A method, device, equipment and storage medium for detecting malicious websites

Abstract

The present application discloses a method for detecting malicious websites, including: after a target web page of a target website is loaded, determining a webpage screenshot of the target web page; determining the content type of the target web page according to the sampling points in the webpage screenshot, and calculating the webpage feature value of the target web page according to the content type; judging whether there is a target feature value in a feature value database determined in advance according to the malicious website, and the target feature value has a similarity with the webpage feature value reaching a preset threshold; if so, determining that the target website is a malicious website. The present method improves the accuracy of detecting malicious websites on the basis of being able to reduce the consumption of human resources. The present application also discloses a malicious website detection device, equipment and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of website detection, and in particular to a method, device, equipment and computer-readable storage medium for detecting malicious websites. Background Art

[0002] With the rapid development of information technology, there are a large number of malicious websites that operate illegally, such as pornography, gambling, fraud, phishing, and content piracy. After the malicious website is shut down, its operator only needs to clone the source code of the malicious website once and change the domain name and server IP to put the website back online.

[0003] In the prior art, the server-side crawler is mainly used to access the target website, obtain the webpage content of the target webpage of the target website, and then identify it through browser rendering based on the webpage content, so as to determine whether the target website is a malicious website. However, when using the server-side crawler to obtain the webpage content, generally only the webpage frame of the target webpage can be obtained, and it is difficult to obtain the substantive content such as text and images in the target webpage, so the judgment of whether the target website is a malicious website is not accurate; and malicious websites are often equipped with technology for resisting server-side crawler access, so technicians need to modify the source code of the server-side crawler according to actual needs, which will cause a great consumption of human resources.

[0004] Therefore, how to improve the accuracy of detecting malicious websites while reducing the consumption of human resources is a technical problem that those skilled in the art currently need to solve. Summary of the invention

[0005] In view of this, an object of the present invention is to provide a method for detecting malicious websites, which can improve the accuracy of detecting malicious websites while reducing the consumption of human resources; another object of the present invention is to provide a malicious website detection device, equipment and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0006] In order to solve the above technical problems, the present invention provides a method for detecting malicious websites, comprising:

[0007] After the target webpage of the target website is loaded, determining a webpage screenshot of the target webpage;

[0008] Determining the content type of the target web page according to the sampling points in the web page screenshot, and calculating the web page feature value of the target web page according to the content type;

[0009] Determine whether there is a target feature value whose similarity with the feature value of the web page reaches a preset threshold in a feature value database determined in advance based on malicious websites;

[0010] If so, it is determined that the target website is a malicious website.

[0011] Preferably, the process of determining the content type of the target web page according to the sampling points in the web page screenshot, and calculating the web page feature value of the target web page according to the content type specifically includes:

[0012] Calculating the RGB variance of the RGB values ​​of the plurality of sampling points in the webpage screenshot;

[0013] When the RGB variance is less than a first threshold, determining that the content type of the target webpage is a text type, and calculating the webpage feature value according to the feature text in the target webpage;

[0014] When the RGB variance is greater than a second threshold, determining that the content type of the target webpage is an image type, and calculating the webpage feature value according to the image elements in the target webpage;

[0015] When the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type, the target webpage is converted into a static webpage and the webpage feature value is calculated.

[0016] Preferably, when the RGB variance is less than a first threshold, determining that the content type of the target webpage is a text type, and calculating the webpage feature value according to the feature text in the target webpage specifically includes:

[0017] When the RGB variance is less than the first threshold, determining that the content type of the target webpage is the text type;

[0018] Extracting the characteristic text in the target webpage, and setting corresponding weights for each part of the characteristic text according to a preset rule;

[0019] The web page feature value is calculated according to the feature text and the weight.

