Malicious message recognition method, device and equipment and computer storage medium

Abstract

The invention provides a malicious message recognition method, device and equipment and a computer storage medium. The method comprises steps of acquiring a to-be-recognized message; acquiring target features of the to-be-recognized message, wherein the target features at least comprise a message sender feature, a message receiver feature, a message content feature and a message spreading feature; and inputting the acquired target features into a preset malicious message recognition model, and using the malicious message recognition model to recognize whether the to-be-recognized message is a malicious message. According to the embodiment of the invention, rapid recognition of the malicious message can be achieved without depending on the fact whether the linkage in the message content is accessible and survives, or on a Trojan recognition result provided by a Trojan detection engine and without the need of access to an attacker server end, and the recognition efficiency is quite high.

Description

technical field [0001] The present application relates to the technical field of the Internet, and in particular to a malicious message identification method, device, equipment and computer storage medium. Background technique [0002] With the rapid development of Internet technology, the invention of various communication systems has greatly facilitated the mutual communication between users. Users can use electronic equipment to establish a communication network connection, and can transmit communication messages including text, images, voice or video, etc. [0003] However, the ensuing malicious messages are also rapidly flooding, and a large number of malicious messages have brought troubles to users. For example, malicious messages often carry the contact information of criminals to induce users to visit a certain phishing link to contact criminals, query illegal information, download Trojan horses or transfer money. [0004] At present, more and more service provide...

AI Technical Summary

Problems solved by technology

[0005] However, there may be problems with this solution: the link in the malicious message may become invalid within a short time after spreading, and the server may not be able to obtain the corresponding information after the invalidation; the link in the malicious message may be based on the visitor's IP information, access Targeted hiding of the device information used by the visitor, the time of the visitor's visit, etc., so that the link is normal when the server accesses it, but when the user accesses the link, it is tricked.

In addition, the corresponding Trojan horse in the malicious link may bypass the existing Trojan horse detection engine by packing, downloading attack code, etc.

Images