Malicious URL detecting method based on big data

Abstract

The invention provides a malicious URL detecting method based on big data. The method comprises the steps of extracting a profile feature, a semantic feature, a user behavior feature and a network feature of a URL; generating a classification model and an abnormity detecting model according to the profile feature, the semantic feature and partial user behavior feature of the URL; extracting the profile feature, the semantic feature and the partial user behavior feature of the URL from an Internet access log, performing detection on the features for generating a suspicious URL; extracting partial user behavior feature and the URL network feature, performing detection on the partial user behavior feature and the URL network feature, and generating the suspicious URL; performing combination,threshold determining and duplicate removing on the suspicious URLs generated in the two steps, and finally obtaining a final malicious URL. The method according to the invention has higher reliability than a single algorithm. A two-stage model system is combined with a classifying algorithm model and an abnormity detecting algorithm model so that higher accuracy of a malicious URL detecting result is realized. High openness is realized. Furthermore the algorithm can be flexibly added according to the trend change and technical development condition of the malicious URL.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a method for detecting malicious URLs based on big data. Background technique [0002] In the field of network information security, it is often necessary to detect and report suspected malicious URLs (uniform resource locators) in online logs on the live network. At present, the detection of suspected malicious URLs mainly has the following problems: (1) It does not realize the detection of the entire network Statistical analysis of URLs only uploads relevant malicious URLs to the upper-level platform based on policies, and the source of malicious URL samples is too single; (2) In the face of massive data, the analysis speed of the traditional crawling research and judgment method is slow, and it is impossible to achieve effective analysis of the entire network log. To achieve the ideal governance effect; (3) The existing URL database does not have the abili...

AI Technical Summary

Problems solved by technology

[0015] The present invention proposes a method for detecting malicious URLs based on big data, which solves the problem in the prior art that accurate and in-depth detection of malicious URLs in massive online data cannot be realized

Images