Information detection method and device, electronic equipment and computer readable storage medium

Abstract

The invention provides an information detection method and device, electronic equipment and a computer readable storage medium. The method comprises the following steps: acquiring a first list and a second list; determining a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; determining the credibility of the target URL address based on a predetermined credibility calculation rule; when the credibility of the target URL address is smaller than or equal to a specified threshold value, monitoring whether the information content at the target URL address is changed or not; and if the information content of the target URL address changes, determining whether the target URL address is an abnormal address used by a malicious code C2 based on a behavior corresponding to the change. According to the technical scheme provided by the invention, the abnormity of the address can be quickly and efficiently identified aiming at the condition that the address of the legal network service is utilized by the malicious code C2, so that the smooth implementation of security monitoring and the timely implementation of subsequent security protection behaviors are facilitated, and the network security is improved.

Description

【Technical field】 [0001] The invention relates to the technical field of network security, in particular to an information detection method and device, electronic equipment and a computer-readable storage medium. 【Background technique】 [0002] With the rapid development of Internet technology, network attacks also occur frequently. In recent years, a new network threat has emerged——APT attack, that is, advanced persistent threat attack, also known as targeted threat attack. In this type of attack, in order to avoid the detection of security products, attackers will use legitimate external network services to Managed command and control network infrastructure acts as a medium, making it difficult for security products to effectively identify. [0003] Therefore, how to effectively identify the malicious code C2 that uses legal network services for communication has become a technical problem that needs to be solved urgently. 【Content of invention】 [0004] Embodiments of...

AI Technical Summary

Problems solved by technology

[0004] Embodiments of the present invention provide an information detection method and device, electronic equipment, and a computer-readable storage medium, aiming to solve the technical problem in the related art that it is difficult to effectively identify malicious code C2 that uses legal network services for communication

Images