Information detection method and device, electronic device and computer-readable storage medium

Abstract

The present invention proposes an information detection method and device, an electronic device, and a computer-readable storage medium. The method includes: obtaining a first list and a second list; determining a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; determining the reputation of the target URL address based on a predetermined reputation calculation rule; when the reputation of the target URL address is less than or equal to a specified threshold, monitoring whether the information content at the target URL address has changed; if the information content of the target URL address has changed, determining whether the target URL address is an abnormal address exploited by malicious code C2 based on the behavior corresponding to the change. The technical solution of the present invention can quickly and efficiently identify the abnormality of a legitimate network service address when it is exploited by malicious code C2, thereby facilitating the smooth implementation of security monitoring and the timely implementation of subsequent security protection actions, thereby improving network security.

Description

Technical field

[0001] The present invention relates to the field of network security technology, and in particular to an information detection method and device, an electronic device, and a computer-readable storage medium. [Background Technology]

[0002] With the rapid development of internet technology, cyberattacks are becoming increasingly common. In recent years, a new cyber threat has emerged: APT attacks, or advanced persistent threat attacks, also known as targeted threat attacks. In these attacks, attackers exploit legitimate external network services to host command and control network infrastructure to evade detection by security products, making them difficult for security products to effectively identify.

[0003] Therefore, how to effectively identify malicious code C2 that uses legitimate network services to communicate has become a technical problem that needs to be solved urgently. [Summary of the invention]

[0004] Embodiments of the present invention provide an information detection method and apparatus, an electronic device, and a computer-readable storage medium, aiming to solve the technical problem in related technologies of being difficult to effectively identify malicious code C2 that utilizes legitimate network services for communication.

[0005] In a first aspect, an embodiment of the present invention provides an information detection method, comprising: obtaining a first list and a second list, the first list including network service domain names involved in legitimate network services available to the malicious code C2, and the second list including actual URL addresses of sample malicious codes obtained based on dynamic testing; determining a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; determining the credibility of the target URL address based on a predetermined credibility calculation rule; when the credibility of the target URL address is less than or equal to a specified threshold, monitoring whether the information content at the target URL address changes; if the information content of the target URL address changes, determining whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change.

[0006] In the above embodiment of the present invention, optionally, the step of determining the credibility of the target URL address based on a predetermined credibility calculation rule includes: determining the credibility of the target URL address based on attribute information of the target URL address in multiple dimensions and the weights corresponding to each of the multiple dimensions.

[0007] In the above embodiment of the present invention, optionally, the step of determining the credibility of the target URL address based on a predetermined credibility calculation rule includes: determining the feature vectors corresponding to the attribute information of the multiple dimensions based on the attribute information of the target URL address in multiple dimensions and the conversion rules corresponding to each of the multiple dimensions; and determining the credibility of the target URL address based on the feature vectors of the target URL address in multiple dimensions and a credibility calculation model.

[0008] In the above embodiment of the present invention, optionally, the attribute information of the target URL address in the multiple dimensions includes: the number of visits to the target URL address, access time distribution information, account attention volume, account activity, historical credibility, current content release time, whether the current content is readable in natural language, and whether the historical content is readable in natural language.

[0009] In the above embodiment of the present invention, it is optionally further included: determining the credibility change distribution information of the historical credibility of the target URL address within several historical security periods, and determining the lowest credibility of similar addresses of the target URL address exploited by the malicious code C2 within the several historical security periods; normalizing the credibility change distribution information and the lowest credibility; based on the ratio of the highest value in the normalized credibility change distribution information to the normalized lowest credibility, and the lowest value in the normalized credibility change distribution information, determining the lowest value in the simulated distribution information with the normalized lowest credibility as the highest value; and determining the lowest value as the specified threshold.