[0020] Preferably, when the RGB variance is greater than a second threshold, determining that the content type of the target webpage is an image type, and calculating the webpage feature value according to the image elements in the target webpage specifically includes:

[0021] When the RGB variance is greater than the second threshold, determining that the content type of the target webpage is the image type;

[0022] Calculating a first feature value according to the pixel points of the image element in the target webpage;

[0023] Extracting text information from the image element, and calculating a second eigenvalue based on the text information;

[0024] A webpage feature value corresponding to the target webpage is calculated according to the first feature value and the second feature value.

[0025] Preferably, when the RGB value of the same sampling point changes within a preset time period, determining that the content type of the target webpage is a video type, converting the target webpage into a static webpage and calculating the webpage feature value specifically includes:

[0026] When the RGB value of the same sampling point changes within a preset time period, determining that the content type of the target webpage is a video type;

[0027] Converting the target web page into the static web page and calculating a third characteristic value;

[0028] Extracting voice information from the video element in the target webpage using MFCC technology, and calculating a fourth eigenvalue based on the voice information;

[0029] A webpage feature value corresponding to the target webpage is calculated according to the third feature value and the fourth feature value.

[0030] Preferably, the process of determining the content type of the target web page according to the sampling points in the web page screenshot, and calculating the web page feature value of the target web page according to the content type specifically includes:

[0031] The content type of the target webpage is determined according to the sampling points in the webpage screenshot, and the webpage feature values ​​of the target webpage are calculated according to the content type using a plurality of preset calculation methods.

[0032] Preferably, after the target webpage of the target website is loaded, the process of determining a webpage screenshot of the target webpage specifically includes:

[0033] After the target webpage of the target website is loaded, the webpage screenshot of the target webpage is determined by using canvas.

[0034] In order to solve the above technical problems, the present invention also provides a malicious website detection device, comprising:

[0035] A screenshot determination module, used to determine a webpage screenshot of a target webpage after the target webpage of the target website has been loaded;

[0036] A feature value calculation module, used to determine the content type of the target web page according to the sampling points in the web page screenshot, and calculate the web page feature value of the target web page according to the content type;

[0037] A judgment module is used to judge whether there is a target feature value whose similarity with the feature value of the web page reaches a preset threshold in the feature value database determined in advance based on malicious websites; if so, calling the website type determination module;

[0038] The website type determination module is used to determine that the target website is a malicious website.

[0039] In order to solve the above technical problems, the present invention also provides a malicious website detection device, comprising:

[0040] Memory for storing computer programs;

[0041] A processor is used to implement the steps of any of the above-mentioned malicious website detection methods when executing the computer program.

[0042] In order to solve the above technical problems, the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above-mentioned malicious website detection methods are implemented.

[0043] The present invention provides a method for detecting malicious websites, including: after the target web page of the target website is loaded, determining a webpage screenshot of the target webpage; determining the content type of the target webpage according to the sampling points in the webpage screenshot, and calculating the webpage feature value of the target webpage according to the content type; judging whether there is a target feature value in the feature value database determined in advance according to the malicious website whose similarity with the webpage feature value reaches a preset threshold; if so, determining that the target website is a malicious website. It can be seen that in this method, the corresponding webpage screenshot is determined according to the loaded target webpage, so that the webpage screenshot can contain the substantial content of the target webpage; the corresponding webpage feature value is calculated according to the webpage screenshot, so that the webpage feature value can fully and completely reflect the characteristics of the target webpage; judging whether the target website is a malicious website according to the webpage feature value can make the judgment result more comprehensive and accurate; and this method does not need to use a server-side crawler to access the target website to obtain the webpage content of the target webpage of the target website, so it can greatly reduce the consumption of human resources.

[0044] In order to solve the above technical problems, the present invention also provides a malicious website detection device, equipment and computer-readable storage medium, all of which have the above beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0046] Figure 1 A flowchart of a method for detecting malicious websites provided by an embodiment of the present invention;

[0047] Figure 2 A structural diagram of a malicious website detection device provided by an embodiment of the present invention;

[0048] Figure 3 A structural diagram of a malicious website detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The core of an embodiment of the present invention is to provide a method for detecting malicious websites, which can improve the accuracy of detecting malicious websites while reducing the consumption of human resources; another core of the present invention is to provide a malicious website detection device, equipment and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0051] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0052] Figure 1 The following is a flow chart of a method for detecting malicious websites provided by an embodiment of the present invention. Figure 1 As shown, a method for detecting a malicious website includes:

[0053] S10: After the target webpage of the target website is loaded, a webpage screenshot of the target webpage is determined.

