An Automatic Judgment Method for Malicious Jump and Malicious Nested Bad Websites

Abstract

The present invention proposes a method for automatically judging maliciously redirected and maliciously nested bad websites, including: 1) building a blacklist of domain names; 2) building a recursive server, and performing recursive analysis when a website to be judged initiates a domain name query request , and at the same time enable the query log recording function to record the domain name query request initiated by the website to be determined; 3) use the server to simulate the browser access behavior, and conduct polling access to the website to be determined; 4) analyze the query log of the recursive server to form a Screened domain name list; 5) Screen each domain name in the domain name list to form a list of suspected abused domain names; 6) Compare the list of suspected abused domain names with the blacklist of domain names to determine whether the website to be determined is a malicious website. Based on domain name resolution, by simulating browser access behavior, capture the domain name query sets of the above two types of websites, and finally realize the judgment of the two types of websites through the blacklist matching mechanism.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an automatic determination method for malicious redirection and malicious nesting bad websites. Background technique [0002] The Domain Name System (DNS for short) is a core service of the Internet. As a distributed database that maps domain names and IP addresses to each other, it is the entrance for users to access network resources. Because of its intuition and convenience, it facilitates people's access to network resources, but at the same time, it also produces a large number of domain name abuse phenomena, including phishing, pornographic, gambling and other bad websites, botnets, etc., resulting in the leakage of user information and The loss of property has brought serious adverse effects on the social atmosphere. [0003] With the implementation of real-name authentication for some top-level domains (such as .CN domain names) and the strengthening of efforts ...

AI Technical Summary

Problems solved by technology

[0006] It can be seen that for bad websites with malicious jumps and malicious nesting, traditional identification methods, including statistical learning based on information such as text and links, and detection based on image recognition, have failed.

Images