Network traffic interception method, device and computer-readable storage medium

Abstract

The present invention discloses a method, device, and computer-readable storage medium for intercepting network traffic. The method comprises: obtaining a preset domain name and generating similar domain names to the preset domain name; obtaining first webpage information corresponding to the similar domain name and second webpage information corresponding to the preset domain name; and, when the similarity between the first webpage information and the second webpage information exceeds a preset threshold, intercepting network traffic based on the preset domain name and the similar domain name. The present invention aims to reduce reliance on blacklists and effectively detect and intercept network traffic with similar domain names.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for intercepting network traffic, and a computer-readable storage medium. Background Art

[0002] When detecting certain domain names to intercept their network traffic, the detection is performed through the domain name URL (Uniform Resource Locator), and the detection is performed using the URL blacklist or sensitive feature words appearing in the URL. However, in order to avoid blocking, the holders of certain domain names will establish a series of similar URLs. The above-mentioned method relies too much on the blacklist and cannot effectively detect newly created similar domain names. Therefore, the present invention at least solves the following technical problem: how to reduce the reliance on the blacklist to effectively detect and intercept the network traffic of similar domain names. Summary of the Invention

[0003] The main purpose of the present invention is to provide a method, device and computer-readable storage medium for intercepting network traffic, aiming to reduce reliance on blacklists and effectively detect and intercept network traffic of similar domain names.

[0004] To achieve the above object, the present invention provides a method for intercepting network traffic, the method comprising:

[0005] Obtain a preset domain name and generate similar domain names to the preset domain name;

[0006] Obtaining first webpage information corresponding to the similar domain name and second webpage information corresponding to the preset domain name;

[0007] When the similarity between the first webpage information and the second webpage information is greater than a preset threshold, network traffic is intercepted according to the preset domain name and the similar domain name.

[0008] Optionally, the step of obtaining a preset domain name and generating a domain name similar to the preset domain name includes:

[0009] Obtaining the preset domain name;

[0010] The similar domain name of the preset domain name is generated by a pre-trained long short-term memory network prediction model.

[0011] Optionally, the step of generating the similar domain name of the preset domain name by using a pre-trained long short-term memory network prediction model includes:

[0012] Inputting the preset domain name into the long short-term memory network prediction model;

[0013] Obtaining a first output character of the long short-term memory network prediction model, and generating a target sequence including the first output character;

[0014] Inputting the target sequence into the long short-term memory network prediction model, and updating the target sequence according to the second output character generated by the long short-term memory network prediction model;

[0015] When the second output characters do not include a preset cutoff character, returning to the step of inputting the target sequence into the long short-term memory network prediction model;

[0016] When the second output character includes the preset cutoff character, the similar domain name is determined according to the updated target sequence.

[0017] Optionally, the step of updating the target sequence according to the second output character generated by the long short-term memory network prediction model includes:

[0018] The second output character is inserted at the end of the target sequence, and a target number of characters that are sorted in front of the target sequence are deleted to update the target sequence, wherein the target number is the number of characters of the second output character.

[0019] Optionally, before the step of obtaining the preset domain name, the method further includes:

[0020] Obtaining the original domain name, and extracting each original character contained in the original domain name;

[0021] Generate a first original sequence corresponding to each original character, wherein the original characters included in each of the first original sequences are partially identical, and the number of the first original sequences is the same as the number of the original characters;

[0022] generating a second original sequence corresponding to a preset cutoff character, wherein the second original sequence includes the original domain name;

[0023] Using the preset cutoff character and each of the original characters as input data, and using the second original sequence and each of the first original sequences as output data, to form training data including the input data and the output data;

[0024] A long short-term memory network training model is trained according to the training data to obtain the long short-term memory network prediction model.

