Device, method and system for detecting spamming links

Abstract

The invention discloses a device, a method and a system for detecting spamming links. The device comprises a second behavior detector, a second obtainer and a second link detector, wherein, the second behavior detector is configured for detecting suspicious behaviors on network resources, and transmitting detected suspicious behaviors to a server device for further detection, the second obtainer is configured for obtaining a dangerous spamming website host name collection and a dangerous spamming link collection which are determined by the server device on the basis of the suspicious links provided by the second behavior detector, the second link detector is configured for detecting new suspicious links according to the dangerous spamming website host name collection and the dangerous spamming link collection which are obtained by the second obtainer, and transmitting the new suspicious links to the server device to detect and renew relevant spamming values, and other links embedded in the new suspicious links hit the dangerous spamming website host name collection or the dangerous spamming link collection.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security management device, detection device, method and system for detecting malicious links. Background technique [0002] With the development of the Internet, the attack methods of various computer malicious programs are becoming more and more endless. For example, there are various methods of attacking malicious programs like hanging horses, such as SQL (StructuredQuery Language) injection, website sensitive file scanning, server vulnerabilities, website program 0day and other methods to obtain the website administrator account, Then log in to the background of the website, and obtain a webshell (script attack tool for web intrusion) through database backup / restore or uploading vulnerabilities. Use the obtained webshell to modify the content of the website page, and add malicious redirection code to the page. It is also possible to directly obtain the se...

AI Technical Summary

Problems solved by technology

For this detection system based on client-side detection, because the malicious attack code embedded in the hacker can stop at any time, it is often impossible to detect malicious behavior, and it is impossible to return the attacked URL to the server-side detection system. The detection method is relatively passive

Therefore, this solution cannot quickly discover and detect as many websites that hang horses as possible, and also cannot detect as many websites that hang horses as possible.

Images