[0054] Specifically, after the target webpage of the target website is opened by the browser and loaded, the target webpage will display the corresponding text, image or video and other webpage content information, and the target webpage is operated on this basis to determine the webpage screenshot corresponding to the target webpage. The webpage screenshot is to convert the target webpage into the corresponding image format; in this embodiment, the specific method of converting the target webpage into the webpage screenshot is not limited, as long as it can achieve the technical purpose.

[0055] S20: Determine the content type of the target web page according to the sampling points in the web page screenshot, and calculate the web page feature value of the target web page according to the content type.

[0056] Specifically, after determining the web page screenshot, sampling points are obtained from the web page screenshot, and the content type of the target web page is determined based on the sampling points; wherein the content type may include text, image and video; after determining the content type of the target web page, a corresponding calculation method is further determined based on the corresponding content type, and the web page feature value of the target web page is calculated.

[0057] S30: Determine whether there is a target feature value whose similarity with the webpage feature value reaches a preset threshold in the feature value database determined in advance based on the malicious website;

[0058] S40: If yes, it is determined that the target website is a malicious website.

[0059] Specifically, in the present embodiment, a feature value database is pre-set, and each feature value in the feature value database is a web page feature value calculated based on web page screenshots of each predetermined malicious website; after calculating the web page feature value of the target web page, it is determined whether there is a target feature value that is the same as or similar to the web page feature value in the feature value database; if so, it indicates that the target web page is the same as or similar to the web page corresponding to the target feature value, and therefore it is determined that the content of the target web page is malicious content, and the target web page is a malicious web page, and since the website is mainly composed of a collection of web pages, when it is determined that the target web page is a malicious web page, it can be determined that the target website is a malicious website.

[0060] It should be noted that malicious web pages refer to web pages containing illegal operating contents such as pornography, gambling, fraud, phishing, and content piracy, and the websites corresponding to malicious web pages are malicious websites. The standard for determining whether the webpage feature value of the target webpage is the same or similar to the feature value in the feature value database is: judging whether the similarity between the webpage feature value and each feature value reaches a preset threshold; if so, it indicates that the two are the same or similar; if not, it indicates that the two are different; the preset threshold is set according to actual needs, and this embodiment does not limit this.

[0061] It should be noted that in actual operation, multiple target web pages of the target website can be obtained and the corresponding web page feature values ​​can be calculated respectively, and then the highest similarities corresponding to each web page feature value and each feature value in the feature value database are calculated respectively, and then the average similarity of each highest similarity is calculated to determine whether the average similarity reaches a preset threshold, thereby determining whether the target website is a malicious website.

[0062] A method for detecting malicious websites provided by an embodiment of the present invention includes: after a target web page of a target website is loaded, determining a webpage screenshot of the target web page; determining the content type of the target web page according to the sampling points in the webpage screenshot, and calculating the webpage feature value of the target web page according to the content type; judging whether there is a target feature value in a feature value database determined in advance according to the malicious website whose similarity with the webpage feature value reaches a preset threshold; if so, determining that the target website is a malicious website. It can be seen that in this method, a corresponding webpage screenshot is determined according to the loaded target web page, so that the webpage screenshot can contain the substantial content of the target web page; the corresponding webpage feature value is calculated according to the webpage screenshot, so that the webpage feature value can fully and completely reflect the characteristics of the target web page; judging whether the target website is a malicious website according to the webpage feature value can make the judgment result more comprehensive and accurate; and this method does not need to use a server-side crawler to access the target website to obtain the webpage content of the target web page of the target website, so it can greatly reduce the consumption of human resources.

