Method, system, electronic device and storage medium for detecting harmful URLs

Abstract

The technical scheme of the present application provides a method, system, electronic device and storage medium for detecting harmful URLs. The method comprises: obtaining URL data, wherein the URL data includes harmful URL data and normal URL data; creating word features according to the URL data, wherein the word features are used to summarize the features possessed by the URL data; creating a training set and a test set according to the URL data, and counting the word features of the URL data in the training set; constructing a decision tree according to the word features of the URL data in the training set and generating a random forest model; and identifying harmful URL data from the test set according to the random forest model. This technical scheme can improve the efficiency and accuracy of URL detection and reduce the consumption of computer computing resources.

Description

Technical Field

[0001] This invention relates to the field of network processing technology, and in particular to a method, system, electronic device, and storage medium for detecting harmful URLs. Background Technology

[0002] Harmful Uniform Resource Locators (URLs) detection techniques can generally be divided into blacklist heuristics and machine learning techniques. Blacklist detection and heuristics involve adding confirmed harmful URLs to a blacklist and then determining whether a URL is harmful based on whether it is included in the blacklist or whether it exhibits similarity rules to manually extracted blacklist URLs. Machine learning techniques utilize existing machine learning classification methods to analyze the URL string itself or its associated web page content, network activity, etc., to obtain a result indicating whether the URL is harmful.

[0003] However, traditional blacklisting and heuristic techniques are mainly used to detect already discovered malicious URLs or URLs similar to existing malicious URLs. When attackers use URL automatic generation techniques, these detection techniques are difficult to use effectively. On the other hand, methods for detecting the maliciousness of URLs based on webpage content or network activity are very resource-intensive and time-consuming. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This invention provides a method, system, electronic device, and storage medium for detecting harmful URLs, which can improve the efficiency and accuracy of URL detection and reduce the consumption of computer computing resources.

[0006] In a first aspect, embodiments of the present invention provide a method for detecting harmful URLs, including:

[0007] Obtain URL data, wherein the URL data includes harmful URL data and normal URL data;

[0008] Word features are created based on the URL data, wherein the word features are used to summarize the characteristics of the URL data;

[0009] A training set and a test set are created based on the URL data, and the word features of the URL data in the training set are statistically analyzed.

[0010] A decision tree is constructed and a random forest model is generated based on the word features of the URL data in the training set.

[0011] The random forest model is used to detect whether the URLs in the test set are harmful URLs.

[0012] Secondly, embodiments of the present invention provide a system for detecting harmful URLs, comprising:

[0013] The first processing module is used to obtain URL data, wherein the URL data includes harmful URL data and normal URL data;

[0014] The second processing module is used to create word features based on the URL data, wherein the word features are used to summarize the characteristics of the URL data;

[0015] The third processing module is used to create a training set and a test set based on the URL data, and to statistically analyze the word features of the URL data in the training set.

[0016] The fourth processing module is used to construct a decision tree and generate a random forest model based on the word features of the URL data in the training set;

[0017] The fifth processing module is used to detect whether the URL data in the test set is a harmful URL based on the random forest model.

[0018] Thirdly, embodiments of the present invention provide an electronic device, the electronic device including a processor, a memory, and one or more programs, the one or more programs being stored in the memory and configured to be executed by the processor, the programs being executed by the processor to implement the method for detecting harmful URLs described in the first aspect.

[0019] Fourthly, embodiments of the present invention provide a computer-readable storage medium, characterized in that it stores processor-executable program instructions, the program instructions being used to execute the method for detecting harmful URLs as described in the first aspect above.

[0020] The embodiments of the present invention include at least the following beneficial effects: By using the word features of URLs instead of traditional webpage content as the attribute for detecting whether a URL is harmful, the time for building and training the detection model can be reduced. Since the amount of data required for training using URL word features is greatly reduced, the training time can be reduced. By using the word features of URL data as node parameters of the decision tree model, the parameters of the decision tree model can be manually selected and tuned, unlike the parameters of deep neural networks which are unknown. This improves the visualization of the detection model and makes it easier to analyze and optimize the model. Since only the word features of URL data need to be calculated, the amount of data processing can be reduced during the detection process, and the detection speed can be improved. Compared with existing technologies that directly process URLs, classifying URLs layer by layer using the word features of URLs can make the detection results more real-time and accurate. Moreover, when facing new personalized small sample tasks, since the original data used only includes URLs and does not involve access to the original webpages, there is no need to worry about security and computing power issues, which can make the trained detection model more adaptable and improve the practical value of the system. Attached Figure Description

[0021] Figure 1 This is a flowchart of a method for detecting harmful URLs according to an embodiment of the present invention.