[0025] Optionally, before the step of intercepting network traffic according to the preset domain name and the similar domain name when the similarity between the first webpage information and the second webpage information is greater than a preset threshold, the method further includes:

[0026] Calculating a first hash value corresponding to the first webpage information and a second hash value corresponding to the second webpage information;

[0027] Determine a Hamming distance between the first hash value and the second hash value;

[0028] The similarity between the first webpage information and the second webpage information is determined according to the Hamming distance.

[0029] Optionally, after the steps of obtaining a preset domain name and generating a domain name similar to the preset domain name, the method further includes:

[0030] Detecting whether the similar domain name is a real domain name;

[0031] When the similar domain name is the real domain name, performing the step of obtaining the first webpage information corresponding to the similar domain name and the second webpage information corresponding to the preset domain name;

[0032] When the similar domain name is not the real domain name, the similar domain name is discarded.

[0033] In addition, to achieve the above-mentioned purpose, the present invention further provides a network traffic interception device, the network traffic interception device comprising:

[0034] A domain name generation module, configured to obtain a preset domain name and generate a domain name similar to the preset domain name;

[0035] A web page information acquisition module, configured to acquire first web page information corresponding to the similar domain name and second web page information corresponding to the preset domain name;

[0036] The network traffic interception module is used to intercept network traffic according to the preset domain name and the similar domain name when the similarity between the first web page information and the second web page information is greater than a preset threshold.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also provides a network traffic interception device, which includes a memory, a processor, and a network traffic interception program stored on the memory and runnable on the processor. When the network traffic interception program is executed by the processor, the steps of the network traffic interception method described in any one of the above items are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a network traffic interception program is stored. When the network traffic interception program is executed by a processor, the steps of the network traffic interception method described in any one of the above-mentioned items are implemented.

[0039] The embodiments of the present invention propose a method, device and computer-readable storage medium for intercepting network traffic. The method obtains a preset domain name, generates a similar domain name of the preset domain name, obtains first web page information corresponding to the similar domain name, and second web page information corresponding to the preset domain name, and when the similarity between the first web page information and the second web page information is greater than a preset threshold, intercepts network traffic based on the preset domain name and the similar domain name. This method can actively generate similar domain names of the preset domain name, and further, based on the similarity between the first web page information corresponding to the similar domain name and the second web page information corresponding to the preset domain name, when it is detected that the similarity is greater than a preset threshold, intercepts network traffic based on the preset domain name and the similar domain name, avoiding the problem of similar websites being unable to effectively intercept network traffic caused by interception using a blacklist, and can achieve the effect of reducing reliance on blacklists to effectively detect and intercept network traffic of similar domain names. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of the hardware operating environment according to the embodiment of the present invention;

[0041] Figure 2 This is a flow chart of a first embodiment of a method for intercepting network traffic according to the present invention;

[0042] Figure 3 This is a flow chart of a second embodiment of a method for intercepting network traffic according to the present invention;

[0043] Figure 4 Schematic diagram of the flow of a third embodiment of the method for intercepting network traffic of the present invention;

[0044] Figure 5 Schematic diagram of a flow chart of a fourth embodiment of a method for intercepting network traffic of the present invention;

[0045] Figure 6 A schematic diagram of the architecture of a network traffic interception device according to the present invention;

[0046] Figure 7 A schematic diagram of generating similar domain names in a specific scenario;

[0047] Figure 8 A schematic diagram of generating training data in a specific scenario.

[0048] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0050] like Figure 1 As shown, Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention.

[0051] The device that intercepts network traffic can be a server or other computer equipment.

[0052] like Figure 1 As shown, the apparatus may include: a processor 1001, such as a CPU, a memory 1002, and a communication bus 1003. Communication bus 1003 is used to implement communication between these components. Memory 1002 may be a high-speed RAM memory or a non-volatile memory, such as a disk storage device. Memory 1002 may also optionally be a storage device independent of processor 1001.

[0053] Those skilled in the art will understand that Figure 1 The device structure shown in the figure does not constitute a limitation of the device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0054] like Figure 1 As shown, the memory 1002 as a computer storage medium may include a network traffic interception program.