[0063] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, the process of determining the content type of the target web page according to the sampling points in the web page screenshot and calculating the web page feature value of the target web page according to the content type specifically includes:

[0064] Calculate the RGB variance of the RGB values ​​of multiple sampling points in the webpage screenshot;

[0065] When the RGB variance is less than the first threshold, it is determined that the content type of the target webpage is a text type, and a webpage feature value is calculated according to the feature text in the target webpage;

[0066] When the RGB variance is greater than the second threshold, determining that the content type of the target webpage is an image type, and calculating a webpage feature value according to the image elements in the target webpage;

[0067] When the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type, the target webpage is converted into a static webpage and a webpage feature value is calculated.

[0068] Specifically, in the present embodiment, after determining the webpage screenshot of the target webpage, multiple sampling points are selected from the webpage screenshot according to the pixel values ​​in the height and width directions of the webpage screenshot, and the RGB values ​​(color scalar values) of the sampling points are obtained, a set of parameters is constructed, and then the corresponding RGB variance is calculated according to the multiple sampling points; the calculated RGB variance is compared with the first threshold and the second threshold, respectively, wherein the first threshold is smaller than the second threshold.

[0069] Specifically, when the RGB variance is less than the first threshold, it means that the target webpage has fewer colors, and the content type of the target webpage is determined to be a text type, so the text information in the target webpage is extracted, and the bidirectional maximum matching algorithm is used to filter out the feature text from the text information, and the webpage feature value of the target webpage is calculated using the feature text. In addition, more different sampling points can be obtained by moving the sampling coordinates, and the sample size of the sampling points can be increased to improve the accuracy of calculating the webpage feature value.

[0070] Specifically, when the RGB variance is greater than the second threshold, it indicates that the target webpage is rich in color, and it is determined that the content type of the target webpage is an image type. Therefore, the webpage feature value of the target webpage is calculated according to the pixel points of the image elements in the target webpage; and, in actual operation, when the target webpage is rich in color, only an appropriate number of sampling points are needed to ensure that the webpage feature value of the target webpage is obtained with a high probability and accurately. For example, according to experiments, more than 30 sampling points can ensure that the feature values ​​obtained in more than 95% of cases are available; therefore, a preset number of sampling points can be screened out from a plurality of predetermined sampling points, the sample size of the sampling points can be appropriately reduced, and the webpage feature value of the target webpage can be calculated using the screened sampling points. On the basis of being able to accurately calculate the webpage feature value, the calculation complexity can be reduced as much as possible.

[0071] Specifically, when multiple webpage screenshots of the target webpage are obtained within a preset time period, it is determined whether the RGB value of the sampling point of the same sampling coordinate in the multiple webpage screenshots has changed. If so, it is determined that the content type of the target webpage is a video type. Therefore, the target webpage containing video elements can be converted into a webpage without animation at all by disabling all timers, disabling gif elements, disabling video elements, etc., that is, converting the target webpage into a static webpage, converting the video element into an image element, and then calculating the webpage feature value of the target webpage according to the calculation method of the content type being the image type. Specifically, the calculation method can also be recursively called to calculate the webpage feature values ​​corresponding to the multiple webpage screenshots, until the calculated webpage feature value no longer changes, indicating that a stable webpage feature value is obtained.

[0072] It can be seen that this embodiment specifically calculates the webpage feature value of the target webpage using corresponding calculation methods according to different content types, thereby improving the accuracy of calculating the webpage feature value of the target webpage.

[0073] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, when the RGB variance is less than the first threshold, it is determined that the content type of the target webpage is a text type, and the process of calculating the webpage feature value according to the feature text in the target webpage specifically includes:

[0074] When the RGB variance is less than the first threshold, it is determined that the content type of the target webpage is a text type;

[0075] Extract the characteristic text in the target web page, and set corresponding weights for each part of the characteristic text according to preset rules;

[0076] The feature value of the web page is calculated based on the feature text and weight.

