A malicious website detection method, device, system and equipment

Abstract

The application discloses a malicious website attack detection method, device, system and equipment, and the method comprises the following steps: step 1, website quantitative feature extraction: extracting the quantitative features of a website to be detected from the website page source code; step 2, website semantic feature extraction: selecting important tags closely related to the website semantics from the website page source code, extracting the semantic information of each tag from the selected important tags, and combining the semantic information of each tag into the semantic features of the website to be detected; step 3, generating the feature vector of the website: combining the quantitative features and the semantic features into a feature vector; and step 4, detecting the malicious website: taking the feature vector of the website to be detected as input, using a graph convolutional neural network classifier pre-trained by using augmented graph data constructed in a graph topology expansion mode to predict the type classification of the website to be detected, and the type classification comprises a malicious website and a legal website. The method can accurately detect malicious websites.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a malicious website detection method, device, system and equipment. BACKGROUND

[0002] A malicious website is a website that attempts to interfere with computer operation, collect user personal information or even completely control the user's machine by installing malicious software through vulnerabilities. In most cases, a malicious website often disguises itself as a legitimate website, allowing people to normally browse the page content while illegally obtaining various data in the user's machine. Malicious websites are not only an important source of computer viruses, but also use "disguise" methods to spread harmful information or commit fraud, seriously affecting the interests of netizens and the safety of online surfing.

[0003] There are generally three forms of malicious websites: phishing websites, spam websites and malicious software websites. Phishing websites will try to imitate the appearance of normal websites to deceive users visually and steal their private information. When visitors enter their personal information or bank card information, the data will be stolen by criminals, and even the user's personal information may be sold, causing serious losses. Spam websites are undesirable websites that use a series of techniques to subvert search engine ranking algorithms to prioritize search results. Spam websites may contain links to undesirable websites, false or illegal content, etc. By increasing the chances of user searches, they spread harmful information to users. Malicious software websites will install malicious software on user devices without the user's attention. By deploying malicious software, they serve as an entry point for extracting device data and controlling devices.

[0004] Traditional detection methods mainly use human-selected website quantitative features combined with machine learning methods for detection. This method relies too much on expert experience in feature selection and only considers the features of a single website node without considering the website node in the overall network environment, ignoring the important influence of adjacent website nodes on the website. Machine learning methods based on a single website node cannot fully consider the spatial characteristics of the website.

[0005] As an important means of network attack, malicious websites have become more and more diverse in recent years with the development of network technology, enhancing the concealment and encryption of malicious websites, making detection more and more difficult. The demand for detection of malicious websites has also increased. Traditional detection methods mainly use pattern matching algorithms or machine learning algorithms to detect the statistical features of a single website node. This method only considers the features of a single website node and cannot effectively represent the strong relationship between adjacent website nodes and the spatial characteristics. Moreover, it does not consider the serious imbalance in the number of website categories in reality. The feature extraction method also relies heavily on expert experience.

[0006] In recent years, with the rise of natural language processing, many methods for extracting text information are provided. In a webpage, text is an important component, and the text semantics of the webpage is an important basis for judging the quality of the webpage. Relying on natural language analysis to process webpage text information can not only strengthen the semantic representation of the webpage, but also obtain website feature information without relying entirely on expert experience.

[0007] In view of this, the present application is proposed. SUMMARY

[0008] The purpose of the present application is to provide a malicious website detection method, device, system and equipment, which can accurately identify malicious websites by detecting the node characteristics of the website and the topological relationship with the network, thereby solving the above technical problems existing in the prior art.

[0009] The purpose of the present application is achieved by the following technical solutions:

[0010] The present application embodiment provides a malicious website attack detection method, comprising:

[0011] Step 1, website quantitative feature extraction: obtaining the webpage source code of the website to be detected, and extracting the quantitative features of the website to be detected from the webpage source code, wherein the quantitative features include content features and link features;

[0012] Step 2, website semantic feature extraction: selecting important tags closely related to the website semantics from the webpage source code of the website to be detected, extracting semantic information of each tag from the selected important tags, and combining the semantic information of each tag into the semantic features of the website to be detected;

[0013] Step 3, generating the feature vector of the website: combining the quantitative features of the website to be detected obtained in step 1 and the semantic features of the website to be detected obtained in step 2 into the feature vector of the website to be detected;

[0014] Step 4, detecting malicious websites: taking the feature vector of the website to be detected as input, using the website topological augmented graph data constructed in the oversampling expansion graph topological structure mode as training data to predict the type classification of the website to be detected by the pre-trained graph convolutional neural network classifier, wherein the type classification includes malicious websites and legal websites.

[0015] The present application embodiment also provides a malicious website attack detection device, comprising: a website quantitative feature extraction module, a website semantic feature extraction module, a website feature vector generation module and a malicious website detection module; wherein,

[0016] The website quantitative feature extraction module, in communication connection with the website feature vector generation module, can acquire the web page source code of the website to be detected, and extract the quantitative features of the website to be detected from the web page source code, wherein the quantitative features include content features and link features;

[0017] The website semantic feature extraction module, in communication connection with the website feature vector generation module, can select important tags closely related to the website semantics from the web page source code of the website to be detected, extract semantic information of each tag from the selected important tags, and synthesize the semantic information of each tag into the semantic features of the website to be detected;

[0018] The website feature vector generation module, in communication connection with the malicious website detection module, can synthesize the quantitative features of the website to be detected obtained by the website quantitative feature extraction module and the semantic features of the website to be detected obtained by the website semantic feature extraction module into the feature vector of the website to be detected;

[0019] The malicious website detection module can take the feature vector of the website to be detected output by the website feature vector generation module as input, use the graph convolutional neural network classifier pre-trained by taking the website topology augmented graph data constructed in the oversampling expansion graph topology mode as training data to make prediction, and obtain the type classification of the website to be detected, wherein the type classification includes malicious websites and legal websites.

[0020] The embodiment of the application further provides a malicious website attack detection system including a plurality of terminal devices and at least one application data security gateway, wherein the application data security gateway adopts the malicious website attack detection device.