[0055] exist Figure 1 In the device shown, the processor 1001 can be used to call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0056] Obtain a preset domain name and generate similar domain names to the preset domain name;

[0057] Obtaining first webpage information corresponding to the similar domain name and second webpage information corresponding to the preset domain name;

[0058] When the similarity between the first webpage information and the second webpage information is greater than a preset threshold, network traffic is intercepted according to the preset domain name and the similar domain name.

[0059] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0060] Obtaining the preset domain name;

[0061] The similar domain name of the preset domain name is generated by a pre-trained long short-term memory network prediction model.

[0062] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0063] Inputting the preset domain name into the long short-term memory network prediction model;

[0064] Obtaining a first output character of the long short-term memory network prediction model, and generating a target sequence including the first output character;

[0065] Inputting the target sequence into the long short-term memory network prediction model, and updating the target sequence according to the second output character generated by the long short-term memory network prediction model;

[0066] When the second output characters do not include a preset cutoff character, returning to the step of inputting the target sequence into the long short-term memory network prediction model;

[0067] When the second output character includes the preset cutoff character, the similar domain name is determined according to the updated target sequence.

[0068] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0069] The second output character is inserted at the end of the target sequence, and a target number of characters that are sorted in front of the target sequence are deleted to update the target sequence, wherein the target number is the number of characters of the second output character.

[0070] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0071] Obtaining the original domain name, and extracting each original character contained in the original domain name;

[0072] Generate a first original sequence corresponding to each original character, wherein the original characters included in each of the first original sequences are partially identical, and the number of the first original sequences is the same as the number of the original characters;

[0073] generating a second original sequence corresponding to a preset cutoff character, wherein the second original sequence includes the original domain name;

[0074] Using the preset cutoff character and each of the original characters as input data, and using the second original sequence and each of the first original sequences as output data, to form training data including the input data and the output data;

[0075] A long short-term memory network training model is trained according to the training data to obtain the long short-term memory network prediction model.

[0076] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0077] Calculating a first hash value corresponding to the first webpage information and a second hash value corresponding to the second webpage information;

[0078] Determine a Hamming distance between the first hash value and the second hash value;

[0079] The similarity between the first webpage information and the second webpage information is determined according to the Hamming distance.

[0080] Furthermore, the processor 1001 may call the network traffic interception program stored in the memory 1002 and perform the following operations:

[0081] Detecting whether the similar domain name is a real domain name;

[0082] When the similar domain name is the real domain name, performing the step of obtaining the first webpage information corresponding to the similar domain name and the second webpage information corresponding to the preset domain name;

[0083] When the similar domain name is not the real domain name, the similar domain name is discarded.

[0084] In the prior art, when detecting websites that need to be blocked (such as bad websites), the following two methods are usually used: one method is to detect through the website URL, such as using a URL blacklist or sensitive feature words appearing in the URL for detection; the other method is to detect based on the website page content, such as performing data processing on the page text, pictures, audio, video and other content of the website to be detected, and then judging whether the website is a bad website through model training.

[0085] Among the above-mentioned existing technologies, the first method relies excessively on blacklists. However, the holders of domain names on the blacklist often change keywords and website addresses to evade blocking, making it impossible to effectively detect new websites. In order to cope with blocking, some website holders will register a large number of similar URLs and domain names to evade supervision. The existing screening technology based on website URL blacklists has a serious lag in website blocking. In the second method, it is necessary to process the text, pictures, audio, video and other content in the page content, which requires a large amount of calculation, low detection efficiency, and cannot effectively identify image interference such as split pictures and combined pictures.

