Gray Website Identification Method and Device

Abstract

This invention provides a method and apparatus for identifying gray websites. The method includes: matching information of a website to be identified with a gray website identification feature library to determine whether the website to be identified is a gray website; if the website to be identified is determined to be a gray website, determining the family fingerprint features of the website to be identified; and supplementing the family fingerprint features into the gray website identification feature library. The gray website identification method and apparatus provided by this invention perform real-time identification of the website to be identified using the gray website identification feature library, supplement the identification feature library with the family fingerprint features of identified gray websites, improve the gray website identification feature library, and complete the gray website identification work by combining gray website information features and family fingerprint features, thereby achieving better identification results, realizing accurate identification of gray websites, and enabling timely dispatch of relevant personnel for interception to avoid damage to user rights.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and apparatus for identifying gray websites. Background Technology

[0002] Gray websites typically refer to sites selling private game servers, adult content, gambling, phishing, and similar services. The enormous profits of these gray industries drive many to risk creating them. Despite strict laws and regulations in China cracking down on gray websites, many still emerge, primarily due to their high profitability. Current methods for combating gray websites involve blocking, intercepting domain names, blocking payment accounts, and disrupting server access. Interception methods mainly utilize mobile network support tools and manual analysis by analysts. Operators identify gray websites through complaint channels and user feedback, while also using network management platforms to obtain suspicious domain names and conduct manual analysis.

[0003] Complaint channels and user feedback are crucial for collecting information on suspected gray-market websites, enabling precise identification and location of such sites. Collecting and aggregating gray-market website domain data to form a gray-market domain database allows for the interception of these websites. However, collecting information through complaint channels and user feedback is often delayed, with gray-market website interception only initiated after user rights have been violated. Furthermore, complaint channels and user feedback have significant limitations, yielding limited data on gray-market websites. Faced with the increasingly rampant gray-market industry, this approach struggles to effectively protect user rights.

[0004] Manual identification via network management platforms primarily involves collecting big data from the platform, extracting abnormal domain name information, and conducting manual analysis and identification. Based on this big data, gray-area websites are manually identified and blocked to prevent user rights from being infringed. However, the volume of abnormal domain name information collected through network management platforms is too large, manual identification is time-consuming and inefficient, and due to the short-lived nature of gray-area websites, their domain name information may have changed by the time manual identification is completed, making it impossible to effectively and promptly block gray-area websites. Summary of the Invention

[0005] This invention provides a method and apparatus for identifying gray websites, in order to solve the technical problem of how to identify gray websites.

[0006] In a first aspect, the present invention provides a method for identifying gray websites, comprising:

[0007] The information of the website to be identified is matched with the gray website identification feature library to determine whether the website to be identified is a gray website;

[0008] If the website to be identified is determined to be a gray website, the family fingerprint characteristics of the website to be identified are determined.

[0009] The family fingerprint features are added to the gray website identification feature library.

[0010] In one embodiment, the gray website identification feature library also includes a feature set of gray websites;

[0011] The feature set is obtained by extracting features from pre-determined gray websites using a priori algorithm.

[0012] In one embodiment, determining the family fingerprint characteristics of the website to be identified when it is determined to be a gray website includes:

[0013] Based on the digital certificate of the website to be identified, the SubjectAltNames extension in the digital certificate is parsed, and the domain name in the digital certificate is determined;

[0014] The set of domains in the digital certificate is considered a gray website family;

[0015] Based on the information of the gray website family, the family fingerprint characteristics of the website to be identified are determined.

[0016] In one embodiment, determining the family fingerprint characteristics of the website to be identified based on the information of the gray website family includes:

[0017] Based on the information of the gray website family, determine the style characteristics of the gray website family;

[0018] Based on the style features of the gray website family and the weight values ​​corresponding to the style features of the gray website family, the correlation of each style feature in the gray website family is determined by the logistic regression algorithm.

[0019] Based on the correlation of the aforementioned pattern features, family fingerprint features are determined.

[0020] In one embodiment, determining family fingerprint features based on the correlation of the various style features includes:

[0021] Style features with a correlation coefficient greater than or equal to 0.5 are used as family fingerprint features.

[0022] In one embodiment, the gray website family style features include: IP information, domain name information, structured web page information, and operational information.

[0023] In one embodiment, the feature set includes: domain name rules, IP mapping rules, content keywords, and website structure.

[0024] In a second aspect, the present invention provides a gray website identification device, comprising:

[0025] The matching module is used to match the information of the website to be identified with the gray website identification feature library to determine whether the website to be identified is a gray website.

