A method, apparatus and medium for identifying black market data

Abstract

The application provides a method, device and medium for identifying black and gray production data, which is suitable for the technical field of Internet. Current traffic data and a malicious website database are obtained; the current traffic data is compared with malicious website data of the malicious website database according to a preset field; the current traffic data matched with the malicious website data is taken as a traffic data packet; the traffic data packet is analyzed to extract corresponding traffic features; and the current traffic data is screened to obtain black and gray production data according to the traffic features. The method matches the current traffic data with the malicious website data of the malicious website database to obtain the traffic data packet, further extracts the traffic features, and then comprehensively screens the current traffic data to obtain the black and gray production data according to the traffic features. The method avoids the inaccurate and comprehensive problems caused by manual experience screening, and improves the screening speed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, in particular to a method and device for identifying black and gray production data and medium. BACKGROUND

[0002] In recent years, new network-related crimes have taken advantage of the rapid development of Internet and Internet of Things technology, and have gradually become hidden. The development of content delivery network (CDN) technology, proxy technology, cloud computing and other technologies enables black and gray production data to disguise themselves, which has an adverse impact on the relevant personnel's crackdown on network environment and governance. Therefore, how to find key black and gray production data from massive Internet data has become a difficult problem.

[0003] At present, the discovery of black and gray production data is mainly based on network space search engines and Internet public resources. In the screening process, only manual experience can be used for screening, and the acquisition is not comprehensive and accurate, resulting in slow screening speed.

[0004] Therefore, it is urgent for those skilled in the art to seek a method for identifying black and gray production data. SUMMARY

[0005] The purpose of the present application is to provide a method, device and medium for identifying black and gray production data, and to improve the screening efficiency.

[0006] To solve the above technical problems, the present application provides a method for identifying black and gray production data, comprising:

[0007] obtaining current traffic data and a malicious website database;

[0008] comparing the current traffic data with the malicious website data of the malicious website database according to a preset field;

[0009] the current traffic data matched with the malicious website data is taken as a traffic data packet;

[0010] analyzing the traffic data packet to extract corresponding traffic features;

[0011] screening the current traffic data according to the traffic features to obtain black and gray production data.

[0012] Preferably, the current traffic data is obtained, comprising:

[0013] obtaining current export traffic data;

[0014] inputting the current export traffic data into a traffic beam splitter to obtain beam-splitting traffic data;

[0015] storing the beam-splitting traffic data as a mirror image to obtain the current traffic data.

[0016] Preferably, the malicious website database is obtained, comprising:

[0017] obtaining historical case data;

[0018] cleaning the historical case data to obtain malicious website data;

[0019] storing the malicious website data and establishing a malicious website database.

[0020] Preferably, the current traffic data is compared with the malicious website data in the malicious website database according to a preset field, comprising:

[0021] obtaining a request header corresponding to the current traffic data and a current target field, wherein the preset field comprises a plurality of target fields;

[0022] comparing the request header with the malicious website data according to the current target field.

[0023] Preferably, the current traffic data matched with the malicious website data is taken as a traffic data packet, comprising:

[0024] determining whether the current traffic data is matched successfully according to the current target field;

[0025] if yes, taking the current traffic data matched successfully as a traffic data packet and marking the current target field;

[0026] if no, obtaining other target fields in the preset field except the current target field as a next current target field and returning to the step of comparing the current traffic data with the malicious website data according to the current target field.

[0027] Preferably, the traffic data packet is analyzed to extract corresponding traffic features, comprising:

[0028] obtaining a request header and a request body of the traffic data packet;

[0029] taking path data of the request header as a first feature;

[0030] taking variable name data of the request body as a second feature;

[0031] merging the first feature and the second feature to obtain the traffic features.

[0032] Preferably, the current traffic data is screened to obtain black and gray production data according to the traffic features, comprising:

[0033] extracting malicious data packets from the current traffic data according to the traffic features;

[0034] obtaining a request header corresponding to the malicious data packets;

[0035] According to the preset field, the field value corresponding to the request header of the malicious data packet is extracted as target malicious website data;

[0036] The target malicious website data is de-duplicated to obtain black and gray production data.