[0086] The present invention solves corresponding technical problems respectively in combination with the following multiple embodiments. Among them, first, some preset domain names are obtained, such as the domain names of confirmed bad websites, and the domain names of these websites are used to generate a series of model training samples, and the training samples are further used to train the Long Short Term Memory (LSTM) model. After the training is completed, the trained model can be used to generate some similar domain names. For example, the domain name of any confirmed bad website A is used as the model input, and the model output is N similar domain names. Further confirm which of the N similar domain names output are real websites, obtain the web page content of these real websites, use the simhash algorithm to calculate the web page content to obtain hash values, and at the same time calculate the hash value of the web page content of the bad website A, further determine which websites have a Hamming distance from the hash value of the bad website A that is less than a preset threshold, and finally determine that the website with a Hamming distance less than the preset threshold is a bad website. And intercept the network traffic of the bad website.

[0087] The technical solutions of the present invention are described below in conjunction with a number of embodiments.

[0088] Reference Figure 2 A first embodiment of the present invention provides a method for intercepting network traffic, the method comprising:

[0089] Step S10, obtaining a preset domain name and generating a domain name similar to the preset domain name;

[0090] A preset domain name is a pre-set domain name that requires network traffic interception. A similar domain name is a domain name with character combinations similar to the preset domain name.

[0091] By learning the character combination characteristics of different preset domain names, the artificial intelligence domain name generation model is trained, and similar domain names are automatically generated based on the artificial intelligence domain name generation model.

[0092] In a specific scenario, the preset domain name is xc87.com. Then, combined with the artificial intelligence domain name generation model, similar domain names such as 87xc.com and xc88.com can be generated to reduce dependence on blacklists.

[0093] Step S20, obtaining first webpage information corresponding to the similar domain name and second webpage information corresponding to the preset domain name;

[0094] The first web page information is information in a web page with a similar domain name, and the second web page information is information in a web page with a preset domain name.

[0095] After obtaining similar domain names, it is necessary to determine whether the similar domain names require network traffic interception.

[0096] Alternatively, the crawled web page information can be judged based on various means such as text intelligent classification algorithm, keyword matching, etc. For example, the crawled web page information can be detected to see whether it contains keywords of bad websites to identify bad websites and intercept network traffic for bad websites.

[0097] Alternatively, because malicious websites may include images, audio, and video in various formats, keyword matching can be computationally intensive and inefficient. In contrast, determining whether a similar domain name is a domain name to be blocked based on the similarity between the first and second webpage information eliminates the need for intelligent text classification algorithms or keyword matching, thereby reducing computational complexity and improving efficiency.

[0098] Step S30: When the similarity between the first webpage information and the second webpage information is greater than a preset threshold, network traffic is intercepted according to the preset domain name and the similar domain name.

[0099] The preset threshold is a pre-set similarity threshold that meets the similarity requirements.

[0100] In one specific scenario, the preset domain name is a domain name that has been pre-marked as a bad website. If the similarity is greater than a preset threshold, it can be determined that the similar domain name corresponding to the preset domain name is also the bad website. At this time, network traffic for the preset domain name and similar domain names can be intercepted. Using known bad website domain names to generate new bad website domain names can discover more bad websites and manage them, converting passive discovery after the fact to active discovery beforehand, changing the passive situation of bad information management and improving the effectiveness of bad information management.

[0101] Optionally, after step S10, it is also possible to detect whether the similar domain name is a real domain name. When the similar domain name is a real domain name, step S20 is executed. When the similar domain name is not the real domain name, the similar domain name is discarded. A real domain name refers to a domain name that actually exists on the Internet, that is, a domain name that can be accessed on the Internet. An attempt can be made to establish a communication connection with a similar domain name. If a communication connection can be successfully established, it indicates that the similar domain name is a real domain name, otherwise it is not a real domain name. When the similar domain name is a real domain name, the first web page information corresponding to the similar domain name and the second web page information corresponding to the preset domain name are obtained, and when the similarity between the first web page information and the second web page information is greater than a preset threshold, network traffic is intercepted according to the preset domain name and the similar domain name to avoid intercepting domain names that do not really exist.