[0022] Figure 2 This is an example diagram of a decision tree in an embodiment of the present invention.

[0023] Figure 3 This is an example of an algorithm in an embodiment of the present invention.

[0024] Figure 4 This is a schematic diagram of a system for detecting harmful URLs in an embodiment of the present invention.

[0025] Figure 5 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] It should be understood that if the description of orientation, such as up, down, front, back, left, right, etc., is used in the specification, claims and above drawings, the orientation or positional relationship indicated is based on the orientation or positional relationship shown in the drawings, it is only for the purpose of facilitating the description of the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention.

[0028] It should be noted that "at least one" means one or more, "more than one" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the number itself, while "above," "below," and "within" are understood to include the number itself. If it is described that "first" and "second" are only used to distinguish technical features, and should not be construed as indicating or implying relative importance, or implicitly indicating the number of technical features indicated, or implicitly indicating the order of the technical features indicated.

[0029] Terminology Explanation:

[0030] Decision Tree: A decision tree is a common type of machine learning algorithm. It is a tree structure (which can be a binary tree or a non-binary tree). Each non-leaf node represents a test on a feature attribute, each branch represents the output of that feature attribute in a certain value range, and each leaf node stores a category.

[0031] Random Forest: Random forest is a type of ensemble learning in machine learning models. It is based on the decision tree model and generates multiple decision trees by randomly sampling samples and randomly selecting attributes. Finally, the final decision result is obtained by voting among the multiple decision trees.

[0032] URL (Uniform Resource Locator): A Uniform Resource Locator is a method of representing the location of information on the World Wide Web services of the Internet. Every file on the Internet has a unique URL, which contains information indicating the file's location and how the browser should handle it. A Uniform Resource Locator consists of two parts: a protocol identifier and a resource name.

[0033] Reference Figure 1 The following is a flowchart of a method for detecting harmful URLs provided in an embodiment of the present invention, including but not limited to the following steps:

[0034] Step S100: Obtain URL data, which includes harmful URL data and normal URL data.

[0035] Specifically, this embodiment uses the WEBSPAM-UK2007 dataset as harmful URL data. Harmful URL data also refers to malicious URL data or malicious URLs, which are malicious programs such as Trojans and viruses planted in websites to lure users to visit the URLs of those websites by disguising website service content. In addition, this embodiment obtains deduplicated URLs from the Alexa top websites as normal URL data.

[0036] Step S200: Create word features based on URL data, whereby word features are used to summarize the characteristics of URL data.

[0037] Specifically, this embodiment analyzes URL data, summarizes the common word features of these URLs, classifies the URLs in the training set based on these word features, and trains a random forest model to detect harmful URLs in the test set.

[0038] In some embodiments, as shown in Table 1 below, the word features in step S200 may include, but are not limited to:

[0039] Table 1

[0040]

[0041]

[0042] Among them, the domain name information entropy in the URL can be expressed by the formula Obtain, p(x) i ) represents the symbol x i The frequency of occurrence in a domain name; character continuity rate specifically refers to the ratio of the sum of the maximum continuous lengths of the characters in a URL, which are divided into three categories: letters, numbers, and symbols, to the URL length.

[0043] It should be noted that this embodiment uses commonly found word features in URLs as classification attributes. In the preprocessing stage, only word feature statistics need to be performed on each URL in the training set. On the one hand, compared to training the recognition model by crawling web page content, the computational resources consumed are greatly reduced, because recognition through web page content requires computational processing of the entire web page data. In contrast, the computational workload of calculating and processing URL word features is much smaller. On the other hand, compared to techniques that process directly through URLs, recognition through URL word features has higher real-time performance and accuracy. Furthermore, compared to identifying harmful URLs through network activity, extracting URL word features does not require visiting the website corresponding to the URL, thus making it more secure.

[0044] Step S300: Create training and test sets based on URL data, and statistically analyze the word features of the URL data in the training set.

[0045] Specifically, in this embodiment, two-thirds of the URL data obtained in the above steps are used as the training set data, and the remaining one-third is used as the test set data. The training set includes URL data and word features of each URL. Since this embodiment uses a supervised machine learning algorithm, such algorithms require a large number of labeled normal or harmful URLs as the training set. Therefore, word features need to be extracted from each URL in the training set, and for each word feature, the URL data possessing that feature are statistically analyzed.

[0046] Step S400: Construct a decision tree and generate a random forest model based on the word features of the URL data in the training set.

