risk and scope of impact, assist users in emergency response, make security risks knowable, manageable and controllable, and reduce adverse effects and losses.

3. Functional features of website security detection products

Website security detection products have the following features:

• Zero deployment, zero operation and maintenance: There is no need to deploy any hardware equipment locally, it does not occupy computer room resources, and it provides nanny-style hosting services, truly realizing zero deployment and zero operation and maintenance. (Generally, you only need to provide the domain name, vulnerability scanning requires authorization)
• Zero false positives: Using cloud + machine learning methods to accurately detect security incidents such as vulnerabilities, phishing, hidden links, and tampering, avoiding false positives while significantly reducing manual labor The verification workload is reduced and the processing efficiency is accelerated.
• Powerful big data scanning capabilities: The self-designed and developed Sumap fast scanning engine for the entire network can scan 4 billion IP addresses across the entire network within 24 hours. Perform big data analysis and vulnerability detection on network-wide data.
• Intelligence Sharing: Protect potential attacks through threat intelligence sharing technology.
• Efficient intelligence: Machine learning is used to perform semantic analysis on injection and cross-site attacks, which greatly reduces the false positive rate and improves detection and protection efficiency.

4. Functional features, advantages and disadvantages of other similar products on the market

A brief description of website security detection products on the market, such as:

• Baidu Website Security Center: Baidu Website Security Center is a website security detection product provided by Baidu. This product will detect malicious code, phishing, fraud, illegality and other security risks on the website. detection, and provide safety scores and safety recommendations.
• Huawei Cloud Vulnerability Scanning Service: Huawei Cloud Vulnerability Scanning Service is a website security detection product provided by Huawei Cloud. This product can detect websites, hosts, mobile applications, software packages/firmware Perform vulnerability scanning and support multiple services such as general vulnerability detection, vulnerability life cycle management, and custom scanning.
• 360 Yuntan Security Monitoring System: 360 Yuntan Security Monitoring System is a website security detection product provided by 360 Company. This product relies on 360 Security Brain, as well as 360’s search, The massive data accumulated in terminal security, website security and other aspects can effectively monitor website anomalies, continuously explore website risks, fully warn of various website security incidents, and provide users with website vulnerability scanning, web page tampering monitoring, web page Trojan monitoring, and black words /Security cloud monitoring services such as dark link monitoring, availability monitoring, counterfeit/phishing website monitoring, and unknown asset monitoring.

These website security detection products have the following advantages and disadvantages:

• Advantages: These products have their own features and advantages. For example, Baidu Website Security Center is supported by the huge data of Baidu search engine, and Huawei Cloud Vulnerability Scanning Service is supported by Huawei Cloud Platform. With strong resources and technical support, 360 Cloud Exploration Security Monitoring System has 360’s rich experience and professional team in the field of network security.
• Disadvantages: These products also have some shortcomings. For example, Baidu URL Security Center can only detect a single URL and cannot scan the entire domain name or IP; Huawei Cloud Vulnerability Scan The service can only scan assets within Huawei Cloud and cannot scan external assets; the 360 ​​Cloud Exploration Security Monitoring System can only provide monitoring services but not protection services.

5. Summary

The website security detection product is a website security monitoring and protection service based on a cloud platform and a team of security experts. It can help users promptly discover and repair loopholes, weaknesses, anomalies and risks on the website, prevent them from being exploited by hackers, and improve the security of the website. Performance and reliability. It has features such as zero deployment, zero operation and maintenance, zero false alarms, powerful big data scanning capabilities, and convenient management, as well as advantages such as energy saving, performance, stability, space, and environmental protection. It also has some disadvantages, such as cost, compatibility, security, etc. that need to be considered. There are some other website security detection products on the market. They also have their own features and advantages, but they also have some shortcomings. Users can choose appropriate website security detection products based on their needs and budget.