[0102] In this embodiment, by obtaining a preset domain name and generating similar domain names of the preset domain name, obtaining first web page information corresponding to the similar domain name and second web page information corresponding to the preset domain name, when the similarity between the first web page information and the second web page information is greater than a preset threshold, network traffic is intercepted based on the preset domain name and the similar domain name. In this way, similar domain names of the preset domain name can be actively generated, and further based on the similarity between the first web page information corresponding to the similar domain name and the second web page information corresponding to the preset domain name, when it is detected that the similarity is greater than a preset threshold, network traffic is intercepted based on the preset domain name and the similar domain name, avoiding the problem of similar websites being unable to effectively intercept network traffic caused by interception using a blacklist, and being able to reduce reliance on blacklists to effectively detect and intercept network traffic of similar domain names.

[0103] Reference Figure 3 The second embodiment of the present invention provides a method for intercepting network traffic based on the above Figure 2 In the first embodiment shown, step S10 includes:

[0104] Step S11, obtaining the preset domain name;

[0105] Step S12: Generate the similar domain names of the preset domain name through a pre-trained long short-term memory network prediction model.

[0106] The Long Short-Term Memory (LSTM) prediction model is based on a LSTM network and is used to generate similar domain names. The LSTM model is a recurrent neural network that accepts sequences of arbitrary length as input and converts the sequence information into an internal state vector. This state vector can be used to perform various sequence-related tasks, such as classification and prediction. By incorporating long-term memory units and forgetting units, the LSTM model effectively addresses the problems of memorizing long sequences and forgetting information. The internal state generated by LSTM processing selectively remembers and forgets information in the sequence, achieving better prediction performance.

[0107] In the process of generating similar domain names, the memory and forgetting capabilities of the LSTM model can be used to learn more style characteristics of bad domain names.

[0108] In a specific scenario, bad domain names often use a "letter+number" or "number+letter" pattern, and never "number+letter+number" patterns, such as "88y88.com." Therefore, the LSTM model, with its memory capabilities, is used. If a "number+letter" pattern has already been generated, the LSTM model will definitely not generate a number next time.

[0109] In another specific scenario, a bad domain name might contain multiple dots (.), such as "3g.tty334.com." In this case, although the domain name "3g.tty334" contains a combination of numbers, letters, and numbers, the dot (.) after "3g" causes the LSTM model to ignore the previously output "3g" and generate a new domain name from the dot (.).

[0110] Unlike article creation, domain name generation uses English letters and numbers as the basic unit, not words. Domain names are distinguished by the dot ("."). Therefore, when generating domain names, we use a character-level prediction model. Specifically, the LSTM model predicts domain names one character at a time, including English letters, numbers, and the dot (".").

[0111] Optionally, the preset domain name can be input into the long short-term memory network prediction model to obtain the first output character of the long short-term memory network prediction model, and a target sequence including the first output character can be generated. The target sequence can be input into the long short-term memory network prediction model, and the target sequence can be updated according to the second output character generated by the long short-term memory network prediction model. When the second output character does not include the preset cutoff character, the step of inputting the target sequence into the long short-term memory network prediction model is returned to execute. When the second output character includes the preset cutoff character, similar domain names are determined according to the updated target sequence.

[0112] The first output character is an output character obtained based on a preset domain name. Optionally, the first output character is a single character. The target sequence is a character sequence consisting of multiple characters. The second output character is an output character obtained based on the target sequence. The preset cutoff character is a pre-set character indicating the end of domain name generation. When the preset cutoff character is included in the second output character, generation of similar domain names is stopped, and similar domain names are determined based on the updated target sequence.

[0113] Alternatively, if the domain name is much shorter than the article, and the reference context is not excessively long, to simplify the LSTM model and improve efficiency, the model can be restricted to generating the next character of the domain name based only on a preset number of characters in the sequence generated recently. The input to the LSTM model is then restricted to a sequence of characters of the preset length, and the output is the next generated character. To determine whether the LSTM model has completed domain name generation, a special character "#" can be introduced as a cutoff marker.

