Malicious website identification method and system based on IP address feature analysis

Abstract

The invention relates to a malicious website identification method and system based on IP address feature analysis, and belongs to the technical field of network security, and the method comprises the steps: collecting network flow data of an IP address through a network flow log, a firewall log and a DNS query record, and carrying out the preprocessing; constructing an IP dynamic graph structure by taking the IP addresses as nodes and the communication relationship between the IP addresses as edges according to the preprocessed network flow data; the IP dynamic graph structure is coded through a graph attention network, the complex relation between nodes is captured, the time sequence characteristics of IP address behaviors are captured in combination with a long and short-term memory network, and a behavior mode of the nodes is constructed; and calculating a reconstruction error and a local outlier factor LOF of the node according to a behavior pattern of the node, calculating an abnormal score of the IP address, and when the abnormal score is higher than a dynamic abnormal detection threshold, performing deep analysis by combining domain name characteristics, webpage content characteristics and network access behavior characteristics of the website, and identifying the malicious website.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method and system for identifying malicious URLs based on IP address feature analysis. Background Art

[0002] While the popularity of the Internet has brought convenience to people's lives, it has also provided a breeding ground for online fraud. In recent years, online fraud cases have occurred frequently, and the means of fraud have been constantly updated, causing huge economic losses to society. Malicious URLs, as an important carrier of online fraud, disguise themselves as regular URLs to induce users to visit and commit fraud. With the continuous evolution of online fraud technology, attackers use dynamic IP pool rotation, cross-domain communication disguise and other means to achieve rapid fission and covert propagation of fraudulent URLs. Traditional detection methods face significant technical bottlenecks when dealing with such dynamic and organized threats. The existing technologies mainly have the following limitations: 1. Insufficient dynamic correlation analysis capabilities: Traditional methods rely on static IP reputation databases or isolated node analysis, which makes it difficult to capture the collaborative behavior patterns that evolve in real time between IP addresses, resulting in low efficiency in identifying attacks on distributed proxy pools; 2. Lack of spatiotemporal feature fusion: Methods based on rule engines or single-dimensional statistical models cannot effectively integrate the spatial topological relationship and time series behavior characteristics of IP addresses, and lack the ability to detect evasion strategies designed by attackers, such as day and night mode switching and cross-autonomous system migration; 3. Lack of adaptive detection mechanism: The fixed threshold strategy is easily affected by fluctuations in the network environment and cannot dynamically balance the detection accuracy and false alarm rate, especially when dealing with sudden large-scale IP fission attacks.

[0003] Prior art, such as a Chinese patent application with publication number "CN113779481A", discloses a method for identifying fraudulent websites, the method comprising: obtaining the web page source code of the website to be identified, and obtaining a target feature vector based on the web page source code; determining whether there is a target standard feature vector matching the target feature vector in a preset fraudulent website feature library; if so, determining the website to be identified as a fraudulent website, and determining the fraudulent website classification of the website to be identified based on the fraud type label of the standard feature vector set corresponding to the target standard feature vector.

[0004] The problems with the above-mentioned prior art are that the method is based on the webpage source code to obtain feature vectors and match them with the preset feature library to identify fraudulent websites. It is difficult to capture the collaborative behavior patterns that evolve in real time between IP addresses, and has weak recognition capabilities for attacks that rely on dynamic associations of IP addresses, such as distributed proxy pool attacks, and insufficient detection capabilities when attackers use evasion strategies that use time and space transformations. There is a lack of a mechanism for dynamic adjustment based on the network environment. When the network environment changes, it is difficult to balance the detection accuracy and false alarm rate, and the response to new or changing fraudulent websites is delayed. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a method and system for identifying malicious URLs based on IP address feature analysis.

[0006] The technical solution of the present invention is as follows: The present invention proposes a method for identifying malicious websites based on IP address feature analysis, comprising the following steps: Step S1, collecting network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocessing the collected network traffic data; Step S2, based on the pre-processed network traffic data, the IP addresses are used as nodes and the communication relationships between the IP addresses are used as edges to construct an IP dynamic graph structure; Step S3, encode the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combine the long short-term memory network to capture the time series characteristics of IP address behavior and construct the behavior pattern of the node; Step S4, calculates the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern, and calculates the IP address's anomaly score. When the IP address's anomaly score is higher than the dynamic anomaly detection threshold, the IP address is determined to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name features of the URL, web page content features, and network access behavior features to identify malicious URLs.