[0026] The determination module is used to determine the family fingerprint characteristics of the website to be identified when it is determined that the website to be identified is a gray website;

[0027] The supplementary module is used to supplement the family fingerprint features into the gray website identification feature library.

[0028] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the gray website identification method described in the first aspect.

[0029] Fourthly, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the gray website identification method described in the first aspect.

[0030] The gray website identification method, device, electronic device, and storage medium provided by this invention perform real-time identification of the website to be identified through a gray website identification feature library. The family fingerprint features of the identified gray websites are added to the identification feature library to improve the gray website identification feature library. By combining gray website information features and family fingerprint features, the identification of gray websites is completed, resulting in better identification effect. This achieves accurate identification of gray websites and can promptly send relevant personnel to intercept them, preventing damage to users' rights. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating the gray website identification method provided by the present invention;

[0033] Figure 2This is a schematic diagram of the gray website identification device provided by the present invention;

[0034] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0036] Figure 1 This is a flowchart illustrating the gray website identification method provided by the present invention. (Refer to...) Figure 1 The gray website identification method provided by this invention may include:

[0037] S110. Match the information of the website to be identified with the gray website identification feature database to determine whether the website to be identified is a gray website;

[0038] S120. If the website to be identified is determined to be a gray website, determine the family fingerprint characteristics of the website to be identified.

[0039] S130. Add family fingerprint features to the gray website identification feature library.

[0040] It should be noted that the executing entity of the gray website identification method provided by this invention can be an electronic device, a component in an electronic device, an integrated circuit, or a chip. The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This invention does not impose specific limitations.

[0041] Specifically, in step S110, the information of the website to be identified is matched with a gray website identification feature library to determine whether the website to be identified is a gray website. For a website to be identified, it may be a gray website or a normal website. The identification feature library can be a collection of address features, page content features, and domain name features extracted based on gray website information. By obtaining the address information, page content information, and domain name information of the website to be identified, and matching the information of the website to be identified with the information in the identification feature library, it can be determined whether the website to be identified is a gray website.

[0042] In step S120, if the website to be identified is determined to be a gray website, the family fingerprint features of the website to be identified are determined. When the website to be identified is identified as a gray website, the family fingerprint features of the website to be identified are extracted, which are the family fingerprint features of the gray website. It can be understood that the family of gray websites consists of websites related to the gray website, and the family fingerprint features are the features of the websites related to the gray website.

[0043] In step S130, family fingerprint features are added to the gray website identification feature library. By adding family fingerprint features identified as gray websites to the identification feature library, the gray website identification feature library can be further improved. By combining gray website information features and family fingerprint features, the identification of gray websites is completed, resulting in better identification effect and more accurate identification results.

[0044] The gray website identification method provided by this invention performs real-time identification of the website to be identified through a gray website identification feature library. It supplements the identification feature library with the family fingerprint features of the identified gray websites, thereby improving the gray website identification feature library. By combining gray website information features and family fingerprint features, the gray website identification work is completed, resulting in better identification effect. This achieves accurate identification of gray websites and can promptly send relevant personnel to intercept them, preventing damage to users' rights and interests.

[0045] In one embodiment, the gray website identification feature library also includes a feature set of gray websites;

[0046] The feature set is obtained by extracting features from pre-determined gray websites using a priori algorithms.

[0047] Specifically, a key feature matching identification method is used to identify gray website domains for suspicious websites obtained through complaints and user feedback channels. Initially, a key feature identification engine is used for discrimination. This involves extracting IP information, domain information, title content information, and webpage content information from the gray website, creating a word cloud from the extracted keywords, and calculating their probabilities. The probability of each word appearing in the entire webpage content is calculated, with some interjections pre-removed. Words with a probability of occurrence greater than or equal to 80% are used as keywords. The program then uses multi-level automated key feature judgment to identify gray websites.

[0048] Based on the gray websites identified by the recognition engine, information such as domain names, server information, webpage content, and website architecture is collected to form a gray website dataset. Features are then extracted from this dataset. Frequent feature set mining can effectively extract data features. This invention employs the Apriori algorithm for frequent feature set mining. The core idea of ​​the Apriori algorithm is to utilize prior knowledge of frequent itemsets and use a hierarchical search technique, where k-itemsets are used to generate k+1 itemsets. Association rule mining is a two-step process: first, all frequent itemsets are identified, and then strong association rules are generated from these frequent itemsets.

[0049] By mining the feature set of gray websites using the aforementioned prior algorithm, the data features of gray websites can be effectively extracted.