[0047] Specifically, the word features of each URL in the training set can be extracted through the above steps. Then, these word features of the training URLs can be used as classification attributes to filter and classify the URLs layer by layer, and finally a decision tree that can distinguish between harmful and normal URLs can be trained. Thus, the trained random forest model composed of several decision trees can be used to classify and judge the URLs in the test set.

[0048] Furthermore, step S400 may include, but is not limited to, the following steps:

[0049] Step S410: Create n new training sets based on the training set using a random sampling with replacement mechanism, where n is an integer greater than zero.

[0050] In this embodiment, generating n new training sets based on the original training set is to train n decision trees to build a random forest model. The random sampling with replacement mechanism is used to create these n new training sets to ensure the randomness of the data and the breadth of the final trained model.

[0051] Step S420: Construct n decision trees based on the word features of the URL data in the n new training sets, and generate a random forest model including the n decision trees.

[0052] Furthermore, step S420 may include, but is not limited to, the following steps:

[0053] Step S421: Calculate the information entropy of the new training set and the information entropy of the word features in the new training set.

[0054] Step S422: Calculate the information gain of the word features based on the information entropy of the new training set and the information entropy of the word features.

[0055] Step S423: Construct a decision tree based on the information gain of word features.

[0056] Furthermore, step S423 may include, but is not limited to, the following steps:

[0057] Step S4231: Select the word feature with the largest information gain and store it in the branch node. The branch node is used as a partitioning attribute to classify the URL data.

[0058] Step S4232: Based on the classification results of the URL data, determine the decision category represented by the leaf node.

[0059] Specifically, machine learning methods are used to learn and train the URL data in each new training set to obtain a trained decision tree model. In this embodiment, n new training sets are generated, and correspondingly, n decision trees need to be trained from the URL data in these n new training sets. For each new training set, steps S421 to S423 above can be performed to construct a decision tree: First, the information entropy of the new training set is calculated according to the information entropy calculation formula, which is as follows: Where H(X) is the information entropy of the training set X, and P(x) is the information entropy of the training set X. iLet be the proportion of URLs of the i-th class in the training set X. In this embodiment, URLs are divided into harmful URLs and normal URLs, so the categories of URLs are binary, i.e., n=2. Thus, i has two values ​​representing harmful URLs and normal URLs, respectively. For each category, the number of URLs belonging to that category is counted, and then the proportion of that type of URLs in the training set can be calculated. Next, for each word feature of the URLs in the new training set, the information entropy of each word feature is calculated. First, the possible deviations of a certain word feature are counted, and then the training set X is... The process involves partitioning the dataset, resulting in subsets of URLs with the same word features. The information entropy of the subset with the number of distinct values ​​obtained after partitioning using these word features is then calculated. Next, based on the information entropy of the new training set and the information entropy of each word feature, the information gain of each word feature is calculated. Since the key to decision tree construction lies in selecting the optimal partitioning attribute, for binary classification, this means maximizing the number of samples partitioned into the same category—that is, the attribute with the highest purity. Generally, a larger information gain indicates a greater "purity improvement" achieved by using word features with that information gain value to partition the new training set. Therefore, information gain can be used to select the splitting attribute in a decision tree. That is, the word feature with the largest information gain is selected as the splitting attribute. For constructing a decision tree, the splitting attribute at the root node is the word feature with the largest information gain obtained after filtering all word features. Taking the word feature "proportion of numbers in the URL" in this embodiment as an example, how to classify the URL data in the new training set based on this word feature requires defining branching rules. For example, specifying the numerical ranges for classification: 0, (0, 0.3], (0.3, 0.7], and (0.7, 1.0], will classify the values ​​falling within the same numerical range. The URL data is divided into one category, which is a branch of the root node. This process continues recursively, dividing each branch node until a termination condition is met. In this embodiment, the termination condition can be: 1. All samples in the current node belong to the same category, no division is needed; 2. The set of current word features is empty, or all samples have the same value on all word features, making division impossible; 3. The sample set in the current node is empty, making division impossible. After the division is complete, the current node is marked as a harmful or normal leaf node, thus determining the decision category represented by the leaf node. Finally, the process returns recursively.

[0060] Step S500: Detect whether the URLs in the test set are harmful URLs based on the random forest model.

[0061] The random forest model consists of n decision trees generated in the above steps, and these decision trees are treated as a whole to form the random forest model. URL data is progressively filtered and divided using word-feature-based classification attributes until all subsets consist of URLs of a single category. Decision trees and a random forest model are then constructed. After demonstrating the ability to identify harmful URLs in the new training set, the model's ability to identify such URLs is validated using a test set.

[0062] Furthermore, step S500 may include, but is not limited to, the following steps:

[0063] Step S510: Extract word features from the URL data in the test set.

