A method for detecting malicious websites

Abstract

This invention discloses a method for detecting malicious webpages. It establishes a safe list, omitting detection for safe pages within a certain period to conserve resources and improve response speed, while periodically performing malware detection to ensure security and reliability. For pages not on the safe list but with external links, they are matched against a malware signature database to determine if they are malicious. For unknown pages without external links or those failing to match the signature database, a sandbox simulation is performed to determine if any abnormal operations are triggered, leading to further evaluation. This solution effectively improves upon existing signature matching problems, enhances malware detection effectiveness, and reduces security risks.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method for detecting malicious websites. Background Technology

[0002] Currently, many cyberattacks originate at the application layer, and many websites suffer from various levels of web security issues. Enterprise intrusion detection systems, firewalls, antivirus software, and other network security protection systems still lack sufficient capabilities to address security threats originating from the web application layer.

[0003] A web-based Trojan is a virus that uses web pages to cause damage. After infiltrating a website (often the homepage), it embeds a specific Trojan into the website's pages. Once a user opens the page, the Trojan program is automatically downloaded and executed, achieving its purpose of spreading. Once activated, a web-based Trojan may tamper with the browser homepage, change the page title, automatically display pop-up ads, or even render the website unusable, causing system crashes and loss of sensitive information.

[0004] Current web-based malware spreads by embedding links in legitimate web pages using scripting languages. The most crucial aspect of malware detection is effectively identifying malicious web pages. Traditional feature-matching-based detection methods rely on the accuracy and real-time nature of feature libraries, making it difficult to promptly detect and block the ever-changing nature of malware scripts, and thus require further improvement. Summary of the Invention

[0005] In light of the above background, this invention aims to provide a method for detecting malicious websites, thereby addressing the issues of real-time performance and accuracy in feature matching detection. The specific technical solution is described below.

[0006] A method for detecting malicious webpages includes: acquiring a webpage file, parsing and determining whether the page text content contains external resource links; if so, continuing; matching the external resource links with a Trojan signature database; if a match is successful, issuing an alert and generating a log; if the page does not contain external resource links, or if the page contains external resource links but fails to match the Trojan signature database, determining whether the page triggers an abnormal operation; if not, ending the process, otherwise issuing an alert and generating a log; and identifying the webpage corresponding to the above alert as a malicious webpage.

[0007] Preferably, determining whether a page has external resource links includes: extracting external reference tags from the page, determining whether it has at least one of JavaScript, A, IMG, CssStyle, frame, iframe, and if so, determining that the current page references external resources;

[0008] The matching of external resource links with the Trojan signature database includes: extracting the URL of the external resource referenced by the tag and matching it with the URL in the Trojan signature database; if the match is successful, it is determined that the current page is infected with malware.

[0009] Furthermore, before the external resource links are matched with the Trojan signature database, the process includes: crawling known Trojan information and storing it in the Trojan signature database; marking the threat level of the corresponding Trojan features based on the number of times they are crawled, with the higher the number of times they are crawled, the higher the threat level; then, the external resource links are matched with the Trojan signature database, the threat level of each successfully matched external link resource is determined, and the highest threat level is determined as the threat level of the current page; if the threat level of the current page reaches a preset level, the page is directly judged to be infected with malware, an alarm is issued and a log is generated.

[0010] Preferably, the determination of whether an abnormal operation is triggered includes simulating loading, rendering, and DOM generation using sandbox technology. If the page triggers at least one of the following actions: downloading, changing system files, or modifying the registry, then the page is determined to have triggered an abnormal operation.

[0011] If no abnormal operation is triggered on the page, the page information is added to the security list. The security level is determined based on the cumulative number of times the page has not triggered an abnormal operation; the more times it has not triggered an abnormal operation, the higher the security level.

[0012] Ideally, before detecting malicious code on a webpage, the page information should be matched with a security list to determine its security level. Pages that do not meet the preset security level should be detected for malicious code. Pages that meet the preset security level should be detected for malicious code periodically. If the detection result is that the page is malicious, it should be removed from the security list; otherwise, its security level should be updated.

[0013] Based on the above-described method for detecting malicious webpages, information on external resource links that fail to match the Trojan signature database but trigger abnormal operations is updated to the Trojan signature database; and the threat level is marked according to the cumulative number of abnormal triggers, with the higher the number of triggers, the higher the threat level.