[0007] As a preferred implementation, the network traffic data includes request frequency, communication object, traffic size, protocol type, port number, and geographic location information.

[0008] As a preferred implementation, the IP dynamic graph structure is updated based on network traffic data collected in real time.

[0009] As a preferred implementation, the step of encoding the IP dynamic graph structure through a graph attention network to capture the complex relationship between nodes includes: Calculate the correlation between nodes. The calculation formula is: ; Based on the normalization of the correlation between the node and its neighboring nodes, the attention coefficient of the node is obtained: ; Aggregate neighbor node features according to the attention coefficient as the complex relationship between nodes: ; Where: is the association degree between node i and its neighbor node j; is the rectified linear unit activation function; is the transpose of the attention mechanism parameter vector; W is the graph attention network weight matrix; is the feature vector of node i; is the feature vector of node j; For splicing operation; is the time decay factor; is the last communication time interval between node i and node j; is the diversity factor, which is determined by the number of communication partners between nodes i and j; It is the risk factor of the agreement, and different risk factors are assigned according to the type of agreement; is the attention coefficient; is the set of neighbor nodes of node i; is the association degree between node i and its neighbor node q; is the feature vector of node i after being processed by the graph attention network; is the activation function.

[0010] As a preferred implementation, in the process of constructing the behavior pattern of the node, the behavior pattern of the node is generated by a gated attention fusion mechanism, wherein: The calculation formula of the gating signal is:

[0011] Where: g is the gate signal; is a learnable parameter; is the Sigmoid function; For splicing operation; ; Where: is the final behavior pattern representation of node i; is the feature vector of node i output after processing by the graph attention network; It is the time series feature of node i output by the long short-term memory network.

[0012] As a preferred implementation, the reconstruction error and the local outlier factor LOF of the node are calculated according to the behavior pattern of the node to obtain the anomaly score of the IP address. The specific calculation process of the anomaly score is: The reconstruction error is calculated based on the autoencoder of the graph attention network. The specific formula is: ; Where: is the reconstruction error; is the original feature vector of node i; For the autoencoder pair Reconstructed feature vector of node i; The local outlier factor LOF is calculated as follows: ; Where: is the local outlier factor of node i; , are the k-local reachability densities of node m and node i respectively; is the k-neighboring set of node i; The specific calculation formula for the anomaly score is: ; in: is the abnormality score of node i; It is a normalization operation; is the weight coefficient, which is dynamically adjusted based on the historical anomaly score. The specific calculation formula is: ; Where: The variance of the historical anomaly scores; To adjust the parameters.

[0013] As a preferred implementation, the dynamic anomaly detection threshold is specifically calculated as follows: ; Where: is the dynamic anomaly detection threshold at time t; is the mean of the anomaly scores within the historical time window; is the standard deviation during the same period; , is a dynamic weight coefficient, which is dynamically adjusted based on the historical score variance; An exponential moving average of historical anomaly scores.

[0014] On the other hand, the present invention also provides a malicious website identification system based on IP address feature analysis, comprising: The data collection and preprocessing module collects network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocesses the collected network traffic data; The dynamic graph structure building module uses the IP addresses as nodes and the communication relationships between IP addresses as edges to build the IP dynamic graph structure based on the pre-processed network traffic data; The feature extraction and fusion module encodes the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combines the long short-term memory network to capture the time series characteristics of IP address behavior and construct the behavior pattern of the node; The malicious URL identification module calculates the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern to obtain the anomaly score of the IP address. When the anomaly score of the IP address is higher than the dynamic anomaly detection threshold, the IP address is judged to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name characteristics of the URL, web page content characteristics, and network access behavior characteristics to identify malicious URLs.

[0015] On the other hand, the present invention further provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for identifying malicious URLs based on IP address feature analysis as described in any embodiment of the present invention is implemented.