[0050] In one embodiment, the feature set includes: domain name rules, IP mapping rules, content keywords, and website structure.

[0051] The gray website identification method provided by this invention collects relevant information such as domain name information, server information, web page content, and website architecture of gray websites to form a gray website dataset. Then, a priori algorithm is used to extract and mine the feature set of gray websites, which can effectively extract the data features of gray websites for real-time identification of the websites to be identified by the gray website identification feature library.

[0052] In one embodiment, when the website to be identified is determined to be a gray website, determining the family fingerprint characteristics of the website to be identified includes:

[0053] Based on the digital certificate of the website to be identified, parse the SubjectAltNames extension in the digital certificate and determine the domain name in the digital certificate;

[0054] The collection of domains in the digital certificate is considered a family of gray websites;

[0055] Based on information about the gray website family, determine the family fingerprint characteristics of the website to be identified.

[0056] Specifically, analysis of gray-area websites obtained through complaints and user feedback channels reveals that some of these websites use HTTPS for encrypted access. Packet capture analysis shows that accessing these encrypted gray-area websites requires downloading a digital certificate before the website can be opened normally. Furthermore, the packet captures show that the SubjectAltNames extension in the digital certificates of these gray-area websites contains various different domains belonging to the same team. Further analysis of domains belonging to the same team reveals that most of these domains point to gray-area websites. Based on this finding, it can be concluded that the domains in the digital signature certificates belong to the same family.

[0057] For gray-area websites accessed via encryption, their digital certificates contain domains associated with them. Since obtaining a digital certificate for each domain is costly, the common practice is to apply for a single certificate for multiple domains. When one domain is blocked, the others remain accessible, and the digital certificate itself continues to function normally. By cracking the gray-area website's digital certificate and obtaining its signature information, we can uncover the registered company's information and the multiple domains listed in the certificate. Since these domains all point to the gray-area website, this group can be considered a gray-area website family. By extracting the characteristics of these domains as the gray-area website family fingerprint, we can determine the family fingerprint of the website to be identified—that is, the gray-area website family fingerprint.

[0058] For example, by obtaining a batch of gray domains from a gray-scale website family, analysis reveals that these gray domains share common operational characteristics, such as: the domain registration locations all point to the same location, the domain registrants all point to the same person, the registration time is all less than one month, and the code in the website architecture corresponding to the domains all contains the same keywords, etc. These conditions can be unified as family fingerprint characteristics.

[0059] The gray website identification method provided by this invention expands gray website information through digital certificates of gray websites, providing a large amount of data for gray website feature analysis. It supplements the gray website identification feature library with gray website family fingerprint features, enabling the identification of gray websites based on gray website family fingerprint capture and feature recognition analysis. This achieves accurate gray website identification, improves the efficiency of analysts and the accuracy of analysis results, and reduces the human resource requirements for gray website identification analysis.

[0060] In one embodiment, determining the family fingerprint characteristics of the website to be identified based on information about the gray website family includes:

[0061] Based on information about gray website families, determine the style characteristics of gray website families;

[0062] Based on the style characteristics of gray website families and the corresponding weight values ​​of the style characteristics of gray website families, the correlation of each style characteristic in the gray website family is determined by the logistic regression algorithm.

[0063] Based on the correlation of various pattern features, family fingerprint characteristics are determined.

[0064] Specifically, extended domain names obtained from the analysis of digital certificates of gray websites form a family of gray websites. Based on the domain names of this family of gray websites, further information such as their IP addresses, domain names, web page data, and operational structure is obtained.

[0065] In one embodiment, the gray website family style features include: IP information, domain name information, structured web page information, and operational information.

[0066] This process involves searching for IP server links and distribution information, domain name registration and filing information, structured web page information related to gray websites, and information related to the operation of gray websites, forming a dataset. The dataset's features are then mined. Based on the frequency of information occurrence within the analyzed website families and preset thresholds, the pattern characteristics of various information such as IP addresses, domain names, structured web page information, and operation-related information are derived. The correlation of these pattern characteristics within the website families is calculated, identifying highly correlated features and forming website family fingerprints. This completes the capture and output of gray website family fingerprints.

[0067] Gray website family fingerprint capture aims to identify association sets that match the family identification features of gray websites from a large dataset of family websites. This is essentially a supervised classification problem. This application employs a logistic regression algorithm to obtain a family fingerprint capable of identifying gray websites. Logistic regression is robust, less prone to overfitting, and its results are easy to interpret. With proper feature preparation, logistic regression can achieve excellent results.

[0068] For example, a gray website family fingerprint capture model can be constructed based on gray website family information. The gray website family fingerprint capture model includes: a search module, a style feature extraction module, and a fingerprint calculation module.