[0021] Each terminal device accesses websites on the Internet through the application data security gateway, and when any terminal device accesses websites on the Internet through the application data security gateway, the application data security gateway detects the accessed websites, and if the accessed websites are confirmed to be malicious websites, the terminal device is prohibited from accessing the malicious websites.

[0022] The embodiment of the application further provides a processing device including:

[0023] At least one memory for storing one or more programs;

[0024] At least one processor capable of executing the one or more programs stored in the memory, so that when the one or more programs are executed by the processor, the processor can implement the method described in the application.

[0025] Compared with the prior art, the malicious website detection method, device, system and equipment provided by the application have the following advantages:

[0026] The website label text semantics is introduced into the feature extraction link through website semantic feature extraction, the defects of the traditional feature extraction mode which excessively relies on expert experience are abandoned, and the relevance of the website text label theme and the semantic connectivity of adjacent web pages are strengthened; in the pre-training stage, the oversampling processing mode is used to obtain the website topology augmented graph data to train the graph convolutional neural network classifier, the problem of unbalanced data of malicious websites and legal websites is fully considered, the problem of insufficient malicious website sample quantity is avoided, and if the malicious website sample quantity is directly used for training, the problem of overfitting reducing the detection accuracy exists; the graph convolutional neural network is used as the feature extractor and the classifier in the step of detecting the malicious website, unlike the traditional mode considering single node features, the association relationship between websites can be mined, the properties of neighbor node websites are integrated into the website feature learning in the mode of constructing a topology graph, and whether the website is a malicious website can be more effectively detected. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0028] Figure 1 The flow chart of the malicious website detection method provided by the embodiment of the present application.

[0029] Figure 2 The training stage flow chart of the malicious website detection method provided by the embodiment of the present application.

[0030] Figure 3 The page2vec algorithm flow chart of the website semantic feature extraction step of the malicious website detection method provided by the embodiment of the present application.

[0031] Figure 4 The training framework diagram of the graph convolutional neural network classifier of the malicious website detection method provided by the embodiment of the present application.

[0032] Figure 5 The structural schematic diagram of the malicious website detection device provided by the embodiment of the present application.

[0033] Figure 6 The structural schematic diagram of the malicious website detection system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the specific contents of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application, which do not constitute a limitation of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the present application.

[0035] Firstly, the terms possibly used in the present application are explained as follows:

[0036] The term "and / or" means either of the two or both, for example, X and / or Y means three cases including "X" or "Y" or "X and Y".

[0037] The terms "include", "contain", "have", "possess" or other similar semantic descriptions should be interpreted as non-exclusive inclusion. For example, including a technical feature element (such as raw materials, components, ingredients, carriers, dosage forms, materials, sizes, parts, components, mechanisms, devices, steps, processes, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or articles, etc.) should be interpreted as not only including the explicitly listed technical feature element, but also including other technical feature elements not explicitly listed in the art.

[0038] The term "consisting of" means excluding any technical feature element not explicitly listed. If this term is used in the claims, the term will make the claim closed, so that it does not contain technical feature elements other than the explicitly listed technical feature elements, except for conventional impurities related thereto. If the term only appears in a certain clause of the claim, it is only limited to the elements explicitly listed in the clause, and the elements described in other clauses are not excluded from the overall claim.

[0039] Unless otherwise explicitly specified or limited, the terms "mount", "connect", "connect", "fix", and the like should be understood broadly, for example: it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0040] The malicious website detection method, device, system and equipment provided by the present application are described in detail below. The content not described in detail in the embodiments of the present application belongs to the prior art known to those skilled in the art. If no specific conditions are specified in the embodiments of the present application, the conditions are performed according to the conventional conditions in the art or the conditions recommended by the manufacturer. If no manufacturer of the reagent or instrument used in the embodiments of the present application is specified, it is a conventional product that can be obtained by market purchase.

[0041] As shown in Figure 1 The embodiments of the present application provide a malicious website attack detection method, which comprises:

[0042] Step 1, website quantitative feature extraction: obtaining the web page source code of the website to be detected, and extracting the quantitative features of the website to be detected from the web page source code, wherein the quantitative features include content features and link features;

[0043] Step 2, website semantic feature extraction: selecting important tags closely related to the semantics of the website from the web page source code of the website to be detected, extracting the semantic information of each tag from the selected important tags, and combining the semantic information of each tag into the semantic features of the website to be detected;

[0044] Step 3, generating the feature vector of the website: combining the quantitative features of the website to be detected obtained in the step 1 and the semantic features of the website to be detected obtained in the step 2 into the feature vector of the website to be detected;

[0045] Step 4, detecting malicious website: taking the feature vector of the website to be detected as input, and using the website topology augmented graph data constructed in the oversampling extended graph topology mode as training data to predict the type classification of the website to be detected by the graph convolutional neural network classifier pre-trained, wherein the type classification includes malicious website and legal website.

[0046] In the above method, the graph convolutional neural network classifier is trained by using the website topology augmented graph data constructed in the oversampling extended graph topology mode as training data, which comprises:

[0047] Step 401, feature extraction of existing website topology: extracting the feature vector of the input website by the graph neural network classifier, learning the website node representation, and obtaining the website node attribute and graph topology information;

[0048] Step 402, generating the feature attribute of the minority class node in the embedding space: generating a new node attribute by interpolating the feature values of the malicious websites and their nearest neighbors in the embedding space, wherein the new node attribute belongs to the malicious website node category;

[0049] Step 403, constructing the link relationship between the new synthetic node and the old node:

[0050] After the new synthetic node is synthesized, the link relationship between the new and old nodes needs to be constructed, the original website topology graph is expanded, the correlation between the new synthetic node and the old node is calculated by using a weighted inner product decoder, the generation of edges is derived, the new synthetic node is linked on the original website topology graph according to the generated edges, and the expansion of the original website topology graph is completed to obtain website topology augmented graph data;

[0051] In step 404, the obtained website topology augmented graph data is used as training data to train a graph convolutional neural network classifier.

[0052] In the above method, the structure of the graph convolutional neural network classifier is a two-layer graph convolutional neural network composed of an input layer, a hidden layer and an output layer.

