Malicious website detection method and device

Abstract

The invention discloses a malicious site detection method and device. The malicious site detection method comprises the steps of: acquiring a URL (Uniform Resource Locator) to be accessed; capturing a page pointed by the URL; carrying out static characteristic analysis on the data of the captured page; and if the static characteristic analysis shows that dangerous characteristics exist, carrying out dynamic behavior analysis in a Honeynet cluster. The malicious site detection device comprises an acquiring device used for acquiring the URL to be accessed, a capturing unit used for capturing the page pointed by the URL, a static analyzing unit used for carrying out static characteristic analysis on the data of the captured page, and a dynamic analyzing unit used for carrying out dynamic behavior analysis in the Honeynet cluster if the static analyzing unit shows that the dangerous characteristics exist. By adopting the technical scheme of the invention, complete website security detection can be carried out.

Description

technical field [0001] The present invention generally relates to computer network security, in particular to a malicious website detection method and device. Background technique [0002] With the development of computer and network technology, the Internet has penetrated into all aspects of people's work and life. But the security problems that follow have greatly troubled network users. There are more and more malicious acts against the Internet, which are gradually refined and form a huge black industry chain. The current overall security situation on the Internet is worrying. Among the malicious behaviors against the Internet, hanging horses on websites is one of the main malicious behaviors. The website hanging horse means that the source code content (including HTML, CSS, JS) of the website itself is embedded with malicious script codes by hackers. The strategy was breached, and Trojan horse virus programs were installed on the computers of netizens. [0003] At ...

AI Technical Summary

Problems solved by technology

For malicious codes embedded in popular malicious websites, static feature matching technology can be used to quickly detect, but this method often has the problem of decreased accuracy due to lack of timeliness, so we need to develop a combination of In addition to static features, it can also detect unknown Trojan page technology

Images