[0014] Based on the above technical solution, the webpage malware detection method of the present invention achieves the following beneficial effects compared with the prior art:

[0015] A security list is established. Pages deemed safe within a certain period are no longer checked to conserve resources and improve response speed, while periodic malware detection is performed to ensure their security and reliability. Pages not on the security list but with external links are matched against a malware signature database to determine if they contain malware. Unknown pages without external links or failing to match the signature database are subjected to sandbox simulation to determine if any abnormal operations are triggered, and further investigation is conducted. This solution effectively improves upon the problems with signature matching, enhances the effectiveness of malware detection, and reduces security risks. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the workflow for the first embodiment of the webpage malware detection method of the present invention;

[0017] Figure 2 This is a schematic diagram of the workflow for the second embodiment of the webpage malware detection method of the present invention. Detailed Implementation

[0018] First, a brief explanation of the issue of malicious websites.

[0019] A "web page Trojan" combines a Trojan horse program with a web page, automatically downloading and running its program when the page is opened. Early web page Trojans utilized ActiveX controls in Internet Explorer; a prompt to download the control would appear, and the Trojan would only run after user confirmation. Newer Trojans typically exploit vulnerabilities in Internet Explorer to spread their web page Trojans.

[0020] Typical steps for injecting malicious code into a website include:

[0021] a) Apply for web hosting: Upload the Trojan program and malware to the web hosting space so that it can be accessed. If the application is successful, the web hosting address will be http: / / www.xxx.com / xxx;

[0022] b) Upload the Trojan program: After uploading, the Trojan's access address is http: / / www.xxx.com / horse.exe;

[0023] c) Use a web trojan generator to generate a web trojan: For example, the generated web trojan address is http: / / www.xxx.com / horse.htm;

[0024] d) Spreading malware: Embedding the generated malware address into other normal website pages, such as embedding it into the homepage of a portal website, http: / / www.YYY.com / index.htm.

[0025] When a user visits the aforementioned homepage, the system will automatically request and download the previously generated Trojan program, thus achieving the purpose of illegal dissemination.

[0026] Therefore, this invention provides a method for detecting malicious websites, mainly including:

[0027] Obtain the webpage file, parse it, and determine whether the page text content contains external resource links. If it does, continue.

[0028] The external resource link is matched against the Trojan signature database. If a match is found, an alarm is triggered and a log is generated.

[0029] If the page does not have external resource links, or if the page has external resource links but fails to match the Trojan signature database, then determine whether the page has triggered an abnormal operation. If it has not been triggered, the process ends; otherwise, an alarm is triggered and a log is generated.

[0030] The webpage that triggered the alert during the above steps was identified as a malicious page.

[0031] The technical solution of the present invention will be explained and described in detail below with reference to the embodiments and accompanying drawings. Example

[0032] like Figure 1 As shown, the methods for detecting malicious websites include:

[0033] 1.1 Obtain the webpage file, parse it, and determine whether the page text content contains external resource links. If it does, continue.

[0034] Preferably, determining whether a page has external resource links includes: extracting external reference tags from the page, determining whether it has at least one of JavaScript, A, IMG, CssStyle, frame, iframe, and if so, determining that the current page references external resources.

[0035] 1.2 Match the external resource link with the Trojan signature database. If the match is successful, issue an alarm and generate a log.

[0036] Specifically, this includes: extracting the external resource URLs referenced by the tags, matching them with URLs in the Trojan signature database, and determining that the current page is infected with malware if a match is found.

[0037] 1.3 If the page does not have external resource links, or if the page has external resource links but fails to match the Trojan signature database, then determine whether the page has triggered an abnormal operation. If it has not been triggered, then the process ends; otherwise, an alarm is issued and a log is generated.

[0038] Preferably, the determination of whether an abnormal operation is triggered includes simulating loading, rendering, and DOM generation using sandbox technology. If the page triggers at least one of the following actions: downloading, changing system files, or modifying the registry, then the page is determined to have triggered an abnormal operation.

[0039] 1.4 Identify the webpage that triggered the alert in the above steps as a malicious page. Example

[0040] like Figure 2 As shown, the methods for detecting malicious websites include:

[0041] 2.1 Establish a Trojan signature database, crawl resource links known to carry Trojans and store them in the Trojan signature database, and mark the threat level of the corresponding links according to the number of times they are crawled. The more times they are crawled, the higher the threat level.

[0042] Meanwhile, based on Implementation Example 1, page information that has external resource links, fails to match the Trojan signature database, and does not trigger abnormal operations is added to the security list. The security level is determined based on the cumulative number of times the page does not trigger an abnormality; the more times it does not trigger an abnormality, the higher the security level.

[0043] 2.2 First, match the page information with the aforementioned security list to determine the page's security level. If the page's security level does not meet the preset security level, then perform a malware detection on the page.

[0044] In a preferred implementation, for pages that meet a preset security level, a malware detection is performed periodically (e.g., daily or hourly). Furthermore, if the periodic detection result indicates a malware-infected page, the page is removed from the security list; if the periodic detection result does not indicate a malware-infected page, its security level in the security list is reassessed and updated.