[0053] The input of the input layer is the adjacency matrix of the website topology augmented graph data and the feature vector of each website, and the graph convolution formula of the input layer is:

[0054]

[0055] Where g θ is the convolution kernel of the graph convolutional neural network classifier; x is the input website node; and θ is the Chebyshev coefficient vector. is the degree matrix of x A is the adjacency matrix of the website topology graph in the network, and I N is the identity matrix of the website topology graph in the network.

[0056] The hidden layer acts as a feature extractor and receives the output of the input layer. The transfer function of the hidden layer is:

[0057]

[0058] Wherein, the meanings of the parameters are as follows: σ is a nonlinear activation function. is the degree matrix of x A is the adjacency matrix of the website topology graph in the network, and I N is the identity matrix of the website topology graph in the network; H (l) is the feature of the graph neural network layer, and W (l) is the weight of the graph neural network layer.

[0059] The forward propagation formula of the output layer is:

[0060]

[0061] Wherein, W (0) is the weight matrix from the input layer to the hidden layer; and W (1) is the weight matrix from the hidden layer to the output layer. X is a node embedding feature;

[0062] The loss function of the output layer classification is:

[0063]

[0064] wherein, Loss is the classification loss function of the output layer; Y L is a set of node indexes with labels; F represents the number of feature vectors; Z is the output vector after propagation through the graph convolutional neural network classifier.

[0065] In step 1 of the above method, the content features and link features of the website to be detected are extracted from the web source code in the following manner, including:

[0066] The web source code is split by tag, and the HTML code after splitting is obtained in units of tags, from <title>、< / title> <meta> The HTML code corresponding to each label extracts the content features and link features of the website to be detected; wherein

[0067] The content features of the website to be detected include: a stop word quantity feature value, an error word quantity feature value, a keyword quantity feature value, and a web page text vocabulary quantity feature value.

[0068] The link features of the website to be detected include: a web page ranking value, a null link quantity feature value, a web page redirection link quantity feature value, and a web page external link quantity feature value.

[0069] In the above method, the stop word quantity feature value refers to a word in the web page text that has no actual meaning, and the calculation method of the stop word quantity feature value is as follows:

[0070]

[0071]

[0072] Wherein, F1 is the stop word quantity feature value; stop_rate is the stop word ratio, which refers to the ratio of the number of stop words in the web page to the total number of words, N s and N t are the number of stop words and the total number of words in the web page, respectively. is a threshold value of the stop word ratio, which is 0-1, and the value is recorded as the base value when the accuracy rate is the highest by increasing 0.1 step by step while keeping other feature vectors unchanged.

[0073] The error word quantity feature value refers to a word in the web page text that is misspelled or does not exist, and the calculation method of the error word quantity feature value is as follows:

[0074]

[0075]

[0076] Wherein, F2 is the error word quantity feature value; error_rate is the error word ratio, which refers to the ratio of the number of error words in the web page to the total number of words, N e and N t are the number of error words and the total number of words in the web page, respectively. is a threshold value of the error word ratio, which is 0-1, and the value is recorded as the base value when the accuracy rate is the highest by increasing 0.1 step by step while keeping other feature vectors unchanged.

[0077] The calculation method of the keyword quantity feature value is as follows:

[0078] ​​

[0079] Where F3 is the keyword quantity feature value; N k Indicates keywords in a webpage; This parameter represents the number of keywords, and its value is up to 100 on the webpage, increasing by 10 each time while keeping other feature vectors constant. It records the point of highest accuracy. The value is used as the base value;

[0080] The webpage ranking value is calculated as follows:

[0081]

[0082] Where F5 is the page ranking value; PR is the PageRank value of the website node in the network topology diagram; d is the damping factor, typically taken as 0.85; p k This is the currently calculated website page; It points to website p k A collection of website pages; L(p k ) is p k The number of pages linking out of the website; N is the total number of pages.

[0083] The calculation method for the empty link quantity feature value is as follows:

[0084]

[0085]

[0086] Where F6 is the characteristic value of the number of empty links; null_rate is the null link rate of the webpage, L e and L t These are the number of empty links within the webpage and the total number of links, respectively. This is a threshold for the empty link rate of web pages, with a value between 0 and 1. The value is increased by 0.1 at each iteration, while other feature vectors remain unchanged, to record the point of highest accuracy. The value is used as the base value;

[0087] The calculation method for the characteristic value of the number of redirected links on the webpage is as follows:

[0088]

[0089]

[0090] Where F7 is the characteristic value of the number of redirect links; redirect_rate is the redirect link rate, L r and L t These are the number of redirect links and the total number of links, respectively. is a threshold value of the webpage redirection link rate, and is between 0 and 1, and is taken as a base value when the accuracy rate is the highest by increasing 0.1 step by step, and other feature vectors remain unchanged.

[0091] The webpage external link quantity feature value is calculated as follows:

[0092]

[0093]

[0094] Wherein, F8 is the webpage external link quantity feature value; out_rate is the webpage redirection link rate, L ex and L t are the redirection link quantity and the total link quantity respectively; is a threshold value of the webpage redirection link rate, and is between 0 and 1, and is taken as a base value when the accuracy rate is the highest by increasing 0.1 step by step, and other feature vectors remain unchanged.

[0095] In step 2 of the above method, the important tags closely related to the website semantics are selected from the webpage source code of the website to be detected, the semantic information of each tag is extracted from the selected important tags, and the semantic features of the website to be detected are synthesized, including:

[0096] The important tags closely related to the website semantics are selected from the webpage source code of the website to be detected, <keyword> 、 <description>and <title>The four tags are important tags closely related to the semantics of the website;< / title>

[0097] The selected text within the same label is regarded as a whole, the word2vec algorithm is used to predict the current vocabulary from the context vocabulary in each label to obtain the vectorized representation of the current vocabulary, the output vector of each obtained vocabulary is aggregated into a label vector in units of labels, and all label vectors are combined to generate a label matrix. The query vector sequence, the key vector sequence and the value vector sequence are obtained by using the self-attention mechanism through the label matrix, the attention values of each label are calculated through the query vector sequence, the key vector sequence and the value vector sequence, and the calculation formula of the attention values of the labels is:

[0098]

[0099] Wherein, D is the attention value; Q, K and V are the query vector sequence, the key vector sequence and the value vector sequence respectively, is a scale;

