A detection method and device for malicious detection behavior

Abstract

The embodiment of the invention discloses a method and a device for detecting a malicious detection behavior, which can improve the detection result of the malicious detection behavior. In the method,a detection behavior set sent to a network server by a client is obtained; it is judged whether each to-be-detected uniform resource locator URL is the same as a non-malicious URL portrait in a non-malicious URL portrait set, respectively; if the to-be-detected URL is the same as the non-malicious URL portrait in the non-malicious URL portrait set, it is determined that offset does not exist in the to-be-detected URL and the non-malicious URL portrait set; the number of the to-be-detected URLs which with the non-malicious URL portrait set are offset is subjected to summation calculation, andthe total offset amount of the client within a detection period of time is obtained; and when the total offset amount exceeds an offset threshold, the client is determined to execute the malicious detection behavior.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a detection method and device for malicious detection behavior. Background technique [0002] With the rapid development of Internet technology, users' operations on the Internet will become more and more frequent. At the same time, some malicious elements develop automatic access programs to perform malicious acts on the Internet, such as cracking the password Identification of spam and property theft, etc., so it is necessary to effectively detect malicious behavior. [0003] At present, network (web) scanning detection is a common method for hackers to further intrude after entering the intranet. For example, obtain the Uniform Resource Locator (Uniform Resource Locator, URL) resource tree through crawlers, or detect that the management background of the network server is a hacker The common method of stepping on the site, the current method of detecting malicious detection...

AI Technical Summary

Problems solved by technology

Among them, malicious detection behaviors are often used in various fraudulent, counterfeiting, phishing or hanging horse webpages. When users accidentally access such webpages, it may cause economic losses to users, leakage of personal privacy information, or infection of current computers. Adverse effects such as Trojan horse virus

[0004] In the prior art, the detection of malicious detection behavior mainly depends on the statistics of the total number of visits to the destination URL and the judgment of the threshold. Access requests are also mixed with malicious detection behavior, which can cause a large number of false positives

If the threshold is set too small, a large number of false positives will be generated. If the threshold is set too large, malicious detection behaviors cannot be effectively detected. Therefore, the detection scheme of malicious detection behaviors provided by the prior art has the problem of poor detection effect.

Images