[0016] On the other hand, the present invention also provides a computer-readable medium for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a malicious URL identification method based on IP address feature analysis as described in any embodiment of the present invention.

[0017] The present invention has the following beneficial effects: 1. By constructing an IP dynamic graph structure and combining the graph attention network with the long short-term memory network, it is possible to capture the real-time evolving collaborative behavior patterns between IP addresses and effectively improve the recognition efficiency of complex attack methods such as distributed proxy pool attacks.

[0018] 2. The spatial topological relationship and time series behavior characteristics of IP addresses are integrated to overcome the shortcomings of methods based on rule engines or single-dimensional statistical models in detecting attackers' evasion strategies such as day-night mode switching and migration across autonomous systems.

[0019] 3. The dynamic anomaly detection threshold can dynamically balance the detection accuracy and false alarm rate according to changes in the network environment, and respond more promptly when dealing with sudden large-scale IP fission attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The figure is a schematic diagram of the method flow of embodiment 1. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0023] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0024] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0025] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0026] Embodiment 1: In order to make the purpose, technical solutions and advantages of the present invention more clear, the following will be combined with the specific embodiments of the present application and refer to the attached Figure 1 , clearly and completely describe the technical solution of the present invention.

[0027] To solve the problems in the prior art, this embodiment provides a method for identifying malicious websites based on IP address feature analysis, comprising the following steps: Step S1, collecting network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocessing the collected network traffic data; The preprocessing process includes: data cleaning, deduplication and formatting to ensure data quality and consistency; The network traffic data includes: Request frequency: The number of network requests sent by an IP address in a given period of time. It can be used to measure the activity intensity of an IP address or a group of IP addresses on the network.

[0028] Communication partner: Other entities (usually another IP address or domain name) that interact with a specific IP address during network communication.

[0029] Traffic size: The amount of data in each request or response.

[0030] Protocol type: network protocols such as HTTP, HTTPS, FTP, etc.

[0031] Port number: Service port related to communication.

[0032] Geographic location information: Geographic coordinates (longitude and latitude) obtained based on IP address query.

[0033] Step S2, based on the pre-processed network traffic data, the IP addresses are used as nodes and the communication relationships between the IP addresses are used as edges to construct an IP dynamic graph structure; In the IP dynamic graph structure, the corresponding features of nodes and edges are assigned according to the pre-processed network traffic data; node features include: request frequency: the number of requests initiated per unit time; geographic location: geographic coordinates obtained based on IP address query; historical behavior: based on activity patterns in the past period of time, such as frequent visits to specific types of websites or abnormal activity in a time period; associated entities: other entities that frequently interact with the IP address, such as other IP addresses or domain names; time series features: reflecting the behavior change trends in different time periods of the day, and the behavior differences between weekends and weekdays. The communication relationship of the edge is obtained by analyzing the network traffic data, and the edge features include: connection frequency: the number of times a connection is established between two IP addresses; interaction intensity: the intensity of interaction between two nodes is measured based on the amount of data transmitted; duration: the length of time a complete communication session lasts; delay time: the time required from initiating a request to receiving a response; error rate: the proportion of errors occurring during the communication process, such as timeouts or retransmissions; encryption status: whether encryption technology is used in the communication, and the type of encryption algorithm used. Therefore, the dynamic graph structure based on network traffic data can reflect the changes in the interaction relationship between IP addresses and their behavior patterns in real time.

[0034] The IP dynamic graph structure can be updated according to the network traffic data collected in real time to reflect the latest network status.