[0100] The query vector sequence, the key vector sequence and the value vector sequence are obtained by using the self-attention mechanism through the label matrix, the attention values of each label are calculated through the query vector sequence, the key vector sequence and the value vector sequence, and the calculation formula of the attention values of the labels is: <keyword> 、 <description>and <title>The attention value of the tag is calculated in the following way to synthesize the semantic features of the website to be detected:< / title>

[0101] o i = v i · d' i,j

[0102]

[0103] wherein each parameter means: F9 is the semantic feature of the website to be detected; o i is the row vector of the output vector, wherein each row respectively represents, <keyword> ， <description>and <title>The attention value of the tag; O< / title> page is a webpage semantic vector; o body , o keyword , o description , o title respectively, <keyword> , <description>, <title>The semantic vector of the tag.< / title>

[0104] The embodiment of the present application also provides a malicious website attack detection device, comprising: a website quantitative feature extraction module, a website semantic feature extraction module, a website feature vector generation module and a malicious website detection module; wherein,

[0105] The website quantitative feature extraction module is in communication connection with the website feature vector generation module, can acquire the webpage source code of the website to be detected, extracts the quantitative features of the website to be detected from the webpage source code, and the quantitative features include: content features and link features;

[0106] The website semantic feature extraction module is in communication connection with the website feature vector generation module, can select important tags closely related to the website semantics from the webpage source code of the website to be detected, extracts the semantic information of each tag from the selected important tags, and integrates the semantic information of each tag into the semantic features of the website to be detected;

[0107] The website feature vector generation module is in communication connection with the malicious website detection module, can integrate the quantitative features of the website to be detected obtained by the website quantitative feature extraction module and the semantic features of the website to be detected obtained by the website semantic feature extraction module into the feature vector of the website to be detected;

[0108] The malicious website detection module can take the feature vector of the website to be detected output by the website feature vector generation module as input, use the website topology augmented graph data constructed in the oversampling expansion graph topology mode as the training data of the graph convolutional neural network classifier pre-trained to make prediction and obtain the type classification of the website to be detected, and the type classification includes: malicious website and legal website.

[0109] In the above device, the website quantitative feature extraction module extracts the content features and link features of the website to be detected from the webpage source code in the following mode, comprising:

[0110] The webpage source code is split in units of tags, and the HTML code in units of tags is obtained after splitting, from which <title>、< / title> <meta> ,< / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> ​​ The HTML code corresponding to each label extracts content features and link features of the website to be detected; wherein

[0111] The content features of the website to be detected include: a stop word quantity feature value, an error word quantity feature value, a keyword quantity feature value, and a web page text vocabulary quantity feature value;

[0112] The stop word quantity feature value refers to a word without actual meaning in web page text, and the calculation method of the stop word quantity feature value is as follows:

[0113]

[0114]

[0115] F1 is the stop word quantity feature value; stop_rate is a stop word ratio, which refers to the ratio of the number of stop words in the web page to the total number of words, N s and N t are the number of stop words and the total number of words in the web page, respectively; is a threshold value of the stop word ratio, which is 0-1, and the value is recorded as a base value when the accuracy rate is the highest by increasing 0.1 step by step while keeping other feature vectors unchanged;

[0116] The error word quantity feature value refers to a word with spelling errors or non-existent in web page text, and the calculation method of the error word quantity feature value is as follows:

[0117]

[0118]

[0119] F2 is the error word quantity feature value; error_rate is an error word ratio, which refers to the ratio of the number of error words in the web page to the total number of words, N e and N t are the number of error words and the total number of words in the web page, respectively; is a threshold value of the error word ratio, which is 0-1, and the value is recorded as a base value when the accuracy rate is the highest by increasing 0.1 step by step while keeping other F1, F3-F9 feature vectors unchanged;

[0120] The calculation method of the keyword quantity feature value is as follows:

[0121]

[0122] F3 is the keyword quantity feature value; N k represents the number of keywords in the web page, is a parameter of the number of keywords,​​ In the web page, the value is 100 or less, by increasing 10, other feature vectors remain unchanged, to record the highest accuracy when As the base value;

[0123] The link feature of the website to be detected includes: webpage ranking value, null link quantity characteristic value, webpage redirection link quantity characteristic value, webpage external link quantity characteristic value;

[0124] The calculation method of the webpage ranking value is as follows:

[0125]

[0126] Wherein, F5 is the webpage ranking value; PR is the PageRank value of the website node in the network topology graph; d is the damping factor; Refers to the set of pages pointing to p k , p k is the current page; L(p k ) is the number of links from webpage u; d is the damping factor; Refers to the set of pages pointing to p k ; L(p k ) is the number of links from webpage u;

[0127] The calculation method of the null link quantity characteristic value is as follows:

[0128]

[0129]

[0130] Wherein, F6 is the null link quantity characteristic value; null_rate is the webpage null link rate, L e And L t are the number of null links and total links in the webpage respectively; Is the threshold value of the webpage null link rate, the value is between 0-1, by increasing 0.1, other feature vectors remain unchanged, to record the highest accuracy when Value as the base value;

[0131] The calculation method of the webpage redirection link quantity characteristic value is as follows:

[0132]

[0133]

[0134] Wherein, F7 is the webpage redirection link quantity characteristic value; out_rate is the webpage redirection link rate, L ex And L t are the number of redirection links and the total number of links respectively; is the threshold value of the webpage redirection link rate, and is valued between 0 and 1, and is recorded as the base value when the accuracy rate is the highest by increasing 0.1 step by step, and other feature vectors remain unchanged;

[0135] The webpage external link quantity feature value is calculated as follows:

[0136]

[0137]

[0138] Wherein, F8 is the webpage external link quantity feature value; out_rate is the webpage redirection link rate; L ex and L t are the redirection link quantity and the total link quantity, respectively; is the threshold value of the webpage redirection link rate, and is valued between 0 and 1, and is recorded as the base value when the accuracy rate is the highest by increasing 0.1 step by step, and other feature vectors remain unchanged;

[0139] The website semantic feature extraction module selects important tags closely related to the website semantics from the webpage source code of the website to be detected, extracts semantic information of each tag from the selected important tags, and synthesizes the semantic features of the website to be detected, including:

[0140] selecting, <keyword> 、 <description>and <title>The four tags are important tags closely related to the semantics of the website;< / title>

[0141] The selected text within the same label is regarded as a whole, the word2vec algorithm is used to predict the current vocabulary from the context vocabulary in each label to obtain the vectorization representation of the current vocabulary, the output vector of each obtained vocabulary is aggregated into a label vector in units of labels, and all label vectors are combined to generate a label matrix. The query vector sequence, the key vector sequence and the value vector sequence are obtained by using the self-attention mechanism through the label matrix, the attention values of each label are calculated through the query vector sequence, the key vector sequence and the value vector sequence, and the calculation formula of the attention values of the labels is as follows:

[0142]

[0143] Wherein, D is the attention value; Q, K and V are the query vector sequence, the key vector sequence and the value vector sequence respectively, is a scale;

[0144] The query vector sequence, the key vector sequence and the value vector sequence are obtained by using the self-attention mechanism through the label matrix, the attention values of each label are calculated through the query vector sequence, the key vector sequence and the value vector sequence, and the calculation formula of the attention values of the labels is as follows: <keyword> 、 <description>and <title>The attention value of the tag is calculated in the following way to synthesize the semantic features of the website to be detected:< / title>

[0145] o i = v i · d' i,j

[0146]

[0147] wherein each parameter means: F9 is the semantic feature of the website to be detected; o i is the row vector of the output vector, wherein each row respectively represents, <keyword> ， <description>and <title>The attention value of the tag; O< / title> page is a webpage semantic vector; o body , o keyword , o description , o title respectively, <keyword> 、 <description>、 <title>The semantic vector of the tag.< / title>

[0148] The structure of the graph convolutional neural network classifier of the malicious website detection module is a double-layer graph convolutional neural network composed of an input layer, a hidden layer and an output layer;

[0149] The input of the input layer is the adjacency matrix of the website topology augmented graph data and the feature vector of each website, and the graph convolution formula of the input layer is:

[0150]

[0151] Where g θ is the convolution kernel of the graph convolutional neural network classifier; The recursive definition of Chebyshev polynomial is T k (x)=2xT k-1 (x)-T k-2 (x), T0(x)=1, T1(x)=x; L is the Laplacian matrix of the website topology augmented graph data, equal to D-A, D is a diagonal matrix, D ii =∑ j A ij , A is the adjacency matrix of the graph, normalized as I N is the unit matrix;

[0152] The hidden layer, as a feature extractor, receives the output of the input layer, and the transfer function of the hidden layer is:

[0153]

[0154] Wherein, the meanings of the parameters are: A is the adjacency matrix of the graph, I N is the unit matrix; is the degree matrix of, H is the feature of each layer, and sigma is a nonlinear activation function;

[0155] The forward propagation formula of the output layer is:

[0156]

[0157] Where W (0) is the weight matrix of the input layer-to-hidden layer; W (1) is the weight matrix of the hidden layer-to-output layer, X is the website embedding feature;

[0158] The loss function of the output layer classification is:

[0159]

[0160] wherein, Loss is a classification loss function of an output layer; Y L is a set of website index with labels; F represents the number of feature vectors; Z is an output vector after propagation through the graph convolutional neural network classifier.

[0161] The embodiment of the present application also provides a malicious website attack detection system, comprising a plurality of terminal devices and at least one application data security gateway, wherein the application data security gateway adopts the malicious website attack detection device.

[0162] Each terminal device accesses websites on the Internet through the application data security gateway, and when any terminal device accesses websites on the Internet through the application data security gateway, the application data security gateway detects the accessed websites, and if the accessed websites are confirmed as malicious websites, the terminal device is prohibited from accessing the malicious websites.

[0163] The embodiment of the present application further provides a processing device, comprising:

[0164] at least one memory for storing one or more programs;

[0165] at least one processor capable of executing the one or more programs stored in the memory, so that the processor can implement the above method when the one or more programs are executed by the processor. The processing device can also be used for the application data security gateway to detect malicious websites in the malicious website attack detection system.

[0166] The embodiment of the present application further provides a readable storage medium storing a computer program, which can implement the above method when the computer program is executed by the processor.

[0167] As can be seen from the above, the detection method, device and system of the embodiment of the present application can introduce website label text semantics into the feature extraction link by using the page2vec algorithm through the website semantic feature extraction step, abandon the defects that the traditional feature extraction method is too dependent on expert experience, and strengthen the relevance of website text label theme and the semantic connectivity of adjacent web pages. In the pre-training stage, the graph convolutional neural network classifier is trained by using the oversampling processing method to obtain augmented graph data, fully considering the problem of unbalanced data between malicious websites and legal websites, avoiding the problem that the malicious website sample size is insufficient and directly used for training, and the overfitting reduces the detection accuracy. The graph convolutional neural network is used as a feature extractor and a classifier in the malicious website detection step, which is different from the traditional method considering single node features, can mine the association relationship between websites, and can more effectively detect whether a website is a malicious website.

[0168] In order to more clearly show the technical solutions provided by the present application and the technical effects produced, the malicious website detection method, device and system provided by the embodiments of the present application are described in detail below with specific examples.

[0169] Embodiment 1

[0170] The present application provides a kind of malicious website detection method, it is a kind of detection method based on graph convolutional neural network, this method first extracts the quantitative feature and semantic feature of the website to be detected, generates the feature vector of the website to be detected according to quantitative feature and semantic feature, through the graph convolutional neural network classifier trained by pre-utilized augmented graph data, accurately identify malicious website through detection network and node feature.

[0171] Specifically, the malicious website detection method is as follows< / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> ​​ Figure 1 As shown in the figure, comprising the following steps:

[0172] Step 1, website quantitative feature extraction: obtaining the web source code of the website to be detected through crawling, and extracting the quantitative features of the website to be detected from the web source code, wherein the quantitative features include: content features and link features;

[0173] Step 2, website semantic feature extraction: selecting important tags closely related to the semantics of the website from the web source code of the website to be detected, extracting semantic information of each tag from the selected important tags, and combining the semantic information of each tag into semantic features of the website to be detected;

[0174] Step 3, generating feature vectors of the website: combining the quantitative features of the website to be detected obtained in step 1 and the semantic features of the website to be detected obtained in step 2 into feature vectors of the website to be detected;

[0175] Step 4, detecting malicious websites: taking the feature vectors of the website to be detected as input, using the augmented graph data constructed in the oversampling expansion graph topology mode as training data to pre-train the graph convolutional neural network classifier to predict the type classification of the website to be detected, wherein the type classification includes: malicious websites and legal websites.

