Malicious domain name detection method based on tag and attribute similarity of DOM tree

Abstract

The invention provides a malicious domain name detection method based on tag and attribute similarity of a DOM (Document Object Model) tree, and solves the technical problems of low detection rate andpoor accuracy of an existing malicious domain name detection method. The method comprises the steps of collecting a malicious domain name set, converting the malicious domain name set into a binary string, and storing the binary string in a database; converting the domain name of the unknown type into a binary string; comparing the binary string corresponding to the unknown type domain name withthe binary string of the malicious type domain name set in the database, and judging the maliciousness of the unknown type domain name through the similarity between the binary string and the binary string. The method can be widely applied to a network security system.

Description

technical field [0001] The invention relates to a malicious domain name detection method, in particular to a malicious domain name detection method based on DOM tree label and attribute similarity. Background technique [0002] In recent years, the continuous increase in the number of various malicious domain names has posed a huge threat to the personal privacy, property safety, and even physical and mental health of users. The existence of malicious domain names has seriously hindered the healthy development of the Internet. Although the number of malicious domain names is huge, in reality, malicious domain name registrants will register a large number of different domain names in order to achieve the purpose of low-cost, fast and large-scale generation of malicious domain names, but the webpage structures of these domain names are the same or similar. [0003] At present, the malicious domain name detection method based on the research of the web page corresponding to the...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the technical problems of low detection rate and poor accuracy of existing malicious domain name detection methods, the present invention provides a high-accuracy, high-efficiency malicious domain name detection method based on DOM tree label and attribute similarity

Images