Malicious URL detection intervention method, system and apparatus

Abstract

The invention discloses a malicious URL detection intervention system. The system comprises a DNS proxy device, a credit evaluation device and a traffic intervention device, wherein the DNS proxy device is suitable for receiving a domain name resolution request, requesting a domain name credit evaluation device for the credit of a domain name, and returning back an IP address of the traffic intervention device to a user if the credit indicates that the domain name has security risks; the credit evaluation device comprises a domain name credit library, and is suitable for returning back the credit of the domain name in response to the request of the credit of the domain name; and the traffic intervention device is suitable for receiving an access request from the user and performing protocol identification for the access request, and is also suitable for extracting a URL from the access request which is identified as a request of a HTTP or HTTPS protocol, matching the URL with a malicious RUL library, and if matching is failed, being used as a reverse proxy to realize communication of the user and a destination server. The invention also discloses a corresponding domain name credit determining apparatus, a corresponding domain name credit library establishing apparatus and methods.

Description

technical field [0001] The invention relates to the technical field of computer communication, in particular to a malicious URL detection intervention method, system and device. Background technique [0002] With the rapid development of network communication technology, the continuous deepening of Internet applications, and the increasingly rich information carried, the Internet has become an important infrastructure of human society. At the same time, network security problems are becoming more and more serious. In particular, with the continuous development of mobile data services and online payment, personal information is bound to mobile terminals, and telecommunications fraud is becoming more and more serious. Therefore, it is imperative to perform targeted detection of mobile Internet malicious URLs and malware. [0003] At present, most users choose to install security detection software on the terminal side to defend against malicious URLs and malware, such as the c...

AI Technical Summary

Problems solved by technology

However, this solution depends on the user's own security awareness, and needs to install relevant software on the mobile terminal, occupying terminal resources; in addition, because the number of URLs accessed by end users is uncontrollable and there are a lot of repetitions, and the terminal detection program cannot occupy mobile terminal resources. System resources screen it, so these data cannot be used to drive the update of the cloud malicious URL library, and eventually there are still a large number of malicious URLs that are not in the library

Images