[0010] In the above embodiment of the present invention, optionally, if the information content of the target URL address changes, the step of determining whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change specifically includes: dynamically testing the target file corresponding to the information content after the change at the target URL address to obtain a target log; comparing the target log with the test log corresponding to the information content before the target URL address changes, and identifying whether specified abnormal behavior is recorded in the target log, the specified abnormal behavior including: initiating and / or establishing a connection to any C2, reading instructions for execution, obtaining encrypted code and payload and executing one or more of them; if the specified abnormal behavior is recorded, determining that the target URL address is an abnormal address exploited by the malicious code C2.

[0011] In the second aspect, an embodiment of the present invention provides an information detection device, including: a list acquisition unit, used to obtain a first list and a second list, the first list including network service domain names involved in legitimate network services available to the malicious code C2, and the second list including actual URL addresses of sample malicious codes obtained based on dynamic testing; a list comparison unit, used to determine a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; a reputation calculation unit, used to determine the reputation of the target URL address based on a predetermined reputation calculation rule; an address monitoring unit, used to monitor whether the information content at the target URL address changes when the reputation of the target URL address is less than or equal to a specified threshold; an abnormality judgment unit, used to determine whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change if the information content of the target URL address changes.

[0012] In the above embodiment of the present invention, optionally, the reputation calculation unit is configured to determine the reputation of the target URL address based on attribute information of the target URL address in multiple dimensions and weights corresponding to each of the multiple dimensions.

[0013] In the above embodiment of the present invention, optionally, the credibility calculation unit is used to: determine the feature vectors corresponding to the attribute information of the multiple dimensions based on the attribute information of the target URL address in multiple dimensions and the conversion rules corresponding to the multiple dimensions; determine the credibility of the target URL address based on the feature vectors of the target URL address in multiple dimensions and the credibility calculation model.

[0014] In the above embodiment of the present invention, optionally, the attribute information of the target URL address in the multiple dimensions includes: the number of visits to the target URL address, access time distribution information, account attention volume, account activity, historical credibility, current content release time, whether the current content is readable in natural language, and whether the historical content is readable in natural language.

[0015] In the above embodiment of the present invention, it is optionally further included: a threshold calculation unit, used to determine the reputation change distribution information of the historical reputation of the target URL address within several historical security periods, and determine the lowest reputation of the same type of address of the target URL address exploited by the malicious code C2 within the several historical security periods; normalize the reputation change distribution information and the lowest reputation; based on the ratio of the highest value in the normalized reputation change distribution information to the normalized lowest reputation, and the lowest value in the normalized reputation change distribution information, determine the lowest value in the simulated distribution information with the normalized lowest reputation as the highest value; and determine the lowest value as the specified threshold.

[0016] In the above embodiment of the present invention, optionally, the abnormality judgment unit is specifically used to: if the information content of the target URL address changes, dynamically test the target file corresponding to the information content after the change at the target URL address to obtain a target log; compare the target log with the test log corresponding to the information content before the target URL address changes, and identify whether specified abnormal behavior is recorded in the target log, and the specified abnormal behavior includes: initiating and / or establishing a connection to any C2, reading instructions for execution, obtaining encrypted code and payload and executing one or more of them; if the specified abnormal behavior is recorded, determine that the target URL address is an abnormal address exploited by the malicious code C2.

[0017] In a third aspect, an embodiment of the present invention provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being configured to execute any of the methods described in the first aspect above.

[0018] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method flow described in any one of the above-mentioned first aspects.

[0019] The above technical solution addresses the technical problem in related technologies that it is difficult to effectively identify malicious code C2 that uses legitimate network services to communicate. When the address of a legitimate network service is used by malicious code C2, it can quickly and efficiently identify the anomaly of the address and detect the actual situation of its use by malicious code C2, which helps to smoothly carry out security monitoring and the timely implementation of subsequent security protection actions, thereby improving network security.

Brief Description of the Drawings

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 A flow chart of an information detection method according to an embodiment of the present invention is shown;

[0022] Figure 2 A block diagram of an information detection device according to an embodiment of the present invention is shown;

[0023] Figure 3 A block diagram of an electronic device according to an embodiment of the present invention is shown. [Specific implementation method]

[0024] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0025] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0026] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "an", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

[0027] Figure 1 A flow chart of an information detection method according to an embodiment of the present invention is shown.

