A malicious script detection method and related device

Abstract

The invention discloses a malicious script detection method, comprising: extracting HTTP traffic to be transmitted to a target host, and determining the script to be detected in the HTTP traffic; calculating the relationship between the content of the script to be detected and preset malicious features similarity; wherein the preset malicious feature is a malicious feature obtained by feature extraction of pre-collected malicious scripts; using the similarity to determine the detection result of the script to be detected. This makes it possible to detect HTTP traffic before it is transmitted to the target host. In addition, by calculating the similarity between the content of the script to be detected and the preset malicious features, the detection result of the script to be detected can be determined, thereby effectively avoiding the use of normal source addresses to send malicious scripts, and making the detection result more accurate. The present application also provides a malicious script detection system, device, and computer-readable storage medium, which can also achieve the above-mentioned technical effects.

Description

technical field [0001] The present invention relates to the field of information security, and more specifically, to a malicious script detection method, system, device and computer-readable storage medium. Background technique [0002] At present, security incidents are becoming more and more common, and new attack methods are emerging one after another. Therefore, an effective security detection method is a basic requirement in the information field. Existing security detection methods usually install virus scanning and killing software locally to detect malicious programs and files that have been stored locally. [0003] Such as phishing emails, malicious links and other attack methods, after the user triggers the email attachment or clicks on the malicious link, some executable malicious script files will be transmitted. The script files include executable commands. When the script files are transmitted to After the target host is installed, the executable commands in i...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to provide a malicious script detection method, system, device and computer-readable storage medium to solve the problem in the prior art that effective detection cannot be made before the malicious script file reaches the target host

Images