A malicious URL detection method and device

Abstract

The embodiment of the invention provides a malicious URL detection method and device. The method comprises the following steps: reading and analyzing log data to be detected to obtain a URL to be detected; if it is determined that the URL to be detected is not on a preconfigured blacklist or a preconfigured whitelist, carrying out matching between a hash value of the URL to be detected and hash values in a mapping table; if it is determined that the hash value of the URL to be detected is not in the mapping table, or a warning type corresponding to the URL to be detected is an unknown type, carrying out malicious URL detection on the log data to be detected corresponding to the URL to be detected through the sandbox technology to obtain a detection result; and locally generating a corresponding asset table and a corresponding warning table. The device is used for implementing the method. The method and device provided by the embodiment of the invention has the advantages that when it is determined that the URL to be detected is not on the blacklist or the whitelist, the matching with the mapping table is carried out, and the detection is carried out through the sandbox technology to obtain the detection result, so that the detection efficiency and accuracy are improved.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of information security, and in particular, to a malicious URL detection method and device. Background technique [0002] The Internet has enriched people's lives, but more and more pornographic, fraudulent and phishing websites are also emerging one after another, which seriously threatens the safety of Internet users obtaining information online. Therefore, a detection engine for identifying malicious URLs is needed. [0003] The existing URL cloud detection engine can identify and prompt whether the URL (Uniform / UniversalResource Locator, Uniform Resource Locator) accessed by the user has malicious characteristics. After the user enters the URL to be accessed and before the browser displays the page content, the URL cloud detection engine needs to go to the cloud detection center to obtain the malicious attributes of the URL accessed by the user, identify it, and give relevant pr...

AI Technical Summary

Problems solved by technology

This detection method has the problem of low accuracy. Therefore, how to improve the detection accuracy while ensuring the detection efficiency is an urgent problem to be solved today.

Images