[0069] The search module is used to search for information such as IP server links and distribution information, domain name registration and filing information, structured web page information related to gray websites, and information related to the operation of gray websites, and to form a dataset.

[0070] The style feature extraction module is used to mine the features of the dataset obtained by the search module. Based on the frequency of information occurrence in the website family analyzed in the dataset and the preset threshold, it derives the style features of various information such as IP, domain name, structured web page information, and operation-related information.

[0071] The fingerprint calculation module is used to calculate and determine the fingerprint of gray website family, calculate the correlation of various style features in the website family, obtain highly correlated feature items and form the website family fingerprint, complete the capture of gray website family fingerprint and output fingerprint features.

[0072] The gray website family dataset and its various style features are digitized to form a new dataset. 80% of the dataset is used as the training set, and 20% as the test set. Both the training and test sets include style features and judgment results. From the dataset, we know that each family fingerprint sample has multiple style features and one label. Our task is to capture the family fingerprint using multiple style features, calculated using a logistic regression model. The algorithm is as follows:

[0073] z = b + w1x1 + w2x2 + w3x3 + ... + w n x n

[0074]

[0075] Where, x i w represents the i-th style feature. i Let b represent the weight value corresponding to the i-th feature, and b represent the bias.

[0076] The following can be obtained by changing the formula:

[0077] z = w0x0 + w1x1 + w2x2 + w3x3 + ... + w n x n

[0078] Where x0 equals 1.

[0079] θ = (w0, w1, w2, ..., w n )

[0080] X = (x0, x1, x2, ..., x...) n )

[0081]

[0082] By inputting the sample data into the algorithm described above, the correlation of each style feature can be obtained.

[0083] In one embodiment, determining family fingerprint features based on the correlation of various pattern features includes:

[0084] Pattern features with a correlation coefficient greater than or equal to 0.5 are used as family fingerprint features.

[0085] Specifically, if the predicted value is greater than or equal to 0.5, it is determined to be type 1; if it is less than 0.5, it is determined to be type 0 (type 1 conforms to family fingerprints, and type 0 does not conform to family fingerprints).

[0086] The gray website identification method provided by this invention supplements the gray website identification feature library with gray website family fingerprint features. It can complete the identification of gray websites based on gray website family fingerprint capture and feature recognition analysis, achieve accurate gray website identification, improve the efficiency of analysts and the accuracy of analysis results, and reduce the human resource requirements for gray website identification analysis.

[0087] The gray website identification device provided by the present invention is described below. The gray website identification device described below can be referred to in correspondence with the gray website identification method described above.

[0088] Figure 2 This is a schematic diagram of the gray website identification device provided by the present invention, as shown below. Figure 2 As shown, the device may include:

[0089] The matching module 210 is used to match the information of the website to be identified with the gray website identification feature library to determine whether the website to be identified is a gray website.

[0090] The determination module 220 is used to determine the family fingerprint characteristics of the website to be identified when it is determined that the website to be identified is a gray website;

[0091] Supplementary module 230 is used to supplement family fingerprint features into the gray website identification feature library.

[0092] The gray website identification device provided by this invention performs real-time identification of the website to be identified through a gray website identification feature library. It supplements the identification feature library with the family fingerprint features of the identified gray websites, thereby improving the gray website identification feature library. By combining gray website information features and family fingerprint features, the identification of gray websites is completed, resulting in better identification effect. This achieves accurate identification of gray websites and can promptly send relevant personnel to intercept them, preventing damage to users' rights.

[0093] In one embodiment, the gray website identification feature library also includes a feature set of gray websites;

[0094] The feature set is obtained by extracting features from pre-determined gray websites using a priori algorithms.

[0095] In one embodiment, the determining module 220 is specifically used for:

[0096] Based on the digital certificate of the website to be identified, parse the SubjectAltNames extension in the digital certificate and determine the domain name in the digital certificate;

[0097] The collection of domains in the digital certificate is considered a family of gray websites;

[0098] Based on information about the gray website family, determine the family fingerprint characteristics of the website to be identified.

[0099] In one embodiment, the determining module 220 is specifically used for:

[0100] Based on information about gray website families, determine the style characteristics of gray website families;

[0101] Based on the style characteristics of gray website families and the corresponding weight values ​​of the style characteristics of gray website families, the correlation of each style characteristic in the gray website family is determined by the logistic regression algorithm.

[0102] Based on the correlation of various pattern features, family fingerprint characteristics are determined.