[0028] like Figure 1 As shown, the process of the information detection method according to an embodiment of the present invention includes:

[0029] Step 102: Obtain a first list and a second list.

[0030] The first list includes the network service domain names associated with legitimate network services accessible to malicious code C2. Malicious code C2 typically exploits common, legitimate network services that are less alert to conventional security detection systems. These legitimate network services include, but are not limited to, websites and software commonly used by people for daily activities such as work, study, and socializing, such as Weibo and Twitter. Enumerating as many network service domain names as possible for legitimate network services accessible to malicious code C2 can serve as a basic sample set for identifying anomalous addresses used by malicious code C2, facilitating subsequent screening and identification of anomalous addresses.

[0031] Specifically, the step of obtaining the first list includes adding available legitimate domain names on the Internet and network service domain names involved in legitimate network services previously used by the malicious code C2 in historical attack incidents to the first list. Potentially available network service domain names from legitimate network services can be added to the first list, as can network service domain names previously used by the malicious code C2 in historical security detection results. This expands the scope of the first list to include as many addresses as possible that could be exploited by the malicious code C2.

[0032] The second list includes actual URL addresses of sample malicious code obtained through dynamic testing, where dynamic testing can be performed using an open source dynamic sandbox or honeypot. In other words, the second list includes actual URL addresses actually used by the sample malicious code files, obtained through testing the sample malicious code files using an open source dynamic sandbox. The step of obtaining the second list includes: obtaining test logs obtained from testing the sample malicious code files using multiple open source dynamic sandboxes; and obtaining the actual URL addresses actually used by the sample malicious code files from the test logs.

[0033] Specifically, the sample malicious code files can be tested through the open source dynamic sandbox to obtain test logs. These test logs record which actual URL addresses in legitimate network services have been used by the malicious code C2. In this way, the actual malicious code C2 can be simulated and the actual URL addresses currently used by the malicious code C2 can be filtered out as much as possible.

[0034] Step 104: Determine a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list.

[0035] The first list is a list of domain names, for example, it may include the network service domain name blog.sina.com.cn. The second list includes the actual URL addresses used by the sample malicious code files, for example, it may include the URL address blog.sina.com.cn / s / blog_549c1d970102z766.html. By comparing the first and second lists, that is, detecting whether the actual URL addresses in the second list contain the network service domain names in the first list, it is possible to filter out the actual URL addresses that are likely to be used by the malicious code C2 from all addresses that may be used by the malicious code C2. This step serves as a preliminary screening step, which can effectively reduce the number of samples for the subsequent anomaly determination step and improve security detection efficiency.

[0036] Step 106: Determine the reputation of the target URL address based on a predetermined reputation calculation rule.

[0037] In one possible design, the predetermined credibility calculation rules can perform weighted calculation on the attribute information of the target URL address in multiple dimensions. Specifically, the credibility of the target URL address can be determined based on the attribute information of the target URL address in multiple dimensions and the weights corresponding to each of the multiple dimensions.

[0038] The attribute information of the target URL address in these multiple dimensions includes: the number of visits to the target URL address, the distribution of visit time information, the number of account followers, the account activity, the historical reputation, the current content release time, whether the current content is readable in natural language, and whether the historical content is readable in natural language. Each item of attribute information reflects, to varying degrees, the actual state of the information content at the target URL address, and this actual state can precisely reflect whether the information content has been tampered with or encrypted by malicious code C2 using the target URL address. Furthermore, because each item of attribute information can reflect different levels of the actual state of the information content, i.e., different levels of reflection ability and degree of reflection, a weight corresponding to the level of reflection ability can be assigned to each item of attribute information. Ultimately, a weighted calculation is performed based on the attribute information of the target URL address in multiple dimensions and the weights corresponding to each of these dimensions to determine the reputation of the target URL address.