[0064] Step S520: Detect whether the URL data in the test set is a harmful URL based on word features and a random forest model.

[0065] Furthermore, step S520 may include, but is not limited to, the following steps:

[0066] Step S521: Utilize each decision tree in the random forest model to detect URL data based on the word features of the URL data.

[0067] Step S522: Summarize the classification results of each decision tree based on a simple voting method to determine whether the URL data is a harmful URL.

[0068] Specifically, firstly, the word features of each URL in the test set are extracted as classification attributes when using the random forest model for identification. Next, since the random forest model consists of n decision trees, n decision trees are used as detection models to detect harmful URLs n times on the URL data in the test set, and n decision results are obtained. Finally, the decision results of each decision tree are summarized based on the simple voting method to obtain the final detection result. The simple voting method is to let each decision tree in the random forest detect whether the URL is harmful, and the result with the most detections is taken as the final detection result.

[0069] Reference Figure 2This is an example of a decision tree constructed in this embodiment. The word feature at the root node is the proportion of numbers in the URL. This means that when using this decision tree to detect the test set, the URL data is first classified according to the numerical proportion of numbers in the URL. The classification criteria are shown in the classification intervals on the branch path, dividing the data into four subsets. The URL data in each subset has the same proportion of numbers in the URL. Then, the URL data in each subset is classified step by step. Taking the subset with a proportion of zero numbers in the URL as an example, since the word feature at this node is the ratio of domain name length to total length, and the branch of this node is in the interval [0, 0.5) and ( Using [0.5, 1.0] as the classification standard, URLs in this subset whose domain length and total length ratio fall within the interval [0, 0.5) are classified into one category as a new node, and URLs whose domain length and total length ratio fall within the interval (0.5, 1.0] are classified into another category as sibling nodes of the previous node. Since the above classification reaches the decision node at the bottom of the decision tree, the URLs falling within the intervals [0, 0.5) and (0.5, 1.0] can be determined as harmful URLs and normal URLs, respectively, based on the label of the decision node. Thus, the results of detecting URL data in the test set using this decision tree are obtained.

[0070] Reference Figure 3 The diagram below illustrates an algorithm in this embodiment. From top to bottom, the steps are: Initialization: acquiring URL data and creating word features; Preprocessing: creating a training set and extracting word features from each URL in the training set; Random sampling with replacement: creating n new training sets based on the training set using random sampling with replacement; Generating decision trees: training n corresponding decision tree models based on each word feature of the URL data in the n new training sets; Generating random forest: the random forest model consists of n decision tree models; Simple voting decision: using a simple voting method to vote on the decisions made by each decision tree in the random forest model to obtain the final detection results of harmful URL data in the test set.

[0071] The embodiments of the present invention include at least the following beneficial effects: By using the word features of URLs instead of traditional webpage content as the attribute for detecting whether a URL is harmful, the time for building and training the detection model can be reduced. Since the amount of data required for training using URL word features is significantly reduced, training time is also reduced. By using the word features of URL data as node parameters of the decision tree model, unlike the unknowable parameters of deep neural networks, the parameters of the decision tree model can be manually selected and tuned, improving the visualization of the detection model and making model analysis and optimization easier. Since only the word features of the URL data need to be calculated, the amount of data processing can be reduced during the detection process, increasing detection speed. Compared to existing technologies that directly process URLs, classifying URLs layer by layer using URL word features enables the detection results to have higher real-time performance and accuracy. Furthermore, when facing new personalized small sample tasks, since the original data used only includes URLs and does not involve access to existing webpages, there are no concerns about security and computing power, allowing the trained detection model to have better adaptability and improving the practical value of the system.

[0072] Reference Figure 4 This invention provides a schematic diagram of a system for detecting harmful URLs, including but not limited to:

[0073] The first processing module 401 is used to obtain URL data, wherein the URL data includes harmful URL data and normal URL data;

[0074] The second processing module 402 is used to create word features based on URL data, wherein the word features are used to summarize the characteristics of the URL data;

[0075] The third processing module 403 is used to create training and testing sets based on URL data and to statistically analyze the word features of the URL data in the training set.

[0076] The fourth processing module 404 is used to construct a decision tree and generate a random forest model based on the word features of the URL data in the training set;

[0077] The fifth processing module 405 is used to detect whether the URL data in the test set is a harmful URL based on the random forest model.

[0078] This invention provides an electronic device, such as... Figure 5 As shown, the electronic device includes a memory 501 and a processor 502; the memory 501 is used to store one or more computer programs; the processor 502 is used to implement the method for detecting harmful URLs provided in the embodiments of the present invention when executing the programs stored in the memory 501.