[0077] Specifically, this embodiment further takes into account that the weights of different paragraphs / sentences / word segments for identifying whether a target web page is a malicious web page are different. Therefore, in the process of calculating the feature value of the web page, corresponding weights are set in advance for each part of the feature text. For example, corresponding weights are set for different paragraphs / sentences / word segments. Then, after the feature text in the text information is extracted using the bidirectional maximum matching algorithm, the feature value of the web page is calculated based on the feature text and the corresponding weight.

[0078] It can be seen that calculating the web page feature value of the target web page whose content type is text type according to the method of this embodiment can further improve the accuracy of calculating the web page feature value, thereby improving the accuracy of determining whether the target web page is a malicious web page, and improving the accuracy of determining whether the target website is a malicious website.

[0079] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, when the RGB variance is greater than the second threshold, it is determined that the content type of the target webpage is an image type, and the process of calculating the webpage feature value according to the image elements in the target webpage specifically includes:

[0080] When the RGB variance is greater than the second threshold, determining that the content type of the target webpage is an image type;

[0081] Calculating a first characteristic value according to the pixel points of the image element in the target web page;

[0082] Extracting text information from the image element and calculating a second eigenvalue based on the text information;

[0083] A webpage feature value corresponding to the target webpage is calculated according to the first feature value and the second feature value.

[0084] Specifically, in the present embodiment, when calculating the webpage feature value of the target webpage whose content type is an image type, the situation that the image elements in the target webpage contain text information is further taken into consideration. Therefore, on the basis of calculating the first feature value according to the pixel points of the image elements in the target webpage, the SIFT algorithm is further used to extract the text information in the image elements, and the scale space is established by convolution of the webpage screenshot and the Gaussian kernel. The feature points with scale invariance are extracted on the Gaussian difference space pyramid, the text information in the image elements in the webpage screenshot is extracted, the text information is weighted, and the second feature value is calculated according to the text information; then, the webpage feature value corresponding to the target webpage is calculated according to the first feature value and the second feature value.

[0085] It can be seen that this embodiment can further improve the accuracy of calculating the web page feature value of the target web page by extracting text information from the image element, calculating the second feature value based on the text information, and calculating the web page feature value corresponding to the target web page based on the first feature value and the second feature value.

[0086] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, when the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type, the target webpage is converted into a static webpage, and the process of calculating the webpage feature value specifically includes:

[0087] When the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type;

[0088] Convert the target web page into a static web page and calculate the third eigenvalue;

[0089] Extracting voice information from the video element in the target web page using MFCC technology, and calculating the fourth eigenvalue based on the voice information;

[0090] A webpage characteristic value corresponding to the target webpage is calculated according to the third characteristic value and the fourth characteristic value.

[0091] Specifically, in the present embodiment, when calculating the webpage feature value of the target webpage whose content type is a video type, the situation that the video element contains voice information is further taken into consideration. Therefore, on the basis of converting the target webpage into a static webpage and calculating the third feature value, the MFCC (Mel-scale Frequency Cepstral Coefficients) technology is further used to extract the voice information in the video element in the target webpage, and the fourth feature value is calculated based on the voice information; then, the webpage feature value corresponding to the target webpage is calculated based on the third feature value and the fourth feature value.

[0092] It can be seen that this embodiment further utilizes MFCC technology to extract voice information from the video element in the target web page, and calculates the fourth eigenvalue based on the voice information; and then calculates the web page eigenvalue corresponding to the target web page based on the third eigenvalue and the fourth eigenvalue, which can further improve the accuracy of calculating the web page eigenvalue of the target web page.

[0093] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, the process of determining the content type of the target web page according to the sampling points in the web page screenshot and calculating the web page feature value of the target web page according to the content type specifically includes:

[0094] The content type of the target web page is determined according to the sampling points in the web page screenshot, and the web page feature values ​​of the target web page are calculated according to the content type using a plurality of preset calculation methods.

