Detection system and detection method of malicious URL

Abstract

A malicious URL detection system and method are provided. The detection method includes: receiving a message to obtain a URL; determining whether the URL matches cached data; in response to a mismatch between the URL and cached data, using multiple deep learning models to determine whether the URL is a malicious URL to generate analysis results; and outputting the analysis results.

Claims

1. A malicious website detection system, comprising: transceiver; Storage media, storing multiple modules; and a processor, coupled to the storage medium and the transceiver, and accessing and executing the plurality of modules, wherein the plurality of modules includes: a response receiving module, which receives messages through the transceiver to obtain a URL; A caching module determines whether the URL matches cached data; and a malicious URL detection module, in response to a mismatch between the URL and the cached data, uses multiple deep learning models to determine whether the URL is a malicious URL to generate analysis results, wherein the receiving response module outputs the analysis results through the transceiver, and wherein the malicious URL detection module obtains the number of first types and the number of second types based on the judgment results output by the multiple deep learning models, and determines that the URL belongs to the first type based on the number of first types and the number of second types.

2. The detection system as claimed in claim 1, wherein the plurality of modules further comprises: The intelligence call module accesses a database through the transceiver. The malicious URL detection module determines whether the URL is a suspicious URL based on a preset list. In response to the URL being a suspicious URL, the intelligence call module retrieves external intelligence corresponding to the URL from the database and updates the cache data based on the external intelligence.

3. The detection system as described in claim 2, wherein in response to the URL not being the suspicious URL, the malicious URL detection module generates the analysis result based on the output of the plurality of deep learning models.

4. The detection system as described in claim 1, wherein the malicious URL detection module generates the analysis result based on the cache data in response to a match between the URL and the cache data.

5. The detection system as claimed in claim 1, wherein the output includes multiple probabilities output by the multiple deep learning models respectively, wherein the malicious URL detection module selects at least one probability corresponding to the first type from the multiple probabilities and generates the analysis result based on the at least one probability.

6. The detection system as claimed in claim 1, wherein the output includes a first output corresponding to a first deep learning model among the plurality of deep learning models, wherein the malicious URL detection module updates the first deep learning model based on the URL corresponding to a second type of the first output.

7. The detection system as claimed in claim 1, wherein the malicious URL detection module acquires a plurality of URLs and counts the number of URLs including a first name, wherein in response to the number being greater than a threshold, the malicious URL detection module filters the URLs including the first name from the plurality of URLs so that the number is less than or equal to the threshold, wherein the malicious URL detection module trains at least one of the plurality of deep learning models based on the filtered plurality of URLs.

8. The detection system as described in claim 7, wherein the ratio of normal URLs to malicious URLs among the filtered plurality of URLs is M, where M is a positive integer.

9. The detection system as described in claim 7, wherein the first name corresponds to a domain.

10. The detection system of claim 1, wherein the plurality of deep learning models includes at least one of the following: convolutional neural networks, long short-term memory models, bidirectional long short-term memory models, or a combination of convolutional neural networks and bidirectional long short-term memory models.

11. The detection system as claimed in claim 1, wherein the receiving response module obtains a short URL from the message and performs a restoration on the short URL to obtain the URL.

12. The detection system as claimed in claim 1, wherein the receiving response module adds the analysis results to the cache data to update the cache data.

13. A method for detecting malicious URLs, executed by a processor, comprising: Receive a message to obtain the URL; Determine whether the URL matches cached data; in response to the URL not matching the cached data, determine whether the URL is a malicious URL using multiple deep learning models to generate analysis results; and output the analysis results, wherein the detection method includes obtaining the number of first types and the number of second types based on the judgment results output by the multiple deep learning models, and determining that the URL belongs to the first type based on the number of first types and the number of second types.

14. A malicious website detection system, comprising: transceiver; Storage media, storing multiple modules; and a processor, coupled to the storage medium and the transceiver, and accessing and executing the plurality of modules, wherein the plurality of modules includes: a response receiving module, which receives messages through the transceiver to obtain a URL; A caching module determines whether the URL matches cached data; and a malicious URL detection module, in response to a mismatch between the URL and the cached data, uses multiple deep learning models to determine whether the URL is a malicious URL to generate an analysis result, wherein the receiving response module outputs the analysis result through the transceiver, wherein the malicious URL detection module obtains multiple URLs and counts the number of URLs including a first name, wherein in response to the number being greater than a threshold, the malicious URL detection module filters the URLs including the first name from the multiple URLs so that the number is less than or equal to the threshold, wherein the malicious URL detection module trains at least one of the multiple deep learning models based on the filtered multiple URLs.

15. A method for detecting malicious URLs, executed by a processor, comprising: Receive a message to obtain the URL; The system determines whether the URL matches cached data; in response to a mismatch between the URL and the cached data, it uses multiple deep learning models to determine whether the URL is a malicious URL to generate an analysis result; and outputs the analysis result, wherein the malicious URL detection module obtains multiple URLs and counts the number of URLs including a first name, wherein in response to the number being greater than a threshold, the malicious URL detection module filters the URLs including the first name from the multiple URLs so that the number is less than or equal to the threshold, wherein the malicious URL detection module trains at least one of the multiple deep learning models based on the filtered multiple URLs.

Images