[0037] To solve the above technical problems, the application further provides a device for identifying black and gray production data, comprising:

[0038] The acquisition module is configured to acquire current traffic data and a malicious website database;

[0039] The comparison module is configured to compare the current traffic data with the malicious website data of the malicious website database according to a preset field;

[0040] The matching module is configured to match the current traffic data with the malicious website data as traffic data packets;

[0041] The analysis module is configured to analyze the traffic data packets to extract corresponding traffic features;

[0042] The screening module is configured to screen the current traffic data according to the traffic features to obtain black and gray production data.

[0043] To solve the above technical problems, the application further provides a device for identifying black and gray production data, comprising:

[0044] The memory is configured to store a computer program;

[0045] The processor is configured to execute the computer program to realize the steps of the method for identifying black and gray production data.

[0046] To solve the above technical problems, the application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by the processor to realize the steps of the method for identifying black and gray production data.

[0047] The application provides a method for identifying black and gray production data, which comprises the following steps: acquiring current traffic data and a malicious website database; comparing the current traffic data with the malicious website data of the malicious website database according to a preset field; matching the current traffic data with the malicious website data as traffic data packets; analyzing the traffic data packets to extract corresponding traffic features; and screening the current traffic data according to the traffic features to obtain black and gray production data. The method matches the current traffic data with the malicious website data of the malicious website database to obtain traffic data packets, further extracts traffic features, and then screens the current traffic data according to the traffic features to obtain black and gray production data. The method avoids the inaccurate and comprehensive problems caused by manual experience screening, and improves the screening speed.

[0048] In addition, the application further provides a device and a medium for identifying black-market data, which have the same beneficial effects as the method for identifying black-market data. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0050] Figure 1 A flowchart of a method for identifying black-market data provided by an embodiment of the present application is shown in the figure.

[0051] Figure 2 A format structure diagram of a flow data packet provided by an embodiment of the present application is shown in the figure.

[0052] Figure 3 A structure diagram of a device for identifying black-market data provided by an embodiment of the present application is shown in the figure.

[0053] Figure 4 A structure diagram of another device for identifying black-market data provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0055] The core of the present application is to provide a method, device and medium for identifying black-market data, which improves the screening efficiency.

[0056] In order to enable those skilled in the art to better understand the present application, the present application will be further described in detail with reference to the drawings and specific embodiments.

[0057] It should be noted that the method for identifying black and gray market data provided by this invention can be applied to the identification of Internet Protocol (IP) data from web space search engines, as well as to the identification of domain name data in CDN technology. It can be used for internet search identification of public network resources and also for the search identification of private network resources. This invention does not impose specific limitations and can be set according to actual circumstances. Black and gray market activities refer to illegal and criminal activities conducted online, such as telecommunications fraud, phishing websites, Trojan viruses, and hacker extortion. There are four types: source black and gray market activities such as fake account registration; platforms used for illegal transactions and communication; Trojan implantation; phishing websites; and various types of malicious software, mostly through malicious registration, fake authentication, and account theft.

[0058] Figure 1 A flowchart illustrating a method for identifying black and gray market data provided in an embodiment of the present invention is shown below. Figure 1 As shown, the method includes:

[0059] S11: Obtain current traffic data and a database of malicious URLs.

[0060] It is understood that the current traffic data is obtained by further collecting traffic generated from searching website information through the network. The network collection methods can include port mirroring, Web Cache Communication Protocol (WCCP) traffic redirection, optical splitter traffic collection, Layer 4 switch traffic redirection, etc. The appropriate traffic collection method is adopted according to the network structure, network traffic and device characteristics, and this invention does not make specific limitations.

[0061] The malicious website database can be obtained by summarizing historical malicious data or historical case reports and then cleaning the data. It can be set up and established according to the actual situation. This embodiment only requires obtaining the malicious website database.

[0062] S12: Compare the current traffic data with the malicious URL data in the malicious URL database based on preset fields.