[0039] In another possible design, the predetermined credibility calculation rules may be: based on the attribute information of the target URL address in multiple dimensions and the conversion rules corresponding to each of the multiple dimensions, determining the feature vectors corresponding to each of the attribute information in the multiple dimensions; based on the feature vectors of the target URL address in multiple dimensions and the credibility calculation model, determining the credibility of the target URL address.

[0040] This design adopts the big data training method, and uses the attribute information of sample addresses in multiple dimensions and the credibility of sample addresses to train a credibility calculation model, and then uses the credibility calculation model to calculate the credibility of the current target URL address.

[0041] Similar to the previous design, each attribute reflects the actual content of the target URL to varying degrees. Therefore, we can configure a conversion rule appropriate to the level of reflective power of each attribute to convert it into the feature vector needed for reputation calculation. Ultimately, the reputation calculation model uses the combination of the feature vectors corresponding to each attribute as input to determine the reputation of the target URL.

[0042] Step 108: When the reputation of the target URL address is less than or equal to a specified threshold, monitor whether the information content at the target URL address changes.

[0043] The credibility is used to reflect the possibility of the target URL address being exploited by the malicious code C2. If the credibility is high enough, it can be determined that the target URL address is less likely to be exploited by the malicious code C2. In this case, the target URL address can be trusted. If the credibility is low, it can be determined that the target URL address is more likely to be exploited by the malicious code C2. In this case, the target URL address can be further tested to determine whether it has been exploited by the malicious code C2 and is in an abnormal state.

[0044] In this regard, a specified threshold may be set as a standard for judging the credibility. The specified threshold refers to the minimum credibility of the target URL address when the target URL address reaches the standard of being highly likely to be exploited by the malicious code C2.

[0045] In one possible design, the calculation process of the specified threshold specifically includes: determining the reputation change distribution information of the historical reputation of the target URL address within several historical security periods, and determining the lowest reputation of similar addresses of the target URL address exploited by the malicious code C2 within the several historical security periods; normalizing the reputation change distribution information and the lowest reputation; based on the ratio of the highest value in the normalized reputation change distribution information to the normalized lowest reputation, and the lowest value in the normalized reputation change distribution information, determining the lowest value in the simulated distribution information with the normalized lowest reputation as the highest value; and determining the lowest value as the specified threshold.

[0046] The historical reputation of the target URL address over several historical security periods represents the general level of its reputation when the target URL address is not exploited by malicious code C2. The reputation change distribution information obtained based on this shows the possible reputation changes of the target URL address.

[0047] During the same historical security periods, the lowest reputation achieved by similar URLs of the target URL when exploited by malicious code C2 also, to a certain extent, represents the lowest reputation the target URL could achieve when exploited by malicious code C2. Even if the target URL achieves this lowest reputation when exploited by malicious code C2, the change in the target URL's reputation at this point is still constrained by the general change in its reputation. In other words, the target URL can be assumed to experience the same reputation change when exploited by malicious code C2 as when not exploited by malicious code C2.

[0048] Based on the above principles, the credibility change distribution information and the minimum credibility can be normalized so that the two are at the same level. Furthermore, the change pattern of the credibility change distribution information after normalization is used as the change pattern of the target URL address in the simulation distribution information. In order to ensure the reliability of the calculation results, the minimum credibility is used as the highest value of the target URL address in the simulation distribution information. Next, the ratio of the highest value in the credibility change distribution information after normalization to the lowest credibility after normalization is obtained, and the ratio is also determined as the ratio of the lowest value in the credibility change distribution information after normalization to the lowest value in the simulation distribution information where the normalized lowest credibility is the highest value. When the ratio and the lowest value in the credibility change distribution information after normalization are known, the lowest value in the simulation distribution information can be obtained. Finally, the lowest value is determined as the specified threshold.

