Abstract: The traditional methods of website remote monitoring are limited to static webpages. A rule-based classifier for dynamic webpage was proposed. The method took the website partial changes into consideration, and divided the websites into the dynamic regions and the static regions according to the dynamic updates of the historical pages, and then calculated thresholds based on the historical features for dynamic regions and built history database of MD5 based on blocks for the static regions. Finally, it decided whether to send alarms according to the defined IF-THEN rules. The test results show that the model can scan the whole website in shorter time, get lower false detection rate for normal pages and higher detection rate for distorted pages.

Key words: Web defacement, website monitoring, defacement detection, IF-THEN rule, domain knowledge

摘要： 针对传统的网页远程监控方式局限于静态网页的问题，本文提出一种适用于动态网页的基于规则的分类模型。该模型考虑到网页的局部变化性，首先根据历史页面的动态更新，划分网页的动态区域和静态区域；其次，对动态区域，根据历史特征计算相关阀值,对静态区域建立分块的MD5历史库;最后，根据定义的IF-THEN规则决定是否发送警报。实验表明，该模型能在更短时间内完成全站检测，对正常页面的误报率较低，对异常页面的检测率较高。

关键词: 网页篡改, 网站监测, 篡改检测, IF-THEN规则, 领域知识