Method and device for detecting malicious behavior of webpage

Abstract

The invention provides a method and device for detecting a malicious behavior of a webpage. The method comprises the steps that a browser opens a webpage according to a webpage access request of a user; the browser determines that the webpage has a suspicious behavior, wherein the suspicious behavior includes one or more of popup, skip, camera calling, file access, third-party application pulling,calling and SMS sending; the browser reopens the webpage in a sandbox; and if the webpage opened in the sandbox still has the suspicious behavior, the browser reports that the webpage has a maliciousbehavior to a server. According to the technical scheme of the embodiment of the invention, the malicious behavior is identified according to the replay of the webpage behavior in the sandbox, and the malicious behavior of the webpage can be accurately and efficiently identified.

Description

technical field [0001] The present application relates to the technical field of browser security, and more specifically, to a method and device for detecting malicious webpage behaviors. Background technique [0002] A browser is an application program for retrieving and displaying Internet information resources, which brings many rich experiences to users. However, the authors of some webpages and websites will embed malicious codes in the pages, and these malicious codes will cause the browser to produce behaviors that are not expected by users. For example, when a user visits certain web pages, a pop-up window for downloading software will pop up automatically or the behavior of automatically jumping out of the web page to open other application software. For these malicious behaviors, browsers need to block them both from the perspective of security and user experience. But there are also some web page behaviors such as pop-up windows and jumps that are the active beh...

AI Technical Summary

Problems solved by technology

However, this method needs to analyze the code, and the browser's processing capacity is limited, so it is more difficult to process.

Moreover, the general code has certain precautions, and the recognition model also needs to learn dynamically, which makes the cost of recognition higher

There is also identification through user feedback, but user feedback may contain errors and inaccurate information, which requires a lot of manpower to identify, and the cost is high

Moreover, many webpages not only have entrances manually operated by users, but also have automatic pop-up or jump behaviors, which cannot accurately identify the characteristics of malicious behavior of webpages, and are easy to be intercepted by mistake

Images