[0114] Optionally, in the process of updating the target sequence based on the second output character generated by the long short-term memory network prediction model, the second output character can be inserted at the end of the target sequence, and a target number of characters sorted in front of the target sequence can be deleted to update the target sequence, where the target number is the number of characters of the second output character.

[0115] In one scene, refer to Figure 7 As shown, Figure 7 The following diagram illustrates the generation of similar domain names in a specific scenario. Initially, a sequence of 10 "#" characters is fed into the LSTM model. The model outputs a generated character, "y," as the first character of the domain name. After recording this character, "y" is inserted at the end of the input sequence. To ensure the input sequence length is 10, the extra "#" characters at the beginning of the sequence are removed. The sequence is then fed back into the LSTM model to generate the next character. This process continues until the LSTM model outputs the preset cutoff character, "#," indicating that the LSTM prediction model has completed domain name generation. During this process, each character generated by the LSTM model is concatenated to form a similar domain name. As shown above, the LSTM model is the primary driver of domain name generation, continuously referencing previously generated characters to generate new characters, thereby completing the entire domain name generation process.

[0116] In this embodiment, a pre-set domain name is obtained and similar domain names are generated using a pre-trained long short-term memory network prediction model. Because the LSTM model effectively addresses the problem of long sequence memory and information forgetting by incorporating long-term memory units and forgetting units, the internal state generated by LSTM processing selectively remembers and forgets information in the sequence, achieving better prediction performance and thus generating similar domain names with a high degree of similarity.

[0117] Reference Figure 4 The third embodiment of the present invention provides a method for intercepting network traffic based on the above Figure 3 In the second embodiment shown, before step S11, the following steps are further included:

[0118] Step S40: obtaining the original domain name and extracting each original character contained in the original domain name;

[0119] Step S50: generating a first original sequence corresponding to each original character, wherein the original characters contained in each of the first original sequences are partially identical, and the number of the first original sequences is the same as the number of the original characters;

[0120] Step S60: generating a second original sequence corresponding to a preset cutoff character, wherein the second original sequence includes the original domain name;

[0121] Step S70, taking the preset cutoff character and each of the original characters as input data, and taking the second original sequence and each of the first original sequences as output data, to form training data including the input data and the output data;

[0122] Step S80: training a long short-term memory network training model according to the training data to obtain the long short-term memory network prediction model.

[0123] The original domain name is the domain name used to obtain training data, wherein the original domain name specifically refers to the domain name for which network traffic interception is required. The original characters are the characters contained in the original domain name. The first original sequence is the character sequence corresponding to the original characters.

[0124] For example, the original domain name is yabet.com, and the original characters it contains are: "y", "a", "b", "e", "t", ".", "c", "o", and "m". The number of the first original sequence is 9, which is the same as the number of the original characters. For example, the first original sequence corresponding to "y" is "##########", the first original sequence corresponding to "a" is "#########y", the first original sequence corresponding to "b" is "#########ya", and so on. For details, please refer to Figure 8 As shown, Figure 8 The first 9 lines on the left are the first original sequence, and the first 9 lines on the right are the original characters, and the same lines correspond to each other.

[0125] The second original sequence is a sequence corresponding to a preset cutoff character. It contains the preset cutoff character and the original domain name, and has the same length as the first original sequence. For example, if the original domain name is "yabet.com" and the preset cutoff character is "#", the second original sequence is "#yabet.com".

[0126] The preset cutoff character as output data corresponds to the second original sequence as input data. Each original character as output data and its corresponding first original sequence as output data form a set of corresponding training data. The term "correspondence" means that the input and output of the LSTM model correspond to each other.

[0127] To enable the LSTM model to learn different domain name combinations, it's necessary to generate training data using the original domain names. The following describes the process of generating training data suitable for the LSTM model based on an original domain name in a specific scenario.