[0103] In one embodiment, the determining module 220 is specifically used for:

[0104] Pattern features with a correlation coefficient greater than or equal to 0.5 are used as family fingerprint features.

[0105] In one embodiment, the gray website family style features include: IP information, domain name information, structured web page information, and operational information.

[0106] In one embodiment, the feature set includes: domain name rules, IP mapping rules, content keywords, and website structure.

[0107] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the gray website identification method provided by the above methods.

[0108] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call the computer program in the memory 330 to execute the steps of the gray website identification method provided in the above embodiments, such as including:

[0109] The information of the website to be identified is matched with the gray website identification feature library to determine whether the website to be identified is a gray website;

[0110] If the website to be identified is determined to be a gray website, determine the family fingerprint characteristics of the website to be identified;

[0111] Family fingerprint features were added to the gray website identification feature library.

[0112] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer is able to perform the steps of the gray website identification method provided in the above embodiments, such as including:

[0114] The information of the website to be identified is matched with the gray website identification feature library to determine whether the website to be identified is a gray website;

[0115] If the website to be identified is determined to be a gray website, determine the family fingerprint characteristics of the website to be identified;

[0116] Family fingerprint features were added to the gray website identification feature library.

[0117] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon. The computer program is used to cause a processor to execute the steps of the gray website identification method provided in the above embodiments, such as including:

[0118] The information of the website to be identified is matched with the gray website identification feature library to determine whether the website to be identified is a gray website;

[0119] If the website to be identified is determined to be a gray website, determine the family fingerprint characteristics of the website to be identified;

[0120] Family fingerprint features were added to the gray website identification feature library.

[0121] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0122] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying gray websites, characterized in that, include: The information of the website to be identified is matched with the gray website identification feature library to determine whether the website to be identified is a gray website; If the website to be identified is determined to be a gray website, the family fingerprint characteristics of the website to be identified are determined. The family fingerprint features are added to the gray website identification feature library; When the website to be identified is determined to be a gray website, determining the family fingerprint characteristics of the website to be identified includes: Based on the digital certificate of the website to be identified, the SubjectAltNames extension in the digital certificate is parsed, and the domain name in the digital certificate is determined; The set of domains in the digital certificate is considered a gray website family; Based on the information of the gray website family, determine the family fingerprint characteristics of the website to be identified; The step of determining the family fingerprint characteristics of the website to be identified based on the information of the gray website family includes: Based on the information of the gray website family, determine the style characteristics of the gray website family; Based on the style features of the gray website family and the weight values ​​corresponding to the style features of the gray website family, the correlation of each style feature in the gray website family is determined by the logistic regression algorithm. Based on the correlation of the aforementioned pattern features, family fingerprint features are determined.

2. The gray website identification method according to claim 1, characterized in that, The gray website identification feature library also includes a feature set of gray websites; The feature set is obtained by extracting features from pre-determined gray websites using a priori algorithm.

3. The gray website identification method according to claim 1, characterized in that, The step of determining family fingerprint features based on the correlation of the various pattern features includes: Style features with a correlation coefficient greater than or equal to 0.5 are used as family fingerprint features.

4. The gray website identification method according to claim 3, characterized in that, The gray website family style features include: IP information, domain name information, structured web page information, and operational information.

5. The gray website identification method according to claim 2, characterized in that, The feature set includes: domain name rules, IP mapping rules, content keywords, and website structure.

6. A gray website identification device, characterized in that, include: The matching module is used to match the information of the website to be identified with the gray website identification feature library to determine whether the website to be identified is a gray website. The determination module is used to determine the family fingerprint characteristics of the website to be identified when it is determined that the website to be identified is a gray website; The supplementary module is used to supplement the family fingerprint features into the gray website identification feature library; When the website to be identified is determined to be a gray website, determining the family fingerprint characteristics of the website to be identified includes: Based on the digital certificate of the website to be identified, the SubjectAltNames extension in the digital certificate is parsed, and the domain name in the digital certificate is determined; The set of domains in the digital certificate is considered a gray website family; Based on the information of the gray website family, determine the family fingerprint characteristics of the website to be identified; The step of determining the family fingerprint characteristics of the website to be identified based on the information of the gray website family includes: Based on the information of the gray website family, determine the style characteristics of the gray website family; Based on the style features of the gray website family and the weight values ​​corresponding to the style features of the gray website family, the correlation of each style feature in the gray website family is determined by the logistic regression algorithm. Based on the correlation of the aforementioned pattern features, family fingerprint features are determined.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the gray website identification method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the gray website identification method as described in any one of claims 1 to 5.

Images