Web page script identification method and apparatus

Abstract

The invention discloses a web page script identification method which comprises the following steps of: according to a common system command, a common data command and a script language function, generating a sensitive parameter feature library; carrying out deep protocol analysis on a web page traffic, and extracting command parameters; carrying out similarity analysis on the extracted command parameters and the sensitive parameter feature library by utilizing a vector-space algorithm; and comparing similarity analysis results with a threshold, recording parameter information of which the similarity analysis results are greater than the threshold into the sensitive parameter feature library, marking the information as blacklists, and simultaneously updating the sensitive parameter feature library. The web page script identification method has the beneficial effects that by the steps of generation of a basic library and a knowledge base, data analysis of deep protocol analysis, similarity analysis, data processing and the like and through deep protocol analysis, excellent real-time performance is achieved, and the web page script identification method can be applied to various places. Meanwhile, by information accumulation, accuracy of web page trojan identification is also improved.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and device for identifying web page scripts. Background technique [0002] Network traffic anomalies refer to significant changes in network traffic irregularities, such as local events such as transient network congestion, distributed denial of service attacks (DDoS, Distributed Denial of Service), large-scale scanning, or global events such as network routing anomalies. The monitoring and analysis of network traffic anomalies is very important for network security emergency response departments. However, due to the difficulty of macro-traffic anomaly monitoring, it is necessary to extract and explain abnormal patterns from a large number of high-dimensional and noisy data. Monitoring and analysis remains a great challenge. [0003] Aiming at the problems in the related technologies, no effective solution has been proposed yet. Contents of the invention [00...

AI Technical Summary

Problems solved by technology

The monitoring and analysis of network traffic anomalies is very important for network security emergency response departments. However, due to the difficulty of macro-traffic anomaly monitoring, it is necessary to extract and explain abnormal patterns from a large number of high-dimensional and noisy data. Monitoring and analysis remain a great challenge

Images