[0095] Specifically, in this embodiment, after determining the content type of the target webpage, multiple preset algorithms are used to calculate the webpage feature values ​​of the target webpage. It should be noted that the preset calculation method can be MD5 (message-digest algorithm 5) algorithm or SHA-1, etc. This embodiment does not limit the specific type of the preset algorithm.

[0096] It can be seen that this embodiment calculates the corresponding web page feature values ​​for the same target web page using multiple preset calculation methods. Therefore, it is possible to use multiple forms of web page feature values ​​to compare with each feature value in the feature value database, so as to more comprehensively and accurately determine whether the target web page is a malicious web page, thereby improving the accuracy of determining whether the target website is a malicious website.

[0097] Based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, after the target webpage of the target website is loaded, the process of determining the webpage screenshot of the target webpage specifically includes:

[0098] After the target web page of the target website is loaded, the canvas is used to determine the web page screenshot of the target web page.

[0099] First of all, it should be noted that canvas is an HTML element that can use scripts such as JavaScript to draw graphics. In this embodiment, after the target web page of the target website is loaded, a web page canvas element canvas is created, and the entire target web page is drawn into a single picture using canvas to obtain a web page screenshot, so that the web page screenshot contains all the web page content in the target web page.

[0100] It can be seen that this embodiment uses canvas to determine the webpage screenshot of the target webpage, which is convenient to operate and can completely and comprehensively obtain the webpage content in the target webpage, thereby improving the accuracy of determining whether the target website is a malicious website.

[0101] The above describes in detail an embodiment of a malicious website detection method provided by the present invention. The present invention also provides a malicious website detection device, equipment and computer-readable storage medium corresponding to the method. Since the embodiments of the device, equipment and computer-readable storage medium part correspond to the embodiments of the method part, the embodiments of the device, equipment and computer-readable storage medium part refer to the description of the embodiments of the method part, which will not be repeated here.

[0102] Figure 2 A structural diagram of a malicious website detection device provided by an embodiment of the present invention, such as Figure 2 As shown, a malicious website detection device includes:

[0103] A screenshot determination module 21 is used to determine a webpage screenshot of a target webpage after the target webpage of the target website is loaded;

[0104] The feature value calculation module 22 is used to determine the content type of the target web page according to the sampling points in the web page screenshot, and calculate the web page feature value of the target web page according to the content type;

[0105] The judgment module 23 is used to judge whether there is a target feature value in the feature value database determined in advance based on malicious websites, and whether the target feature value has a similarity with the webpage feature value reaching a preset threshold; if so, calling the website type determination module;

[0106] The website type determination module 24 is used to determine whether the target website is a malicious website.

[0107] The malicious website detection device provided by the embodiment of the present invention has the beneficial effects of the malicious website detection method mentioned above.

[0108] Figure 3A structural diagram of a malicious website detection device provided by an embodiment of the present invention, such as Figure 3 As shown, a malicious website detection device includes:

[0109] A memory 31, used for storing computer programs;

[0110] The processor 32 is used to implement the steps of the above-mentioned malicious website detection method when executing the computer program.

[0111] The malicious website detection device provided by the embodiment of the present invention has the beneficial effects of the malicious website detection method mentioned above.

[0112] In order to solve the above technical problems, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned malicious website detection method are implemented.

[0113] The computer-readable storage medium provided by the embodiment of the present invention has the beneficial effects of the above-mentioned malicious website detection method.

[0114] The above is a detailed introduction to the malicious website detection method, device, equipment and computer-readable storage medium provided by the present invention. Specific embodiments are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

[0115] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A method for detecting malicious websites, characterized in that: include: After the target webpage of the target website is loaded, determining a webpage screenshot of the target webpage; Determining the content type of the target web page according to the sampling points in the web page screenshot, and calculating the web page feature value of the target web page according to the content type; Determine whether there is a target feature value whose similarity with the feature value of the web page reaches a preset threshold in a feature value database determined in advance based on malicious websites; If so, it is determined that the target website is a malicious website; The process of determining the content type of the target webpage according to the sampling points in the webpage screenshot and calculating the webpage feature value of the target webpage according to the content type specifically includes: Calculate the RGB variance of the RGB values ​​of the plurality of sampling points in the webpage screenshot; When the RGB variance is less than a first threshold, determining that the content type of the target webpage is a text type, and calculating the webpage feature value according to the feature text in the target webpage; When the RGB variance is greater than a second threshold, determining that the content type of the target webpage is an image type, and calculating the webpage feature value according to the image elements in the target webpage; When the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type, the target webpage is converted into a static webpage and the webpage feature value is calculated.