[0128] Reference Figure 8 , Figure 8The following diagram illustrates the process of generating training data for a specific scenario. Specifically, it illustrates the process of generating training data based on the original domain name yabet.com. The left column in the diagram shows the input data provided when training the LSTM model, and the right column shows the expected output data. The generation process can be equated to sequentially adding the characters from the bad domain name to a 10-character queue, with characters entering from the left and entering from the right. The contents of the queue serve as the model input, and the next character added to the queue serves as the model output. Initially, the queue contains only "#" characters, and the next character to be added is "y." Therefore, the first training data input to the model is "##########", and the expected output is "y." Next, "y" is added to the queue, and the # character to its left is removed from the queue. Therefore, the second training data input to the model is #########y, and the expected output is "a." This process continues in this manner until all domain names have been added to the queue.

[0129] In this embodiment, an original domain name is obtained and each original character contained in the original domain name is extracted; a first original sequence corresponding to each original character is generated, wherein the original characters contained in each first original sequence are partially identical, and the number of first original sequences is the same as the number of original characters; a second original sequence corresponding to a preset cutoff character is generated, wherein the second original sequence contains the original domain name; the preset cutoff character and each original character are used as input data, and the second original sequence and each first original sequence are used as output data to form training data including input data and output data; a long short-term memory network training model is trained based on the training data to obtain a long short-term memory network prediction model. Thus, a long short-term memory network prediction model suitable for generating similar domain names can be obtained.

[0130] Reference Figure 5 The fourth embodiment of the present invention provides a method for intercepting network traffic based on the above Figure 2 In the first embodiment shown, before step S30, the following steps are further included:

[0131] Step S90, calculating a first hash value corresponding to the first webpage information and a second hash value corresponding to the second webpage information;

[0132] The first hash value is a hash value calculated based on the first webpage information. The second hash value is a hash value calculated based on the second webpage information.

[0133] In order to quickly determine whether a similar domain name is a domain name that requires network traffic interception, the Hamming distance between the first hash value and the second hash value is used to evaluate the similarity between the first web page information and the second web page information. Based on the similarity, it is determined whether network traffic interception should be performed on the similar domain name, avoiding the problem of increased computational complexity and low efficiency caused by various formats of data in the web page.

[0134] Optionally, a simhash algorithm may be used when calculating the first hash value and the second hash value.

[0135] Step S100, determining the Hamming distance between the first Hash value and the second Hash value;

[0136] Step S110: determining the similarity between the first webpage information and the second webpage information according to the Hamming distance.

[0137] The larger the Hamming distance, the smaller the similarity. Therefore, when the Hamming distance is less than a preset Hamming distance, it can be determined that the similarity between the first webpage information and the second webpage information is greater than a preset threshold. The preset Hamming distance is, for example, 3.

[0138] Using hash values ​​and Hamming distances to determine whether similar domain names match preset domain names can avoid the time-consuming process of judging a large number of information elements on a web page, and quickly verify whether similar domain names are bad websites, achieving quasi-real-time detection.

[0139] In this embodiment, by calculating the first hash value corresponding to the first web page information and the second hash value corresponding to the second web page information, the Hamming distance between the first hash value and the second hash value is determined, and based on the Hamming distance, the similarity between the first web page information and the second web page information is determined, thereby avoiding the time consumption of judging a large number of information elements in the web page, and being able to quickly detect whether similar websites need to intercept network traffic.

[0140] Reference Figure 6 As shown, Figure 6 Schematic diagram of a module of a network traffic interception device according to an embodiment of the present invention. The network traffic interception device includes:

[0141] The domain name generation module 10 is used to obtain a preset domain name and generate a domain name similar to the preset domain name;

[0142] The webpage information acquisition module 20 is used to acquire the first webpage information corresponding to the similar domain name and the second webpage information corresponding to the preset domain name;

[0143] The network traffic interception module 30 is configured to intercept network traffic based on the preset domain name and the similar domain name when the similarity between the first webpage information and the second webpage information is greater than a preset threshold.