[0176] As Figure 2 ​As shown, the detection process of the detection method mainly includes four stages, which are network quantitative feature extraction, network semantic feature extraction, expanding the graph topology using oversampling method and detecting malicious websites using graph convolutional neural network classifier. The first stage will extract some representative statistical features from the content and links of the website through quantitative analysis method; the second stage will use the page2vec algorithm to vectorize the semantic features of the website from the label angle; the third stage adopts the GraphSmote method to oversample the graph, and constructs the augmented graph to relieve the data imbalance problem; the fourth stage uses the graph convolutional neural network as the classifier to detect malicious websites.

[0177] The above processing steps will be described in detail below.

[0178] (1) Website quantitative feature extraction:

[0179] Malicious websites generally implement attacks through the content or links of the website, and the present application aims to extract the quantitative features of the website by quantitatively analyzing some typical content or link features of the malicious website. The feature extraction of the website is achieved by analyzing the HTML source code of the webpage.

[0180] Firstly, the HTML source code of the website is obtained by crawling. Since the website source code information is relatively complex, the present application splits the source code by tags, and focuses on the extraction of the website features from the webpage <title>，< / title> <meta> These tags are analyzed and a feature vector F is generated, F = <F1, F2, F3, F4, F5, F6, F7, F8, F9>. The first four F1, F2, F3, F4 are the content features of the website, F5, F6, F7, F8 are the link features of the website, and the last one F9 is the semantic feature of the website.

[0181] For the content features of the website, mainly analyze, <meta> tags and JavaScript code. The main content features of the website are:

[0182] The number of stop words feature value: stop words are words in web page text that have no actual meaning, such as it, she, or, a, the, am, etc. Malicious websites will use machines to automatically fill in content or use keywords to fill in text, so that the number of stop words is less than that of legal websites. The definition of the number of stop words feature value of the web page is as follows:

[0183]

[0184]

[0185] Wherein, F1 is the number of stop words feature value; stop_rate is the stop word ratio, which refers to the ratio of the number of stop words in the web page to the total number of words, N s and N t are the number of stop words and the total number of words in the web page, respectively; is the threshold value of the stop word ratio, which is 0-1. The base value of this threshold value is determined in the following experimental way: increase by 0.1, and other feature vectors remain unchanged, to record the highest accuracy value as the base value.

[0186] The number of error words feature value: malicious websites usually use incorrect or non-existent words to avoid detection by search engines, while legal websites rarely have spelling errors. The main difference between malicious websites and legal websites is the number of error words. A commonly used word library is used to check the error words in the website content, and the definition of the number of error words feature value of the web page is as follows:

[0187]

[0188]

[0189] Wherein, F2 is the number of error words feature value; error_rate is the error word ratio, which refers to the ratio of the number of error words in the web page to the total number of words, N e and N t are the number of error words and the total number of words in the web page, respectively; ​is a threshold value of the error word ratio, and is valued between 0 and 1. The base value of the threshold value is determined in the following experimental manner: the accuracy rate is recorded when the accuracy rate is the highest by increasing 0.1 by 0.1, and other feature vectors (i.e., F1, F3-F9) remain unchanged.

[0190] The keyword number feature value: malicious websites will add as many keywords as possible in the webpage content to deceive search engines and induce users to click the webpage. The keyword description of a legal website is accurate and has a small number, which can accurately summarize the text information. The keyword number of a malicious website is large and has no relevance. The keyword number feature value is defined as follows:

[0191]

[0192] wherein F3 is the keyword number feature value; N k represents the keyword in the webpage, is a parameter of the keyword number, and the value in the webpage is 100 or less. The base value of the threshold value is determined in the following experimental manner: the accuracy rate is recorded when the accuracy rate is the highest by increasing 10 by 10, and other feature vectors remain unchanged.

[0193] The webpage text vocabulary number feature value F4: in general, the number of words in a legal website can be higher than that in a malicious website. A malicious website can contain undesirable images or be able to redirect to a malicious website, for example, through <iframe>Tag nesting page. Web page text vocabulary quantity is less, the possibility of malicious website will increase.

[0194] Website link features mainly analyze the tags in the web page source code and some available link data to extract web link quantitative features. The main website content features are:

[0195] PageRank value of web page, i.e. web page ranking value: PageRank is the earliest web page ranking algorithm proposed by Google, according to the link relationship between web pages, the more reliable the website will get higher PR value (importance of website). Add PageRank value to link-based features to make a preliminary judgment on the reliability of the web page. The calculation formula of PageRank value is:

[0196]

[0197] Wherein, F5 is the web page ranking value; PR is the PageRank value of the website node of the network topology graph; d is the damping factor; Opkis the page set pointing to pk, pkis the current page; L(pk) is the number of links from web page u; d is the damping factor; Opkis the page set pointing to pk; L(pk) is the number of links from web page u.

[0198] Empty link quantity feature value: empty link is a link that appears on a web page without pointing to the target endpoint. When the user clicks on the empty link, it will remain static. Malicious websites will put some empty links to fake link quantity in order to pretend to be like a legal website. Malicious websites can use some code designed to create empty links, such as <a href=””>, <a href=”#”>, <a href=”###”>, or use JavaScript pseudo protocol, <a href=”javascript:void(0);”>, <a href=”javascript:void(0)”>, <a href=”javascript:;”>, <a href=”javascript:”> and so on.The definition of the null link quantity characteristic value is as follows:

[0199]

[0200]

[0201] Wherein, F6 is the null link quantity characteristic value; null_rate is the web null link rate, Le and Lt are the number of null links and total links in the web respectively; is the threshold value of the web null link rate, and the value is between 0 and 1, and the base value of the threshold value is determined in the following experimental manner: the value of is recorded as the base value when the accuracy rate is the highest by increasing 0.1 successively, and other characteristic vectors remain unchanged.

