Real-time malicious webpage identification method and system on gateway

Abstract

The invention discloses a real-time malicious webpage identification method on a gateway, which comprises the following steps of: acquiring the traffic of accessing a webpage by a user, and extractinglightweight malicious webpage classification characteristics from the traffic; constructing a real-time malicious webpage classification model based on the classification features; and deploying themodel to core network equipment to predict whether the webpage is a malicious webpage or not in real time. The invention further discloses a system for identifying the real-time malicious webpage on the gateway. The system comprises a flow acquisition module, a classification model training module and a prediction module. Based on the obvious inclined distribution of the malicious web pages on thecharacteristics, the destination IP address and the source IP address are processed by adopting a point division decimal system, i.e., each IP address byte is used as a classification characteristic,so that the malicious web pages can be quickly identified and filtered on a large gateway in real time.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a method and system for identifying malicious webpages. Background technique [0002] Malicious webpages refer to those webpages that embed malicious codes or contain illegal content in webpages, such as websites that hang horses, phishing websites, adult websites, etc. Web page traffic accounts for 70% of all Internet traffic, and 1 / 3 of the web pages may be unsafe. Criminals may use these malicious webpages to steal user information, forcefully install malicious software, and even defraud money. Malicious webpages make Internet users face a huge risk of becoming victims. Therefore, identifying and filtering malicious webpages is of great significance for network supervision and network quality service management QoS, and at the same time provides a good Internet environment for Internet users. [0003] The traditional identification of malicious web pages is based o...

AI Technical Summary

Problems solved by technology

There is a great security risk when collecting features based on webpage content, because the entire webpage content needs to be downloaded in advance, so malicious code may have been executed

Images