[0063] Specifically, the current traffic data is searched for a data packet containing malicious website data according to a preset field, that is, the current traffic data is compared with malicious website data in the malicious website database. It can be understood that the preset field contains multiple fields, and the multiple fields are compared with the current traffic data and the malicious website data, so as to screen the current traffic data matched with the malicious website data. For example, the preset field A is compared with the current traffic data, and part of the traffic data may be screened out or no traffic data may be screened out, and another preset field needs to be acquired to continue to compare with the current traffic data, until the preset fields are all compared, and if no traffic data is matched, it is indicated that the current traffic data acquired does not contain data of the malicious website data. The next current traffic data is further acquired, and the acquisition of the traffic data can be according to an interval time or in real time.

[0064] When the preset field A does not find the traffic data of the malicious website data by comparing the current traffic data, the next preset field B can be acquired to continue to compare, until the preset fields are all compared. The preset field is set according to the field of the malicious website data, and each preset field is compared with the entire current massive data. The preset fields are a request header host field, a referer field and an origin field, and can also be other request header fields, as long as the traffic data packet can be matched according to the preset field.

[0065] S13: The current traffic data matched with the malicious website data is taken as a traffic data packet.

[0066] When the current traffic data is compared with the malicious website data according to the preset field, the current traffic data matched with the malicious website data is taken as a traffic data packet. Meanwhile, when the traffic data packet is obtained by comparing one preset field, the preset field needs to be marked, which indicates that the preset field can screen the traffic data packet, and other preset fields are selected in the malicious website database to avoid circular comparison.

[0067] The traffic data packet obtained in this embodiment is obtained by screening the current traffic data according to all preset fields. When the obtained traffic data packet is multiple, the traffic data packet can be set as a data packet group.

[0068] S14: The traffic data packet is analyzed to extract corresponding traffic features.

[0069] The traffic data packet obtained in step S13 is analyzed to extract the traffic characteristics of the traffic data packet. It can be understood that the extraction of the traffic characteristics can be based on a specific algorithm or filtering processing, or can be set according to the request content of the traffic data packet. The traffic characteristics are obtained based on obtaining comprehensive black and gray production data to avoid the inaccuracy of the traffic data packet obtained by only using the preset field, and the lack of authority of the extraction based on only the preset field, so that further screening is required based on the traffic characteristics.

[0070] S15: screening the current traffic data based on the traffic characteristics to obtain the black and gray production data.

[0071] The black and gray production data is further screened based on the extracted traffic characteristics, and it can be understood that the black and gray production data screened based on the traffic characteristics may have repeated data, and thus needs to be screened and de-duplicated. Meanwhile, the black and gray production data screened based on the traffic characteristics can extract the value of the preset field as malicious website data.

[0072] The application provides a method for identifying black and gray production data, obtaining current traffic data and malicious website database; comparing the current traffic data with the malicious website data of the malicious website database based on a preset field; matching the current traffic data with the malicious website data as traffic data packet; analyzing the traffic data packet to extract corresponding traffic characteristics; screening the current traffic data based on the traffic characteristics to obtain the black and gray production data. The method matches the current traffic data with the malicious website data of the malicious website database to obtain the traffic data packet, further extracts the traffic characteristics, and then screens the current traffic data based on the traffic characteristics to obtain the black and gray production data. The method avoids the inaccuracy and incompleteness caused by the manual experience screening, and improves the screening speed.

[0073] On the basis of the above embodiment, the current traffic data is obtained, comprising:

[0074] Obtaining the current export traffic data;

[0075] Inputting the current export traffic data into a traffic beam splitter to obtain beam-splitting traffic data;

[0076] Storing the beam-splitting traffic data as a mirror image to obtain the current traffic data.

[0077] Specifically, the current export traffic data is obtained, which is the traffic data generated when the user accesses the website, and is the data output from the user himself. The obtained current export traffic data is input into a traffic beam splitter to obtain beam-splitting traffic data, and then the beam-splitting traffic data is stored as a mirror image to obtain the current traffic data.