[0202] Web redirection link quantity characteristic value: the redirection link refers to that the web can jump to another place through the link, which can be in the page or outside the page. The malicious website will design the redirection link to redirect the user to other websites, such as advertisements or malicious websites, etc. Usually, the redirection can be performed through <meta http-equiv="refresh"> or using JavaScript, such as setting window.location or document.location value to perform redirection.The parameter definition of the webpage redirection link is as follows:

[0203]

[0204]

[0205] wherein F7 is a webpage redirection link quantity characteristic value; out_rate is a webpage redirection link rate, Lexand Ltare respectively a redirection link quantity and a total link quantity; is a threshold value of the webpage redirection link rate, and the value is between 0 and 1, the base value of the threshold value is determined in the following experimental manner: the value of is recorded as the base value when the accuracy rate is the highest by increasing 0.1 gradually, and other characteristic vectors remain unchanged.

[0206] Webpage external link quantity characteristic value: external link refers to a link capable of linking to a domain different from a website. A malicious website usually links to a website with a different domain name or promotes its own ranking, or points to a different malicious website. Therefore, a malicious website may have more external links than a legal website.The parameter definition of the number of external links of a web page is as follows:

[0207]

[0208]

[0209] Among them, F8 is the eigenvalue of the number of external links of the web page; out_rate is the web page redirect link rate, Lex and Lt are the number of redirect links and the total number of links respectively; is the threshold of the web page redirect link rate, and its value ranges from 0 to 1. By increasing it by 0.1 successively and keeping other feature vectors unchanged, the value when the accuracy rate is the highest is recorded as the base value.

[0210] (2) Extraction of website semantic features:

[0211] The tags closely related to the website semantics in the website source code will be used for semantic analysis, and the page2vec algorithm will be used to extract the semantic information of each tag to synthesize the semantic features of the website. The process of the page2vec algorithm is shown in Figure 3.

[0212] The selection of quantitative features of the website depends on expert experience. Since malicious websites often use machine-filled fields or add multiple keywords to confuse the browser detection mechanism, the semantic relevance of tags of malicious websites is weaker than that of legal websites. Therefore, the present invention considers integrating website semantic features into the feature extraction stage. The present invention uses the method of tag semantic fusion to vectorize the website semantic features. For the web page source code obtained by the crawler, important tags are extracted and redundant web page text is simplified. The main tags used here are four tags: <body>, <keyword>, <description>, and <title>. The text within the same tag is regarded as a whole, and these four tags are processed separately, which can better fit the text features of the web page.

[0213] The text vector embedding method of the webpage is to use the word2vec algorithm to predict the current word from the context words in the same label to obtain the vector representation of the current word. The words in the same label are represented as {w1, w2, w3…wn}. This step aims to maximize the log function L:

[0214]

[0215] Where wi is the current predicted word; c is the window size of the context on the training set, {b1……bn} represents the words in a single label;

[0216] all one-hot encodings of words are used as input. In the input layer, it will use the c words before and after the target word i to predict the word i. In the projection layer, the 2c vectors of the input layer are added, and Kwi will be obtained:

[0217]

[0218] Combined with the Huffman tree and the gradient ascent method, the final vector representation of the predicted word is:

[0219]

[0220] Where η is the learning rate, which is 0.1.

[0221] After embedding the words by word2vec, the output vector of each word is obtained, and the labels are aggregated. Taking the <body> label as an example, the synthesized label vector can be represented as:

[0222]

[0223] On the label attributes of the website, there should be semantic relevance between the selected labels, and they influence each other. The label semantics of a legal website should be highly related, while the relevance of different labels of a malicious website may be low. The purpose of using the self-attention mechanism is to fully consider the semantic relationship between labels, measure the relevance between label vectors, and highlight the representation of more important webpage content.

[0224] Use xbody, xkeyword, xdescription, xtitleto represent the vector of the synthesized label, and combine the generation matrix form, denoted as Xpage. For the self-attention mechanism, define the query vector sequence, the key vector sequence and the value vector sequence as Q, K, V respectively, and the formula is:

[0225] Q=WQXpage

[0226] K=WKXpage

[0227] V=WVXpage

[0228] In order to calculate the correlation between different labels, after synthesizing the above vectors, the label attention value is calculated by the following method:

[0229]

[0230]

[0231] Where, is the scale.

[0232] In order to synthesize the webpage vector representation, after obtaining the output vector after the self-attention mechanism, separate and fuse the labels, so that the website features can be represented by the vector form instead of the matrix form. Facilitate subsequent graph convolutional neural network classifier processing.The formula for web page semantic vector synthesis is as follows:

[0233] oi = vi · d′i,j

[0234]

[0235] (3) Graph Convolutional Neural Network Detection Model:

[0236] In terms of the detection model, the present invention uses a graph convolutional neural network and combines it with the GraphSmote algorithm to oversample the website topology, balancing the extremely imbalanced problem of the number of malicious websites and legitimate websites in the network. Using the obtained quantitative features and semantic features of the websites, combined with the topological relationship between websites in the network, the features of adjacent nodes are captured for learning, and a two-layer graph convolutional neural network is used for malicious website detection. The overall framework of the detection model is shown in Figure 3.

[0237] In both the actual detection scenario and the sampled dataset, the number of legitimate websites is much larger than the number of malicious websites. If not processed, a model trained only based on a small amount of malicious website data not only has poor generalization ability but also seriously affects the accuracy of detection. To solve this problem, the present invention performs data oversampling during the model training stage and combines it with the malicious website classifier.

[0238] The oversampling process of the graph structure uses the GraphSmote algorithm to construct website topology augmented graph data, and expands the graph for the existing sample features, which is mainly divided into the following stages:

[0239] 401) Feature extraction of the existing website topology:

[0240] In the embodiments of the present invention, a graph neural network is used to perform feature learning on the existing website topology structure. The graph neural network extracts the features of the input website node features, learns the website node representation, and retains the website node attributes and graph topology information.The process of message propagation and fusion of the hidden layer of the graph neural network can be expressed as:

[0241] hv=σ(W·concat(Xv,M,Av)

[0242] wherein hvis the embedding of website node v, W is a weight parameter, σ is an activation function, M represents an attribute matrix of the input node, Xvrepresents the feature of website node v, and A is the adjacency matrix of the website graph.