[0079] This invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method for detecting harmful URLs provided in this invention.

[0080] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital substation (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0081] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0082] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for electronic devices and computer-readable storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0083] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for detecting harmful URLs, characterized in that, include: Obtain URL data, wherein the URL data includes harmful URL data and normal URL data; Word features are created based on the URL data, wherein the word features are used to summarize the characteristics of the URL data; A training set and a test set are created based on the URL data, and the word features of the URL data in the training set are statistically analyzed. Constructing a decision tree and generating a random forest model based on the word features of the URL data in the training set includes: creating n new training sets based on the training set using a random sampling with replacement mechanism, where n is an integer greater than zero; constructing n decision trees based on the word features of the URL data in the n new training sets, and generating a random forest model including the n decision trees. The random forest model is used to detect whether the URLs in the test set are harmful URLs. The process of constructing n decision trees based on the word features of the URL data in the n new training sets, and generating a random forest model including the n decision trees, includes: calculating the information entropy of the new training set and the information entropy of the word features in the new training set; calculating the information gain of the word features based on the information entropy of the new training set and the information entropy of the word features; constructing the decision trees based on the information gain of the word features; selecting the word feature with the largest information gain and storing it in a branch node, the branch node being used as a partitioning attribute to classify the URL data; and determining the decision category represented by the leaf node based on the classification result of the URL data. The splitting attribute at the root node of the decision tree is the word feature with the maximum information gain.

2. The method for detecting harmful URLs according to claim 1, characterized in that, The word features include: domain name information entropy, character continuity, the ratio of request parameter length to path length, the ratio of request parameter length to the total length of URL data, the ratio of request parameter length to domain name length, the ratio of domain name length to the total length of URL data, the ratio of path length to the total length of URL data, the ratio of path length to domain name length, the number of punctuation marks in the domain name, the number of numbers in the access request portion, the number of domain name tags, the number of top-level domains in the domain name, the proportion of numbers in the domain name, the proportion of numbers in directory names, the proportion of numbers in file names, the proportion of numbers in the URL data, the proportion of numbers in the path, the total length of the URL data, the domain name length, the file name length, the length of the longest word in the request parameters, the length of the longest path tag, the average length of the path, the number of alphanumeric substrings in the URL data, and the number of special characters in the URL data.

3. The method for detecting harmful URLs according to claim 1, characterized in that, The step of detecting whether the URL data in the test set is a harmful URL based on the random forest model includes: Extract the word features of the URL data in the test set; The URLs in the test set are used to detect whether they are harmful URLs based on the word features and the random forest model.

4. The method for detecting harmful URLs according to claim 3, characterized in that, The step of detecting whether the URL data in the test set is a harmful URL based on the word features and the random forest model includes: Using each decision tree in the random forest model, the URL data is detected based on the word features of the URL data; The classification results of each decision tree are aggregated using a simple voting method to determine whether the URL data is a harmful URL.

5. A system for detecting harmful URLs, characterized in that, include: The first processing module is used to obtain URL data, wherein the URL data includes harmful URL data and normal URL data; The second processing module is used to create word features based on the URL data, wherein the word features are used to summarize the characteristics of the URL data; The third processing module is used to create a training set and a test set based on the URL data, and to statistically analyze the word features of the URL data in the training set. The fourth processing module is used to construct decision trees and generate a random forest model based on the word features of the URL data in the training set, including: creating n new training sets based on the training set using a random sampling with replacement mechanism, where n is an integer greater than zero; constructing n decision trees based on the word features of the URL data in the n new training sets, and generating a random forest model including the n decision trees; The fifth processing module is used to detect whether the URL data in the test set is a harmful URL based on the random forest model. The process of constructing n decision trees based on the word features of the URL data in the n new training sets, and generating a random forest model including the n decision trees, includes: calculating the information entropy of the new training set and the information entropy of the word features in the new training set; calculating the information gain of the word features based on the information entropy of the new training set and the information entropy of the word features; constructing the decision trees based on the information gain of the word features; selecting the word feature with the largest information gain and storing it in a branch node, the branch node being used as a partitioning attribute to classify the URL data; and determining the decision category represented by the leaf node based on the classification result of the URL data. The splitting attribute at the root node of the decision tree is the word feature with the maximum information gain.

6. An electronic device comprising a processor, a memory, and one or more programs stored in the memory and configured to be executed by the processor, the programs including methods for performing the detection of harmful URLs as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The system stores processor-executable program instructions for performing the method for detecting harmful URLs as described in any one of claims 1-4.

Images