[0049] In this way, we can effectively obtain the bottom line of credibility that the target URL address can have when it reaches the standard of having a high probability of being exploited by malicious code C2 and being very likely to have been exploited by malicious code C2. Based on this bottom line of credibility, we can further screen several addresses and proceed to a more in-depth judgment of whether the addresses are abnormal or not.

[0050] Step 110: If the information content of the target URL address changes, determine whether the target URL address is an abnormal address used by the malicious code C2 based on the behavior corresponding to the change.

[0051] Once the target URL's information content changes, if the target URL has been exploited by malicious code C2, the change indicates that the attacker may have taken new illegal actions at the target URL, such as issuing new action instructions at the target URL. Therefore, the behavior corresponding to the change can be determined, and based on the content of the behavior, it can be determined whether the target URL is an abnormal address exploited by malicious code C2.

[0052] Specifically, a dynamic test can be performed on the target file corresponding to the information content after the target URL address changes to obtain a target log; the target log is compared with the test log corresponding to the information content before the target URL address changes to identify whether specified abnormal behaviors are recorded in the target log. The specified abnormal behaviors include: initiating and / or establishing a connection to any C2, reading instructions for execution, obtaining encrypted code and payload and executing one or more of them; if the specified abnormal behavior is recorded, it is determined that the target URL address is an abnormal address exploited by the malicious code C2.

[0053] The open source dynamic sandbox can perform a test based on the information content before the target URL address changes, generating a test log. After the information content at the target URL address changes, the open source dynamic sandbox can perform another test based on the information content after the target URL address changes, generating a target log. It should be noted that the information content can change multiple times, and accordingly, the open source dynamic sandbox can also test it multiple times. The subsequent comparison of the two logs can be a comparison of logs obtained from any two or more tests of the information content of the target URL address by the open source dynamic sandbox.

[0054] Next, the target log is compared with the test log. Since each log contains behavioral data about the target URL, comparing the two logs effectively identifies the specified abnormal behavior shown in the behavioral data. Specified abnormal behavior refers to the behavior that the target URL might exhibit if exploited by malicious code C2. Therefore, once the specified abnormal behavior is identified, it can be determined that the target URL was exploited by malicious code C2 and is therefore an abnormal address.

[0055] The specified abnormal behavior includes one or more of: initiating and / or establishing a connection to any C2, reading and executing instructions, obtaining and executing encrypted code and payload. Of course, the behavior that may be performed when the target URL address is exploited by the malicious code C2 can be any illegal behavior, including but not limited to the ones listed here.

[0056] Through the above technical solution, when the address of a legitimate network service is exploited by malicious code C2, the anomaly of the address can be identified quickly and efficiently, and the actual situation of its exploitation by malicious code C2 can be detected, which helps to smoothly carry out security monitoring and the timely implementation of subsequent security protection actions, thereby improving network security.

[0057] Figure 2 A block diagram of an information detection device according to an embodiment of the present invention is shown.

[0058] like Figure 2 As shown, the information detection device 200 according to an embodiment of the present invention includes: a list acquisition unit 202, which is used to obtain a first list and a second list, wherein the first list includes network service domain names involved in legitimate network services available to the malicious code C2, and the second list includes actual URL addresses of sample malicious codes obtained based on dynamic testing; a list comparison unit 204, which is used to determine the target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; a reputation calculation unit 206, which is used to determine the reputation of the target URL address based on a predetermined reputation calculation rule; an address monitoring unit 208, which is used to monitor whether the information content at the target URL address changes when the reputation of the target URL address is less than or equal to a specified threshold; an abnormality judgment unit 210, which is used to determine whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change if the information content of the target URL address changes.

[0059] In the above embodiment of the present invention, optionally, the list acquisition unit 202 includes: a first list generation unit, used to add available legitimate domain names on the Internet and network service domain names involved in legitimate network services used by malicious code C2 in historical attack events to the first list; a second list generation unit, used to obtain test logs obtained by testing sample malicious code files by multiple open source dynamic sandboxes; and obtain the actual URL address actually used by the sample malicious code file in the test log.