[0035] Step S3, encode the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combine the temporal characteristics of the IP address encoded by the long short-term memory network to construct the behavior pattern of the node; The graph attention network encodes the node features and edge features in the IP dynamic graph structure to capture the complex relationships between nodes. The specific steps are as follows: Calculate the correlation between nodes. The calculation formula is: ; in: ; ; Based on the normalization of the correlation between the node and its neighboring nodes, the attention coefficient of the node is obtained: ; Aggregate neighbor node features according to the attention coefficient as the complex relationship between nodes: ; Where: is the association degree between node i and its neighbor node j; is the rectified linear unit activation function; is the transpose of the attention mechanism parameter vector; W is the graph attention network weight matrix; is the feature vector of node i; is the feature vector of node j; For splicing operation; is the time decay factor; is the last communication time interval between node i and node j; is the diversity factor, the number of communication objects between nodes i and j Sure; The protocol risk factor is assigned different risk weights according to the protocol type (such as HTTP=1.2, HTTPS=0.8) to reflect the security of the protocol; is the basic time decay factor, take 0.1; is the average value of the historical communication interval between nodes i and j; is the learning rate, take 0.01; is the attention coefficient; is the set of neighbor nodes of node i; is the association degree between node i and its neighbor node q; is the feature vector of node i after being processed by the graph attention network, which can reflect the relative position of the node in the IP dynamic graph structure and the interactive relationship characteristics with other nodes; is the activation function.

[0036] While using the graph attention network to encode the IP dynamic graph structure, the long short-term memory network is introduced to capture the time series characteristics of IP address behavior. For the time series data of each node, LSTM can be applied to extract long-term dependencies. Assume that the maximum time step of the data sequence is , then , the workflow of the LSTM unit is as follows: ; In the formula, is the output of the input gate, between [0, 1], and is used to control the extent to which new information is added to the cell state. is the weight matrix of the input gate, which determines the hidden state at the previous moment and the current time input Impact on the input gate. is the bias term of the input gate, which adjusts the default behavior of the input gate. is the sigmoid activation function, which compresses the calculation results into the (0,1) interval to determine which information should be considered important.

[0037] ; In the formula, is the output of the forget gate, between [0, 1], which determines which information in the cell state at the previous moment should be forgotten. is the weight matrix of the forget gate, which determines the hidden state at the previous moment and the current time input Impact on the forget gate. is the bias term of the forget gate. It is the sigmoid activation function, which compresses the calculation results into the (0,1) interval to determine which information should be forgotten.

[0038] ; In the formula, is the output of the output gate, between [0,1], which determines which parts of the current cell state should be output as the hidden state of the current time step. is the weight matrix of the output gate, which determines the hidden state at the previous moment and current time input Impact on the output gate. is the bias term of the output gate. It is the sigmoid activation function, which compresses the calculation results into the (0,1) interval to determine which information should be output.

[0039] ; In the formula, is a candidate cell state, which indicates new information that may be added to the cell state. Its value range is between [-1,1] and is determined by the hyperbolic tangent function. Decide. is the weight matrix for generating the weight matrix of candidate cell states, is the bias term of the candidate cell state.

[0040] ; In the formula, is the cell state at the current time step, which is the cell state at the previous moment controlled by the forget gate and new candidate cell states controlled by the input gate The weighted sum of . is the output of the forget gate, which determines the cell state at the previous moment Which parts should be discarded. is the output of the input gate, which determines the state of the new candidate cell Which parts should be added to the current cell state Go among them.

[0041] ; In the formula, is the hidden state of the current time step, which is based on the current cell state The result of output gate control. is the output of the output gate, is the hyperbolic tangent function.

[0042] The node representation obtained by the graph attention network and the final hidden state after processing by the long short-term memory network The gated attention fusion mechanism is used to generate the behavior pattern of the node, where: The calculation formula of the gating signal is: ; Where: g is the gate signal; is a learnable parameter; is the Sigmoid function; ; Where: is the final behavior pattern representation of node i; For splicing operation.

[0043] Step S4, calculate the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern to obtain the anomaly score of the IP address. When the anomaly score of the IP address is higher than the dynamic anomaly detection threshold, the IP address is determined to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name characteristics of the URL, the web page content characteristics, and the network access behavior characteristics to identify malicious URLs.

[0044] The reconstruction error of the node is calculated based on the autoencoder of the graph attention network, and the specific formula is: ; Where: is the reconstruction error; is the original feature vector of node i; For the autoencoder pair The reconstructed feature vector of node i. The graph attention network autoencoder uses the selected loss function MSE to train the autoencoder. During the training process, the autoencoder adjusts its weights and biases so that for each input , its reconstructed output As close to the input as possible . This means that the autoencoder is learning how to effectively represent the normal patterns of the data. After training, we can evaluate the performance of the model by comparing the reconstruction error on the test set. For normal data, the reconstruction error should be small; while for abnormal data, the reconstruction error is relatively large. From this, we can get the behavioral characteristics under normal patterns.

