Malicious website identification method and device

Abstract

The invention discloses a malicious website identification method and device, and relates to the technical field of network security. A specific embodiment of the method comprises the steps of extracting a URL address and page content of a to-be-identified website, and querying a URL classification library according to the URL address to obtain corresponding first website classification information; wherein the URL classification library stores a mapping relationship between a URL address sample and website classification information, and the first website classification information is determined from the website classification information; matching the page content with a pre-created content identification template, and determining second website classification information corresponding to the content identification template matched with the page content; and comparing whether the first website classification information is the same as the second website classification information ornot, and when the first website classification information is different from the second website classification information, judging that the to-be-identified website is a malicious website. Accordingto the embodiment, the malicious website can be identified before the URL address of the to-be-identified website is recorded, so that the identification speed and the identification rate of the malicious website are improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for identifying a malicious website. Background technique [0002] Malicious websites are illegal websites with viruses, worms and Trojan horses that intentionally perform malicious tasks on a computer system. This type of website is usually in the form of a certain web page, allowing people to browse the content of the page normally, and at the same time illegally obtain various data in the computer. With the popularization and development of Internet applications, the number of attacks from malicious websites has increased significantly, and the losses caused have become increasingly serious. It has become a major threat to current network security. How to accurately identify malicious websites has become a research hotspot in network security. [0003] For the identification of malicious websites, at present, it is generally based on the maliciou...

AI Technical Summary

Problems solved by technology

[0005] Malicious websites that have not been included in the evil chain database cannot be identified. Relevant threats need to be updated after the evil chain database is updated. The recognition speed is slow and the recognition rate is low.

Images