Domain name credibility evaluation method and system

Abstract

The embodiment of the invention provides a domain name credibility evaluation method and system for improving the accuracy rate of the network safety detection. The method provided by the embodiment of the invention comprises the following steps: collecting website content information corresponding to a to-be-detected target domain name from the internet; inputting the website content informationin a preset classifier model to perform the domain name classification, and determining a first credibility value corresponding to the target domain name according to a classification result; performing multi-dimension matching on the target domain name and the network safety threat information stored in a database, and outputting a second credibility value corresponding to the target domain nameaccording to a matching result; and computing the credibility corresponding to the target domain name according to the first credibility value and the second credibility value.

Description

technical field [0001] The invention relates to the field of network security, in particular to a domain name reputation evaluation method and system. Background technique [0002] With the rapid development of Internet technology, a large number of malicious attacks have appeared in the network. Attackers use physical devices and resources obtained on the network to carry out malicious attacks on the network, such as performing automatic update downloads of botnets, automatic update downloads of malicious code, phishing, using automated network scanners, or automatic spam emails. Sending, etc. In existing solutions, the detection of malicious attacks is often based on the domain name used by the attacker, and the evaluation of the reputation of the domain name is helpful to identify malicious attacks. [0003] In existing schemes, the reputation evaluation of domain names often uses Uniform Resource Locators (URLs) or IP addresses to resolve their corresponding domain name...

AI Technical Summary

Problems solved by technology

[0004] However, attackers will evade the detection of antivirus software by constantly changing the URL or updating the domain name, which reduces the detection rate of malicious behavior. Secondly, the behavior characteristics of malicious attacks are often multi-dimensional, based on a single domain name Dimensional information detects network behavior, and there is a risk of false detection

Images