[0045] The local outlier factor LOF is specifically calculated as follows: ; Where: is the local outlier factor of node i; , are the k-local reachability densities of node m and node i respectively; is the k-neighboring set of node i.

[0046] The specific calculation formula for the anomaly score is: ; in: is the weight coefficient, which is dynamically adjusted based on the historical anomaly score. The specific calculation formula is: ; Where: is the abnormality score of node i; It is a normalization operation; The variance of the historical anomaly scores; To adjust the parameters, in scenarios where network traffic is relatively stable and anomaly score fluctuations are small, the The value of The impact is relatively mild; however, in scenarios where the network environment is complex and changeable and the abnormal score fluctuates greatly, the , enhance the regulatory effect of the variance pair so as to more flexibly adjust the weights of the reconstruction error and the local outlier factor LOF in the calculation of the anomaly score.

[0047] Dynamic anomaly detection threshold, the specific calculation formula is: ; in: ; Where: is the dynamic anomaly detection threshold at time t; is the mean of the anomaly scores within the historical time window; is the standard deviation during the same period; , is the dynamic weight coefficient, ; An exponential moving average of historical anomaly scores; is the variance of the anomaly score.

[0048] We conduct in-depth analysis of abnormal IP addresses combined with domain name features of URLs (such as whether there are spelling errors similar to well-known websites, use of rare or suspicious top-level domain names, etc.), web page content features (such as whether it contains false winning information, links that induce downloading of malware, a large number of pop-up ads, etc.), and network access behavior features (such as whether there are a large number of abnormal access requests in a short period of time, frequent jumps to other suspicious URLs, etc.) to identify malicious URLs.

[0049] Embodiment 2: This embodiment provides a malicious website identification system based on IP address feature analysis, including: The data collection and preprocessing module collects network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocesses the collected network traffic data; The dynamic graph structure building module uses the IP addresses as nodes and the communication relationships between IP addresses as edges to build the IP dynamic graph structure based on the pre-processed network traffic data; The feature extraction and fusion module encodes the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combines the long short-term memory network to capture the time series characteristics of IP address behavior and construct the behavior pattern of the node; The malicious URL identification module calculates the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern to obtain the anomaly score of the IP address. When the anomaly score of the IP address is higher than the dynamic anomaly detection threshold, the IP address is judged to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name characteristics of the URL, web page content characteristics, and network access behavior characteristics to identify malicious URLs.

[0050] Embodiment three: This embodiment provides an electronic device having a computer program stored thereon. When the computer program is executed by a processor, a malicious website identification method based on IP address feature analysis as described in any embodiment of the present invention is implemented.

[0051] Embodiment 4: This embodiment provides a computer-readable medium for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a malicious URL identification method based on IP address feature analysis as described in any embodiment of the present invention.

[0052] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0053] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0054] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0055] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0056] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for identifying malicious websites based on IP address feature analysis, characterized in that: The following steps are involved: Step S1, collecting network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocessing the collected network traffic data; Step S2, based on the pre-processed network traffic data, the IP addresses are used as nodes and the communication relationships between the IP addresses are used as edges to construct an IP dynamic graph structure; Step S3, encode the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combine the long short-term memory network LSTM to capture the time series characteristics of IP address behavior and construct the behavior pattern of the node; Step S4, calculates the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern, and calculates the IP address's anomaly score. When the IP address's anomaly score is higher than the dynamic anomaly detection threshold, the IP address is determined to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name features of the URL, web page content features, and network access behavior features to identify malicious URLs.

2. According to claim 1, a method for identifying malicious websites based on IP address feature analysis is characterized in that: The network traffic data includes: request frequency, communication object, traffic size, protocol type, port number, and geographic location information.

3. The method for identifying malicious websites based on IP address feature analysis according to claim 1, characterized in that: The IP dynamic graph structure is updated according to the network traffic data collected in real time.