[0078] It can be understood that the flow splitter is a passive optical device, which can redistribute the power intensity of the optical signal according to the required proportion. In order to reduce the influence on the original link, the data center usually adopts the splitting ratio of 80:20 and 70:30, wherein the 70 and 80 proportion of the optical signal is sent back to the original link. Based on the application summary of network flow analysis, the network flow needs to be collected. In order to reduce the influence on the original link, the original flow is usually obtained by splitting and mirroring.

[0079] By setting a port mirror on the core layer or aggregation layer switch of the network, the outbound flow of the uplink port of the switch is copied (mirrored) to the front-end machine, so that all user access requests to the network can be collected.

[0080] The current flow data contains access information, that is, the request information sent by the user when accessing the website, and also includes the IP address of the visitor, the specific network information (wireless or wired flow, which operator it belongs to, etc.), the location (including city, latitude and longitude), the time of sending the request, etc.

[0081] The current flow data obtained according to the flow splitter and the mirror storage provided by the embodiment makes the flow data more comprehensive, and the data of the IP end and the domain name end can be obtained by the method. Avoiding the data obtained by the prior art is not comprehensive, and the black and gray production data obtained by screening is not comprehensive.

[0082] On the basis of the above embodiment, the obtaining of the malicious website database in step S11 comprises:

[0083] Obtaining historical report data;

[0084] Cleaning the historical report data to obtain malicious website data;

[0085] Storing and establishing the malicious website database.

[0086] Specifically, the accurate malicious website data involved in the report data is obtained by cleaning the historical report data, and the cleaned malicious website data is stored and the malicious website database is established. The embodiment is only a preferred embodiment, and the historical report data can be filtered, or the malicious website database can be directly stored and established according to the historical report data, which is not limited in the present application.

[0087] The embodiment provided by the present application cleans the historical report data and establishes the malicious website database, so that the malicious website data of the malicious website database can be referred to for screening the current flow data in the subsequent process, so that the data is more real and accurate.

[0088] On the basis of the above embodiment, the step S12 of comparing the current traffic data with the malicious website data in the malicious website database according to the preset field comprises:

[0089] The request header corresponding to the current traffic data is obtained, and the current target field is obtained, wherein the preset field comprises a plurality of target fields;

[0090] The request header is compared with the malicious website data according to the current target field.

[0091] It can be understood that the current traffic data contains what information has been described in detail in the above embodiment, and the request header corresponding to the current traffic data needs to be obtained. Since the preset field comprises a plurality of target fields, a target field can be obtained first to compare the current traffic data with the malicious website data, that is, the current target field of the preset field is obtained. The comparison can also be performed according to a plurality of target fields of the preset field at the same time, but this may cause screening to be missed or the screening time to be relatively long, thereby reducing the screening efficiency.

[0092] The current traffic data is compared with the malicious website data according to the current target field to obtain subsequent traffic data packets.

[0093] The request header obtained according to the current target field is compared with the malicious website data, which avoids missing screening or a relatively long screening time. One target field is used for comparison, and the next target field is obtained for comparison after the comparison is completed, until the comparison of the target fields of the preset field is completed, thereby improving the screening efficiency and saving the screening time.

[0094] On the basis of the above embodiment, the step S13 of taking the current traffic data matched with the malicious website data as the traffic data packet comprises:

[0095] It is judged whether the current traffic data is matched successfully according to the current target field;

[0096] If yes, the current traffic data matched successfully is taken as the traffic data packet, and the current target field is marked;

[0097] If no, other target fields in the preset field except the current target field are obtained as the next current target field, and the step of comparing the current traffic data with the malicious website data according to the current target field is returned to.

[0098] It is judged whether the current traffic data is matched successfully according to the current target field. If yes, it indicates that the current traffic data matched according to the current target field contains the malicious website data, and the matched current traffic data is taken as the traffic data packet, and the current target field is marked, so as not to match and compare again according to the current target field.

[0099] If the current traffic data does not match the current target field, it means that the current traffic data does not contain the malicious website data of the target field, and the next target field needs to be obtained to continue comparing the current traffic data. At this time, the current target field is not marked until all the target fields of the preset field are compared.

[0100] Finally, the current traffic data that matches the multiple target fields is summarized as a traffic data packet group.

