Method, terminal and server for detecting phishing attack

Abstract

The embodiment of the invention provides a method and a device for detecting a phishing attack. The method comprises the following steps of recording the occurrence time of a communication application operating event and the occurrence time of a new self-starting item event of an operating system by a terminal; computing the time difference between the occurrence time of the new self-starting item event and the occurrence time of the communication application operating event; judging that the communication application operating event is a phishing attack event if the communication application operating event occurs before the new self-starting item event and the time difference between the occurrence time of the communication application operating event and the occurrence time of the new self-starting item event is smaller than a preset time threshold value. According to the scheme, computation and judgment are performed by using the occurrence time dimensions of the communication application operating event and the self-starting item event of the operating system, and therefore, the phishing attack can be comprehensively detected, the detecting coverage is high, the computation complexity is low, and maintenance and optimization are easy.

Description

Technical field [0001] The invention relates to the field of computer security, in particular to a method, terminal and server for detecting phishing attacks. Background technique [0002] Phishing attack refers to an electronic attack method in which the attacker defrauds the trust of the attacked person in electronic communication with the attacked person (commonly such as emails, instant messages, etc.), thereby obtaining the attacked person’s private information, a common one. Called a phishing link attack, the attacker will place a link to download malware in the content. After being induced to click on the link, the attacked will download the malware to the attacked client’s client and run it, and then the malware will pass Add self-start items to achieve long-term survival. The attacker communicates with the malware remotely to collect the local private information of the attacked. [0003] At present, the technology used to detect phishing attacks is generally based on th...

AI Technical Summary

Problems solved by technology

However, with the development of computer technology, new phishing links emerge in an endless stream. This detection method based on feature analysis is difficult to guarantee coverage and the detection effect is not good.

Images