[0060] In the above embodiment of the present invention, optionally, the reputation calculation unit 206 is configured to determine the reputation of the target URL address based on attribute information of the target URL address in multiple dimensions and weights corresponding to the multiple dimensions.

[0061] In the above embodiment of the present invention, optionally, the credibility calculation unit 206 is used to: determine the feature vectors corresponding to the attribute information of the multiple dimensions based on the attribute information of the target URL address in multiple dimensions and the conversion rules corresponding to the multiple dimensions; determine the credibility of the target URL address based on the feature vectors of the target URL address in multiple dimensions and the credibility calculation model.

[0062] In the above embodiment of the present invention, optionally, the attribute information of the target URL address in the multiple dimensions includes: the number of visits to the target URL address, access time distribution information, account attention volume, account activity, historical credibility, current content release time, whether the current content is readable in natural language, and whether the historical content is readable in natural language.

[0063] In the above embodiment of the present invention, it is optionally further included: a threshold calculation unit, used to determine the reputation change distribution information of the historical reputation of the target URL address within several historical security periods, and determine the lowest reputation of the same type of address of the target URL address exploited by the malicious code C2 within the several historical security periods; normalize the reputation change distribution information and the lowest reputation; based on the ratio of the highest value in the normalized reputation change distribution information to the normalized lowest reputation, and the lowest value in the normalized reputation change distribution information, determine the lowest value in the simulated distribution information with the normalized lowest reputation as the highest value; and determine the lowest value as the specified threshold.

[0064] In the above embodiment of the present invention, optionally, the abnormality judgment unit 210 is specifically used to: if the information content of the target URL address changes, dynamically test the target file corresponding to the information content after the change at the target URL address to obtain a target log; compare the target log with the test log corresponding to the information content before the target URL address changes, and identify whether the target log records specified abnormal behavior, and the specified abnormal behavior includes: initiating and / or establishing a connection to any C2, reading instructions for execution, obtaining encrypted code and payload and executing one or more; if the specified abnormal behavior is recorded, determine that the target URL address is an abnormal address exploited by the malicious code C2.

[0065] The information detection device 200 uses any one of the solutions in the above embodiments, and therefore has all the above technical effects, which will not be described in detail here.

[0066] Figure 3 A block diagram of an electronic device is shown according to an embodiment of the present invention.

[0067] like Figure 3 As shown, an electronic device 300 according to one embodiment of the present invention includes at least one memory 302 and a processor 304 in communication with the at least one memory 302. The memory stores instructions executable by the at least one processor 304, and the instructions are configured to execute the solution described in any of the above embodiments. Therefore, the electronic device 300 has the same technical effects as any of the above embodiments and will not be further described here.

[0068] The electronic devices of the embodiments of the present invention exist in various forms, including but not limited to:

[0069] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0070] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0071] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0072] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0073] (5) Other electronic devices with data interaction functions.

[0074] In addition, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method flow described in any of the above embodiments.

[0075] The above describes the technical solution of the present invention in detail in conjunction with the accompanying drawings. Through the technical solution of the present invention, when the address of a legitimate network service is exploited by the malicious code C2, the anomaly of the address can be quickly and efficiently identified, and the actual situation of the address being exploited by the malicious code C2 can be detected, which helps to smoothly carry out security monitoring and the timely implementation of subsequent security protection actions, thereby improving network security.

[0076] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0077] It should be understood that although the terms "first," "second," etc. may be used to describe lists in embodiments of the present invention, these lists should not be limited to these terms. These terms are merely used to distinguish one list from another. For example, without departing from the scope of embodiments of the present invention, the first list may also be referred to as the second list, and similarly, the second list may also be referred to as the first list.

[0078] The word "if," as used herein, may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0079] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0080] In addition, the functional units in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional units.