[0101] The current traffic data matched with the malicious website data is provided as a traffic data packet, which improves the screening efficiency and saves the screening time.

[0102] On the basis of the above embodiment, the traffic data packet in step S14 is analyzed to extract the corresponding traffic characteristics, including:

[0103] Obtaining the request header and request body of the traffic data packet;

[0104] The path data of the request header is taken as the first characteristic;

[0105] The variable name data of the request body is taken as the second characteristic;

[0106] The first characteristic and the second characteristic are combined to obtain the traffic characteristics.

[0107] Specifically, the traffic data packet contains the request header and the request body content. In the above embodiment, the request header compared according to the preset field needs to extract the traffic characteristics according to the request header and the request body in the traffic data packet because the fields in the preset field are not comprehensive. Figure 2 A format structure diagram of the traffic data packet provided by the embodiment of the present application is shown in Figure 2 The first line is the request line, that is, the first line in the request header, and the path ( / sample.jsp) therein is taken as the first characteristic. All the field names in the request header of the traffic data packet are taken as the verification condition.

[0108] All the variable names in the request body are taken as the second characteristic, that is, Figure 2 user_name, pass_word and verifys in Figure 2 are taken as the second characteristic.

[0109] The first feature and the second feature are combined to obtain a flow feature, that is, the flow feature of the malicious website is that the request packet satisfies the first feature and the second feature at the same time. If the obtained flow data packet exists in the form of a group, that is, contains multiple data packets, in the embodiment, the feature extraction content of each data packet can be processed concurrently, and then a flow feature group is formed.

[0110] The embodiment provided in the embodiment provides analysis of flow data packets to extract corresponding flow features, extracts corresponding flow features according to the flow data packets screened, and comprehensively screens the black and gray production data according to the flow features.

[0111] On the basis of the above embodiment, the black and gray production data is obtained by screening the current flow data according to the flow features in step S15, comprising:

[0112] The current flow data is extracted according to the flow features to obtain malicious data packets;

[0113] The request header corresponding to the malicious data packet is obtained;

[0114] The field value corresponding to the preset field is extracted from the request header corresponding to the malicious data packet as target malicious website data according to the preset field;

[0115] The target malicious website data is de-duplicated to obtain the black and gray production data.

[0116] Specifically, the current flow data is extracted and filtered according to the flow features to obtain malicious data packets. At this time, the obtained malicious data packets may be the same as the flow data packets, or there may be different data packets more than the flow data packets, and the verification is performed, the request header corresponding to the malicious data packet is obtained, and the field value corresponding to the preset field is extracted from the request header as target malicious website data according to the preset field. In order to avoid omission, the same as the above embodiment, after one field screening is completed, the screening work of the next target field is continued, and the screening objects are all the request headers corresponding to the malicious data packets.

[0117] The target malicious website data is de-duplicated to obtain the black and gray production data.

[0118] The embodiment provided in the embodiment provides screening of the current flow data according to the flow features to obtain the black and gray production data, and comprehensively screens the black and gray production data according to the flow features, avoids the inaccurate and comprehensive problems caused by the existing screening according to the artificial experience, and improves the screening speed.

[0119] The above detailed description of the method for identifying the black and gray production data corresponds to each embodiment, on the basis of which, the application also discloses a device for identifying the black and gray production data corresponding to the above method, Figure 3A structural diagram of a device for identifying black and gray production data is provided for an embodiment of the present application. Figure 3 As shown in the figure, the clock calibration device comprises:

[0120] The acquisition module 11 is configured to acquire current traffic data and a malicious website database.

[0121] The comparison module 12 is configured to compare the current traffic data with malicious website data of the malicious website database according to a preset field.

[0122] The matching module 13 is configured to take the current traffic data matched with the malicious website data as a traffic data packet.

[0123] The analysis module 14 is configured to analyze the traffic data packet to extract corresponding traffic features.

[0124] The screening module 15 is configured to screen the current traffic data to obtain black and gray production data according to the traffic features.

[0125] Since the embodiments of the device part correspond to the above-mentioned embodiments, the embodiments of the device part are described with reference to the embodiments of the above-mentioned method part, and will not be described here.

