Malicious program publishing detection method, device and medium

Abstract

The embodiment of the present invention discloses a malicious program publishing detection method, device and medium, wherein the method includes: extracting summary information from the HTTP request message used to initiate file download, combining the summary information with the malicious and safe website identification library Match the identification information, if the matching is unsuccessful, use the decision classifier to classify the summary information, if it is determined that the summary information is the summary information for the suspicious malicious website, then generate the download connection information for the suspicious malicious resource of the suspicious malicious website , associating the download connection information of multiple suspicious malicious resources to determine the network release information of the suspicious malicious resources. The method, device and medium of the present invention can better describe the activities of the malicious program distribution network through the network node graph, pay attention to the mechanism of the malicious program distribution network and the attributes of the network infrastructure, and can detect malicious network activities that have not occurred before , thereby increasing the detection rate of malicious programs and improving network security.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a malicious program release detection method, device and medium. Background technique [0002] At present, the general malicious program download attack process can be divided into three stages. In the first stage, that is, the exploit stage, the attacker’s goal is to run a small piece of code on the victim’s host. For this, the attacker first prepares a Websites with downloadable exploit driver code. When the victim visits the malicious page, the browser fetches and executes the driver code. When the attack is successful, it forces the browser to execute the injected shellcode. In the subsequent second phase, the installation phase, the shellcode downloads the actual malware binary and launches it. Once the malware program is running, it exhibits its malicious activity in the third stage, the control phase, where, typically, the malware connects back to a rem...

AI Technical Summary

Problems solved by technology

Attackers make blacklists permanently invalid with rapid changes to malicious domains

Images