[0081] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform some steps of the method described in various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0082] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An information detection method, characterized in that: include: Obtaining a first list and a second list, wherein the first list includes legitimate network service domain names available to the malicious code C2, and the second list includes actual URL addresses of sample malicious codes obtained based on dynamic testing; Determine a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; Determining the reputation of the target URL address based on a predetermined reputation calculation rule; When the reputation of the target URL address is less than or equal to a specified threshold, monitoring whether the information content at the target URL address changes; If the information content of the target URL address changes, determining whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change; The information detection method further includes: Determining distribution information of the reputation change of the target URL address in several historical safety periods, and determining the lowest reputation of similar addresses of the target URL address that were exploited by the malicious code C2 in the several historical safety periods; Normalizing the credibility change distribution information and the minimum credibility; Determining, based on a ratio of a maximum value in the normalized credibility change distribution information to a minimum credibility value after normalization, and the minimum value in the normalized credibility change distribution information, a minimum value in the simulated distribution information having the normalized minimum credibility value as the maximum value; The lowest value is determined as the designated threshold value.

2. The information detection method according to claim 1, characterized in that: The step of determining the reputation of the target URL address based on a predetermined reputation calculation rule includes: The credibility of the target URL address is determined based on attribute information of the target URL address in multiple dimensions and weights corresponding to each of the multiple dimensions.

3. The information detection method according to claim 1, characterized in that: The step of determining the reputation of the target URL address based on a predetermined reputation calculation rule includes: Determining, based on the attribute information of the target URL address in multiple dimensions and the conversion rules corresponding to the multiple dimensions, the feature vectors corresponding to the attribute information in the multiple dimensions; The reputation of the target URL address is determined based on the feature vectors of the target URL address in multiple dimensions and a reputation calculation model.

4. The information detection method according to claim 2 or 3, characterized in that: The attribute information of the target URL address in the multiple dimensions includes: The target URL address includes the number of visits, access time distribution information, account follow-up volume, account activity, historical credibility, current content release time, whether the current content is readable in natural language, and whether the historical content is readable in natural language.

5. The information detection method according to claim 1, characterized in that: The step of determining whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change if the information content of the target URL address changes specifically includes: Dynamically test the target file corresponding to the information content after the target URL address changes to obtain a target log; Comparing the target log with a test log corresponding to the information content before the target URL address changes, and identifying whether the target log records specified abnormal behavior, wherein the specified abnormal behavior includes one or more of: initiating and / or establishing a connection to any C2, reading and executing instructions, and obtaining and executing encrypted code and payload; If the specified abnormal behavior is recorded, it is determined that the target URL address is an abnormal address used by the malicious code C2.

6. An information detection device, characterized in that: include: a list acquisition unit, configured to acquire a first list and a second list, wherein the first list includes network service domain names involved in legitimate network services available to the malicious code C2, and the second list includes actual URL addresses of sample malicious codes obtained based on dynamic testing; a list comparison unit, configured to determine a target URL address in the second list, wherein the network service domain name of the target URL address exists in the first list; a reputation calculation unit, configured to determine the reputation of the target URL address based on a predetermined reputation calculation rule; An address monitoring unit, configured to monitor whether the information content at the target URL address changes when the reputation of the target URL address is less than or equal to a specified threshold; an abnormality determination unit, configured to determine, if the information content of the target URL address changes, whether the target URL address is an abnormal address exploited by the malicious code C2 based on the behavior corresponding to the change; The information detection device further includes: A threshold calculation unit is used to determine the reputation change distribution information of the historical reputation of the target URL address within several historical security periods, and to determine the lowest reputation of similar addresses of the target URL address exploited by the malicious code C2 within the several historical security periods; to normalize the reputation change distribution information and the lowest reputation; to determine the lowest value in the simulated distribution information with the normalized lowest reputation as the highest value based on the ratio of the highest value in the normalized reputation change distribution information to the normalized lowest reputation, and the lowest value in the normalized reputation change distribution information; and to determine the lowest value as the specified threshold.

7. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are configured to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that Computer-executable instructions are stored, and the computer-executable instructions are used to execute the method process according to any one of claims 1 to 5.

Images