2. The method according to claim 1, characterized in that: The process of determining that the content type of the target webpage is a text type when the RGB variance is less than a first threshold, and calculating the webpage feature value according to the feature text in the target webpage specifically includes: When the RGB variance is less than the first threshold, determining that the content type of the target webpage is the text type; Extracting the characteristic text in the target webpage, and setting corresponding weights for each part of the characteristic text according to a preset rule; The web page feature value is calculated according to the feature text and the weight.

3. The method according to claim 1, characterized in that The process of determining that the content type of the target webpage is an image type when the RGB variance is greater than a second threshold, and calculating the webpage feature value according to the image elements in the target webpage specifically includes: When the RGB variance is greater than the second threshold, determining that the content type of the target webpage is the image type; Calculating a first feature value according to the pixel points of the image element in the target webpage; Extracting text information from the image element, and calculating a second eigenvalue based on the text information; A webpage feature value corresponding to the target webpage is calculated according to the first feature value and the second feature value.

4. The method according to claim 1, characterized in that: The process of determining that the content type of the target webpage is a video type when the RGB value of the same sampling point changes within a preset time period, converting the target webpage into a static webpage and calculating the webpage feature value specifically includes: When the RGB value of the same sampling point changes within a preset time period, determining that the content type of the target webpage is a video type; Converting the target web page into the static web page and calculating a third characteristic value; Extracting voice information from the video element in the target webpage using MFCC technology, and calculating a fourth eigenvalue based on the voice information; A webpage feature value corresponding to the target webpage is calculated according to the third feature value and the fourth feature value.

5. The method according to claim 1, characterized in that The process of determining the content type of the target web page according to the sampling points in the web page screenshot, and calculating the web page feature value of the target web page according to the content type specifically includes: The content type of the target webpage is determined according to the sampling points in the webpage screenshot, and the webpage feature values ​​of the target webpage are calculated according to the content type using a plurality of preset calculation methods.

6. The method according to any one of claims 1 to 5, characterized in that: The process of determining a webpage screenshot of the target webpage after the target webpage of the target website is loaded specifically includes: After the target webpage of the target website is loaded, the webpage screenshot of the target webpage is determined by using canvas.

7. A malicious website detection device, characterized in that: include: A screenshot determination module, used to determine a webpage screenshot of a target webpage after the target webpage of the target website has been loaded; A feature value calculation module, used to determine the content type of the target web page according to the sampling points in the web page screenshot, and calculate the web page feature value of the target web page according to the content type; A judgment module is used to judge whether there is a target feature value whose similarity with the feature value of the web page reaches a preset threshold in the feature value database determined in advance based on malicious websites; if so, calling the website type determination module; A website type determination module, used to determine that the target website is a malicious website; Wherein, the eigenvalue calculation module is specifically used for: Calculate the RGB variance of the RGB values ​​of the plurality of sampling points in the webpage screenshot; When the RGB variance is less than a first threshold, determining that the content type of the target webpage is a text type, and calculating the webpage feature value according to the feature text in the target webpage; When the RGB variance is greater than a second threshold, determining that the content type of the target webpage is an image type, and calculating the webpage feature value according to the image elements in the target webpage; When the RGB value of the same sampling point changes within a preset time period, it is determined that the content type of the target webpage is a video type, the target webpage is converted into a static webpage and the webpage feature value is calculated.

8. A malicious website detection device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for detecting a malicious website as claimed in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for detecting malicious websites according to any one of claims 1 to 6 are implemented.

Images