Suspicious event detection method and system based on URL heterogeneity

Abstract

The invention discloses a suspicious event detection method and system based on URL heterogeneity. The method includes the steps of firstly, capturing network data packets in the user sending direction; secondly, analyzing the network data packets, and extracting URLs in the network data packets; thirdly, judging whether the URLs are highly-suspicious events or not based on the detection rule in a knowledge base, conducting deep detection if the URLs are highly-suspicious events, and otherwise, conducting detection through a preset detection scheme; fourthly, adding or deleting the detection rule as required, judging whether server ports required by the URLs are system reserved ports or not, judging the URLs to be security events if the server ports required by the URLs are the system reserved ports, and judging the URLs to be the highly-suspicious events if the server ports required by the URLs are not the system reserved ports; fifthly, judging whether domain names of the URLs are meaningful words or not, judging the URLs to be security events if the domain names of the URLs are meaningful words, and judging the URLs to be the highly-suspicious events if the domain names of the URLs are not meaningful words. The suspicious event detection method and system solve the problem that a traditional detection method has an effect on known malicious URLs and has no effect on unknown or non-captured URLs.

Description

Technical field [0001] The invention relates to the technical field of network security, in particular to a suspicious event detection method and system based on URL heterogeneity. Background technique [0002] The web browser used to browse websites has evolved from displaying content to an environment where distributed applications can be executed. In order to better display the various functions of the website, the browser has changed from its original static role to an operating system that can dynamically run client programs, and it also brings greater security risks to users. [0003] Traditional detection methods for malicious programs are mostly based on signatures. The method for URL detection is to match known captured malicious URLs. However, this method is basically invalid for unknown malicious URLs, and its response speed is also far Behind the speed of malicious program development and conversion. Summary of the invention [0004] In view of the above technical prob...

AI Technical Summary

Problems solved by technology

In order to better display the various functions of the website, the browser has changed from the original static role to an operating system that can dynamically run client programs, and it has also brought greater security risks to users.

[0003] Traditional malicious program detection methods are mostly based on feature codes. The method of URL detection is to match known and captured malicious URLs. However, this method is basically ineffective for unknown malicious URLs, and its response speed is far behind. Lag behind the speed of malicious program development and transformation

Images