4. The method for identifying malicious websites based on IP address feature analysis according to claim 1, characterized in that: The step of encoding the IP dynamic graph structure through the graph attention network and capturing the complex relationship between nodes includes: Calculate the correlation between nodes. The calculation formula is: ； Based on the normalization of the correlation between the node and its neighboring nodes, the attention coefficient of the node is obtained: ； Aggregate neighbor node features according to the attention coefficient as the complex relationship between nodes: ； Where: is the association degree between node i and its neighbor node j; is the rectified linear unit activation function; is the transpose of the attention mechanism parameter vector; W is the graph attention network weight matrix; is the feature vector of node i; is the feature vector of node j; For splicing operation; is the time decay factor; is the last communication time interval between node i and node j; is the diversity factor, which is determined by the number of communication partners between nodes i and j; It is the agreement risk factor, and different risk factors are assigned according to the agreement type; is the attention coefficient; is the set of neighbor nodes of node i; is the association degree between node i and its neighbor node q; is the feature vector of node i after being processed by the graph attention network; is the activation function.

5. The method for identifying malicious websites based on IP address feature analysis according to claim 1, characterized in that: In the process of constructing the behavior pattern of the node, the behavior pattern of the node is generated through a gated attention fusion mechanism, wherein: The calculation formula of the gating signal is: ； Where: g is the gate signal; is a learnable parameter; is the Sigmoid function; For splicing operation; ； Where: is the final behavior pattern representation of node i; is the feature vector of node i output after processing by the graph attention network; It is the time series feature of node i output by the long short-term memory network.

6. The method for identifying malicious websites based on IP address feature analysis according to claim 1, characterized in that: The node reconstruction error and the local outlier factor LOF are calculated according to the node behavior pattern to obtain the anomaly score of the IP address. The specific calculation process of the anomaly score is as follows: The reconstruction error is calculated based on the autoencoder of the graph attention network. The specific formula is: ； Where: is the reconstruction error; is the original feature vector of node i; For the autoencoder pair Reconstructed feature vector of node i; The local outlier factor LOF is calculated as follows: ； Where: is the local outlier factor of node i; , are the k-local reachability densities of node m and node i respectively; is the k-neighboring set of node i; The specific calculation formula for the anomaly score is: ； in: is the abnormality score of node i; It is a normalization operation; is the weight coefficient, which is dynamically adjusted based on the historical anomaly score. The specific calculation formula is: ； Where: The variance of the historical anomaly scores; To adjust the parameters.

7. The method for identifying malicious websites based on IP address feature analysis according to claim 1, characterized in that: The dynamic anomaly detection threshold is specifically calculated as follows: ； Where: is the dynamic anomaly detection threshold at time t; is the mean of the anomaly scores within the historical time window; is the standard deviation during the same period; , is a dynamic weight coefficient, which is dynamically adjusted based on the historical score variance; An exponential moving average of historical anomaly scores.

8. A malicious website identification system based on IP address feature analysis, characterized in that: include: The data collection and preprocessing module collects network traffic data of IP addresses through network traffic logs, firewall logs and DNS query records, and preprocesses the collected network traffic data; The dynamic graph structure building module uses the IP addresses as nodes and the communication relationships between IP addresses as edges to build the IP dynamic graph structure based on the pre-processed network traffic data; The feature extraction and fusion module encodes the IP dynamic graph structure through the graph attention network to capture the complex relationship between nodes, and combines the long short-term memory network to capture the time series characteristics of IP address behavior and construct the behavior pattern of the node; The malicious URL identification module calculates the node's reconstruction error and local outlier factor LOF according to the node's behavior pattern to obtain the anomaly score of the IP address. When the anomaly score of the IP address is higher than the dynamic anomaly detection threshold, the IP address is judged to be abnormal. The abnormal IP address is deeply analyzed in combination with the domain name characteristics of the URL, web page content characteristics, and network access behavior characteristics to identify malicious URLs.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for identifying malicious URLs based on IP address feature analysis as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying malicious URLs based on IP address feature analysis as described in any one of claims 1 to 7 is implemented.

Images