[0144] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0145] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a network traffic interception device to execute the methods described in each embodiment of the present invention.

[0147] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for intercepting network traffic, characterized in that: The method comprises: Get the preset domain name; Inputting the preset domain name into a long short-term memory network prediction model; Obtaining a first output character of the long short-term memory network prediction model, and generating a target sequence including the first output character; Inputting the target sequence into the long short-term memory network prediction model, inserting the second output character generated by the long short-term memory network prediction model to the end of the target sequence, and deleting a target number of characters that are sorted in front of the target sequence to update the target sequence, wherein the target number is the number of characters of the second output character; When the second output characters do not include a preset cutoff character, returning to the step of inputting the target sequence into the long short-term memory network prediction model; When the second output character includes the preset cutoff character, determining a similar domain name of the preset domain name according to the updated target sequence; Obtaining first webpage information corresponding to the similar domain name and second webpage information corresponding to the preset domain name; When the similarity between the first webpage information and the second webpage information is greater than a preset threshold, network traffic is intercepted according to the preset domain name and the similar domain name.

2. The method according to claim 1, wherein Before the step of obtaining the preset domain name, the method further includes: Obtaining the original domain name, and extracting each original character contained in the original domain name; Generate a first original sequence corresponding to each original character, wherein the original characters included in each of the first original sequences are partially identical, and the number of the first original sequences is the same as the number of the original characters; generating a second original sequence corresponding to a preset cutoff character, wherein the second original sequence includes the original domain name; Using the preset cutoff character and each of the original characters as input data, and using the second original sequence and each of the first original sequences as output data, to form training data including the input data and the output data; A long short-term memory network training model is trained according to the training data to obtain the long short-term memory network prediction model.

3. The method according to claim 1, wherein Before the step of intercepting network traffic according to the preset domain name and the similar domain name when the similarity between the first webpage information and the second webpage information is greater than a preset threshold, the method further includes: Calculating a first hash value corresponding to the first webpage information and a second hash value corresponding to the second webpage information; Determine a Hamming distance between the first hash value and the second hash value; The similarity between the first webpage information and the second webpage information is determined according to the Hamming distance.

4. The method according to claim 1, wherein After the steps of obtaining a preset domain name and generating a domain name similar to the preset domain name, the method further includes: Detecting whether the similar domain name is a real domain name; When the similar domain name is the real domain name, performing the step of obtaining the first webpage information corresponding to the similar domain name and the second webpage information corresponding to the preset domain name; When the similar domain name is not the real domain name, the similar domain name is discarded.

5. A network traffic interception device, characterized in that: The network traffic interception device includes: A domain name generation module is configured to obtain a preset domain name; input the preset domain name into a long short-term memory network prediction model; obtain a first output character of the long short-term memory network prediction model and generate a target sequence including the first output character; input the target sequence into the long short-term memory network prediction model, insert a second output character generated by the long short-term memory network prediction model into the end of the target sequence, and delete a target number of characters that are ranked before the target sequence to update the target sequence, wherein the target number is the number of characters in the second output character; when the second output character does not contain a preset cutoff character, return to the step of inputting the target sequence into the long short-term memory network prediction model; when the second output character contains the preset cutoff character, determine similar domain names to the preset domain name based on the updated target sequence; A web page information acquisition module, configured to acquire first web page information corresponding to the similar domain name and second web page information corresponding to the preset domain name; The network traffic interception module is used to intercept network traffic according to the preset domain name and the similar domain name when the similarity between the first web page information and the second web page information is greater than a preset threshold.

6. A network traffic interception device, characterized in that: The network traffic interception device includes a memory, a processor, and a network traffic interception program stored in the memory and runnable on the processor. When the network traffic interception program is executed by the processor, the steps of the network traffic interception method as described in any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a network traffic interception program, and when the network traffic interception program is executed by a processor, the steps of the network traffic interception method according to any one of claims 1 to 4 are implemented.

Images