Method and system for detecting large-scale malicious web pages

Abstract

The invention discloses a method and a system for detecting large-scale malicious web pages by using a three-layer parallel architecture and a layered control guarantee method: in the first layer, a plurality of detection servers interconnected via networks are arranged in parallel, so as to construct a detection server cluster, and a task set to be analyzed is set up on one detection server; in the second layer, a plurality of analysis nodes are arranged in parallel in each detection server, and a node cluster monitoring module is arranged so as to monitor and analyze the operating condition of the nodes; and in the third layer, a sandbox environment is constructed in parallel in each analysis node, so as to achieve the paralleled detection of the task to be analyzed. The architecture of the invention ensures the mutual independence and self-maintenance among the detection servers and among the analysis nodes, the overall operation of the system is free from the dynamic expansion of physical hosts and node numbers, and the overall function thereof is not affected by the invalidity of the single analysis node; and various tasks can be detected in a multi-channel and paralleled manner at the same time in the same node, thereby improving the analysis efficiency of the system.

Description

technical field [0001] The invention belongs to the field of computer security, and proposes a large-scale malicious webpage detection method and system, adopts a three-layer parallel architecture and a strategy for layered monitoring and security, and uses virtual host technology and parallel sandbox technology in combination to build a large-scale continuous operation automation Analyze the environment and dynamically detect network Trojan threats contained in web pages. Background technique [0002] At present, the Internet has become an important way to spread malicious programs. According to the "Statistical Report on Internet Development in China" issued by China Internet Network Information Center (CNNIC) in January 2008, the number of Internet users in my country has exceeded 200 million, and Internet users will increasingly rely on the World Wide Web in their daily lives. At the same time, my country's Internet resources are also growing rapidly, and the annual gro...

AI Technical Summary

Problems solved by technology

Through traditional deployment, a virtual host node implements a sandbox environment, and only a single task can be run at the same time, the analysis efficiency is low, and no clear guarantee measures are provided to ensure the continuous operation of the system

Images