[0126] The device for identifying black and gray production data provided by the present application acquires current traffic data and a malicious website database, compares the current traffic data with malicious website data of the malicious website database according to a preset field, takes the current traffic data matched with the malicious website data as a traffic data packet, analyzes the traffic data packet to extract corresponding traffic features, and screens the current traffic data to obtain black and gray production data according to the traffic features. The device matches the current traffic data with malicious website data of the malicious website database to obtain a traffic data packet, further extracts traffic features, and then screens the current traffic data to obtain black and gray production data according to the traffic features. The device avoids the inaccurate and comprehensive problems caused by manual experience screening, and improves the screening speed.

[0127] Figure 4 A structural diagram of another device for identifying black and gray production data provided for an embodiment of the present application is shown in the figure. Figure 4 The device comprises:

[0128] The memory 21 is configured to store a computer program.

[0129] The processor 22 is configured to execute the computer program to realize the steps of the method for identifying black and gray production data.

[0130] The device for identifying black and gray production data provided by the present embodiment can include but is not limited to a smart phone, a tablet computer, a notebook computer, or a desktop computer, etc.

[0131] The processor 22 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 22 can be implemented in at least one of a hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA), etc. The processor 22 can also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 22 can be integrated with a graphics processor (GPU) for rendering and drawing content to be displayed by the display screen. In some embodiments, the processor 22 can further include an artificial intelligence (AI) processor for processing machine learning-related computing operations.

[0132] The memory 21 can include one or more computer-readable storage media, which can be non-transitory. The memory 21 can further include a high-speed random access memory, and a nonvolatile memory such as one or more disk storage devices, flash storage devices. In this embodiment, the memory 21 is at least used to store a computer program 211, which, after being loaded and executed by the processor 22, can implement the related steps of the method for identifying black and gray production data disclosed in any of the preceding embodiments. In addition, the resources stored by the memory 21 can further include an operating system 212 and data 213, etc., and the storage mode can be temporary storage or permanent storage. The operating system 212 can include Windows, Unix, Linux, etc. The data 213 can include, but is not limited to, data related to the method for identifying black and gray production data, etc.

[0133] In some embodiments, the apparatus for identifying black and gray production data can further include a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27.

[0134] Those skilled in the art can understand that the structure shown in the above embodiments does not constitute a limitation on the apparatus for identifying black and gray production data, and can include more or fewer components than those shown in the drawings. Figure 4 The structure shown in the above embodiments does not constitute a limitation on the apparatus for identifying black and gray production data, and can include more or fewer components than those shown in the drawings.

[0135] The processor 22 calls instructions stored in the memory 21 to implement the method for identifying black and gray production data provided by any of the above embodiments.

[0136] The application provides a device for identifying black and gray production data, which acquires current traffic data and a malicious website database; compares the current traffic data with malicious website data of the malicious website database according to a preset field; takes the current traffic data matched with the malicious website data as a traffic data packet; analyzes the traffic data packet to extract corresponding traffic features; and filters the current traffic data to obtain black and gray production data according to the traffic features. The device matches the current traffic data with the malicious website data of the malicious website database to obtain a traffic data packet, further extracts traffic features, and then comprehensively filters the current traffic data to obtain black and gray production data according to the traffic features. The device avoids the inaccurate and comprehensive problems caused by manual experience filtering, and improves the filtering speed.

[0137] Further, the application also provides a computer readable storage medium, which stores a computer program. When the computer program is executed by the processor 22, the steps of the method for identifying black and gray production data are implemented.

[0138] It can be understood that if the method in the above embodiments is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the application or the whole or part of the technical solutions that essentially contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium, and executes all or part of the steps of the method described in each embodiment of the application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0139] For the computer readable storage medium provided by the application, refer to the above method embodiments, and the application will not be repeated here. It has the same beneficial effects as the method for identifying black and gray production data.

[0140] The method, device and medium for identifying black production data are described in detail above. The embodiments in the specification are described in a progressive manner, and each embodiment mainly explains the difference from other embodiments. The same or similar parts of each embodiment can be understood by referring to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can be understood by referring to the method part. It should be pointed out that, for ordinary skilled persons in the art, without departing from the principles of the present application, the present application can be improved and modified in several ways, and these improvements and modifications also fall within the protection scope of the claims of the present application.