[0045] 2.3. Obtain the webpage file, parse it, and determine whether the page text content contains external resource links. If external links are found, continue the detection process. In a preferred implementation, determining whether the page contains external resource links includes extracting external reference tags from the page and determining whether it contains at least one of the following: JavaScript, A, IMG, CssStyle, frame, or iframe. If so, it is determined that the current page references external resources.

[0046] 2.4 Matching the external resource links with the Trojan signature database, specifically including: extracting the external resource URLs referenced by the tags and matching them with the URLs in the Trojan signature database. If a match is successful, the threat level of each successfully matched external link resource is determined according to 2.1, and the highest threat level is determined as the current page threat level. Furthermore, if the current page threat level reaches a preset level, the page is directly judged to be infected with malware, an alarm is issued, and a log is generated.

[0047] 2.5 If the page does not have external resource links, or if the page has external resource links but fails to match the Trojan signature database, then determine whether the page has triggered abnormal operations, including simulating loading, rendering, and DOM generation through sandbox technology. If the page triggers at least one of the following actions: downloading, changing system files, or modifying the registry, then the page has triggered abnormal operations, the cumulative number of triggers is recorded, an alarm is issued, and a log is generated.

[0048] If it is not triggered, the cumulative number of times it is not triggered is recorded to determine the security level.

[0049] 2.6. Identify the webpage that triggered the alert in the above steps as a malicious page.

[0050] 2.7 As a preferred implementation, the external resource link information that fails to match the Trojan signature database but triggers abnormal operations is updated to the Trojan signature database; and the threat level is marked according to the cumulative number of abnormal triggers, the more times it is triggered, the higher the threat level.

[0051] The above records the cumulative number of times the event was triggered or not triggered, which can be the number of times within a specific period. Once the specific period is reached, the records will be reset.

[0052] The technical solution of this invention effectively improves the problems existing in feature matching, enhances the effectiveness of Trojan horse detection and removal, and reduces security risks.

[0053] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0054] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting malicious websites, characterized in that, include: Known Trojan information is crawled and stored in a Trojan feature database. The Trojan information includes threat level markings for corresponding Trojan features based on the number of times they are crawled. The more times they are crawled, the higher the threat level. Obtain webpage files, match page information with the security list to determine its security level, and perform malware detection on pages that do not meet the preset security level; The system parses and determines whether the page text content contains external resource links. If external resource links are present, the system matches these external resource links with the Trojan signature database, determines the threat level of each successfully matched external link resource, and sets the highest threat level as the current page threat level. If the current page threat level reaches a preset level, an alarm is triggered and a log is generated. If a page does not have external resource links, or if a page has external resource links but fails to match the Trojan signature database, it is determined whether the page has triggered abnormal operations. If the page has not triggered abnormal operations, the page information is added to the security list, and its security level is determined based on the cumulative number of times the page has not triggered abnormal operations. The more times it has not triggered abnormal operations, the higher the security level. If the page has triggered abnormal operations, an alarm is triggered and a log is generated. Update the Trojan signature database with external resource link information that fails to match the Trojan signature database but triggers abnormal operations. The threat level is marked based on the cumulative number of times it is abnormally triggered; the more times it is triggered, the higher the threat level. The webpage corresponding to the alert was identified as containing malware.

2. The method for detecting malicious websites according to claim 1, characterized in that, The step of determining whether a page has external resource links includes: extracting external reference tags from the page, and determining whether it has at least one of the following: JavaScript, A, IMG, CssStyle, frame, iframe. If it does, it is determined that the current page references external resources.

3. The method for detecting malicious websites according to claim 2, characterized in that, The process of matching external resource links with the Trojan signature database includes: extracting the URL of the external resource referenced by the tag and matching it with the URL in the Trojan signature database; if the match is successful, it is determined that the current page is infected with malware.

4. The method for detecting malicious websites according to claim 3, characterized in that, The page has external resource links but fails to match the Trojan signature database, including pages where all external resource links fail to match or the page that matches successfully does not reach the preset threat level.

5. The method for detecting malicious websites according to claim 1, characterized in that, The determination of whether an abnormal operation is triggered includes simulating loading, rendering, and DOM generation using sandbox technology. If the page triggers at least one of the following actions: downloading, changing system files, or modifying the registry, then the page is determined to have triggered an abnormal operation.

6. The method for detecting malicious websites according to claim 1, characterized in that, For pages that meet the preset security level, periodic malware detection is performed. If the detection result is malware, the page is removed from the security list; otherwise, its security level is updated.

Images