[0141] It should also be noted that in this specification, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without further limitation, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for identifying black and gray market data, characterized in that, include: Obtain current traffic data and a database of malicious websites; The current traffic data is compared with the malicious URL data in the malicious URL database based on preset fields; The current traffic data that matches the malicious URL data is used as a traffic data packet; Analyze the traffic data packets to extract the corresponding traffic features; The black and gray market data is obtained by filtering the current traffic data based on the traffic characteristics; wherein, the black and gray market data can extract values ​​corresponding to preset fields as malicious URL data; The step of analyzing the traffic data packets to extract corresponding traffic features includes: Obtain the request header and request body of the traffic data packet; The path data in the request header is used as the first feature; The variable name data of the request body is used as the second feature; The first feature and the second feature are combined to obtain the flow feature; The step of filtering the current traffic data based on the traffic characteristics to obtain the black and gray market data includes: Malicious data packets are obtained by extracting the current traffic data based on the traffic characteristics. Obtain the request header corresponding to the malicious data packet; Based on the preset fields, extract the field values ​​corresponding to the preset fields from the request headers corresponding to the malicious data packets as target malicious URL data; The black and gray market data is obtained by deduplicating the target malicious URL data.

2. The method for identifying black and gray market data according to claim 1, characterized in that, Obtaining the current traffic data includes: Obtain current export flow data; The current outflow data is input into the flow splitter to obtain the split flow data. The current traffic data is obtained by storing the split traffic data as a mirror image.

3. The method for identifying black and gray market data according to claim 1, characterized in that, Obtaining the malicious URL database includes: Obtain historical crime report data; The historical report data is cleaned to obtain the malicious website data; The malicious URL data is stored and the malicious URL database is established.

4. The method for identifying black and gray market data according to claim 3, characterized in that, The step of comparing the current traffic data with the malicious website data in the malicious website database according to preset fields includes: Obtain the request header and the current target field corresponding to the current traffic data, wherein the preset field includes multiple target fields; The request header is compared with the malicious URL data based on the current target field.

5. The method for identifying black and gray market data according to claim 4, characterized in that, The step of using the current traffic data that matches the malicious URL data as a traffic data packet includes: Determine whether the current traffic data matches successfully based on the current target field; If so, the current traffic data that matches successfully will be used as the traffic data packet, and the current target field will be marked. If not, then obtain other target fields in the preset fields other than the current target field as the next current target field and return to the step of comparing the current traffic data with the malicious URL data based on the current target field.

6. A device for identifying black and gray market data, characterized in that, include: The acquisition module is used to acquire current traffic data and a database of malicious URLs; The comparison module is used to compare the current traffic data with the malicious URL data in the malicious URL database according to preset fields; The matching module is used to take the current traffic data that matches the malicious URL data as a traffic data packet; The analysis module is used to analyze the traffic data packets to extract corresponding traffic features; The filtering module is used to filter the current traffic data according to the traffic characteristics to obtain the black and gray market data; wherein, the black and gray market data can extract the values ​​corresponding to preset fields as malicious URL data; The step of analyzing the traffic data packets to extract corresponding traffic features includes: Obtain the request header and request body of the traffic data packet; The path data in the request header is used as the first feature; The variable name data of the request body is used as the second feature; The first feature and the second feature are combined to obtain the flow feature; The step of filtering the current traffic data based on the traffic characteristics to obtain the black and gray market data includes: Malicious data packets are obtained by extracting the current traffic data based on the traffic characteristics. Obtain the request header corresponding to the malicious data packet; Based on the preset fields, extract the field values ​​corresponding to the preset fields from the request headers corresponding to the malicious data packets as target malicious URL data; The black and gray market data is obtained by deduplicating the target malicious URL data.

7. A device for identifying black and gray market data, characterized in that, include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the method for identifying black and gray market data as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for identifying black and gray market data as described in any one of claims 1 to 5.

Images