[0243] 402) Generating the feature attributes of the minority class in the embedding space:

[0244] New node attribute generation interpolates the feature values of malicious websites with their nearest neighbors in the embedding space, and the synthesized attribute values should also belong to the malicious website node category. Take the minority class sample v, and obtain the nearest neighbor samples of the same label sample as:

[0245]

[0246] wherein cn(v) refers to the nearest neighbor of sample v from the same class, measured using the Euclidean distance in the embedding space. By obtaining the nearest neighbor samples, new malicious website node attributes are synthesized by an interpolation method:

[0247] hnew=(1-δ)·hv+δ·hcn(v)

[0248] 403) Constructing the link relationship between the new synthesized node and the old node:

[0249] After synthesizing the new minority class node, the link relationship between the new and old nodes needs to be constructed, and the old website topology graph is expanded. A weighted inner product decoder is used to calculate the correlation between nodes, so as to deduce the generation of edges. The way to calculate the correlation between node u and node v by using the weighted inner product decoder is:

[0250] Edu,v=softmax(σ(hv·S·hu))

[0251] wherein Edu,vis the predicted relationship information between node u and node v, and S is a parameter matrix capturing the interaction between nodes.

[0252] By training the weight matrix S of the decoder with the original graph, the reconstructed adjacency matrix of the original website topology graph is calculated, denoted as E, and the reconstruction error can be calculated as:

[0253] Costedge=||Ed-A||2M

[0254] After the decoder is trained, the decoder can be used to predict the relationship between the new and old website nodes, and no weight is set for each edge, and the adjacency matrix is set to 1 if there is an edge between nodes, otherwise 0, and the adjacency matrix of the new augmented graph is:

[0255]

[0256] Wherein, γ is a threshold value, is the adjacency matrix of the network topology graph after GraphSMOTE, Edu,v′ is the predicted relationship information between node u and node v′.

[0257] (4) Graph convolutional neural network classifier:

[0258] Graph convolutional neural network extends convolution operation to graph structured data. The present application uses graph convolution based on spectral graph method to process website single node information and strong relationship between adjacent websites on website topology. In the spectral graph method, the graph is represented by the corresponding Laplacian matrix, and by analyzing the Laplacian matrix and its eigenvalues, the properties of the graph structure can be obtained. Define the Laplacian matrix L of the graph as L=D-A, where D is a diagonal matrix, Dii=∑jAij, A is an adjacency matrix, normalized asINis the unit matrix. The eigenvalue decomposition of the Laplacian matrix is L=UΛUT, Λ=diag([λ0,…,λN-1]), according to the properties of the Laplacian matrix, U is an orthogonal matrix.The Fourier transform of the signal is Ug and the inverse transform is UgT, thus it can be obtained that the signal x on the graph G is convolved with the kernel gθ:

[0259] gθ*x=UgθUgT x

[0260] where gθ is the convolution kernel. The convolution operation of the graph signal is equal to the product of the signals in the spectral domain, thus the above formula can be understood as that gθ and x are respectively transformed into the spectral domain by Fourier transform, the results are multiplied, and then inverse Fourier transform is performed to obtain the final result of the convolution operation. Since the scale of the website topology graph to which the present application is directed is relatively large, in order to reduce the amount of calculation, approximation processing is performed according to the Chebyshev polynomial. Meanwhile, there are many isolated website nodes in the website topology graph, and these websites have no link relationship with other websites, in order to avoid the problem of gradient explosion of the isolated website nodes, a self-loop processing is added to each website node. The optimized graph convolution formula is:

[0261] where Ug is the Fourier transform of the signal, and the recursive definition of the Chebyshev polynomial is Tk(x)=2xTk-1(x)-Tk-2(x), T0(x)=1, T1(x)=x.The graph convolution uses a linear rectifier function as an activation function, the input is an adjacency matrix of a website topology augmented graph and a feature vector of each node, after the graph convolution captures the adjacent information of each node in the spatial dimension, the attribute features of the current node are updated, and the hidden layer transfer function of the graph convolution neural network as a feature extractor is:

[0263]

[0264] After the above-mentioned graph convolutional neural network method, the characteristics of the website can be better transmitted and predicted, and the difference between the real website features and the predicted value is obtained, and the result is passed through the next layer of graph convolutional neural network and the loss function is used to optimize the model parameters. The classification of the website is a binary classification problem, and the website type is divided into two categories: legal website and malicious website. In order to realize the binary classification of the graph convolutional neural network, the forward propagation formula of the double-layer graph convolutional neural network can be calculated as:

[0265]

[0266] Where W(0)is the weight matrix from the input layer to the hidden layer, W(1)is the weight matrix from the hidden layer to the output layer, and X is the node embedding feature. The loss function of classification is:

[0267]

[0268] Where YLis a set of node indexes with labels, F represents the number of features, and Z is a convolution output matrix. That is, the malicious website can be accurately detected.

[0269] The malicious website detection method based on the graph convolutional neural network mechanism of the embodiment introduces the website label text semantics into the feature extraction link for the first time by using the page2vec algorithm. The defects of the traditional feature extraction method that rely too much on expert experience are abandoned. The relevance of the website text label theme and the semantic connectivity of adjacent web pages are strengthened. The oversampling processing method is combined with the graph convolutional neural network classifier, and the real problem of website data imbalance is fully considered, and the problem of overfitting and reducing the detection accuracy is avoided.Unlike the traditional way of considering single node features, using a graph convolutional neural network as a feature extractor and classifier, the association between websites can be mined in a graph manner, and the properties of neighboring nodes can be integrated into website feature learning in the form of a topology graph, which can effectively detect whether a website is a malicious website.

[0270] The method of the embodiment can be deployed in security detection software to achieve accurate identification of malicious websites and improve the accuracy of malicious website detection.

[0271] Embodiment 2

[0272] FIG. 6 illustrates the deployment of a malicious website detection system. The malicious website detection device corresponding to the implementation of the detection method is deployed on the application data security gateway, and various website data transmitted over the Internet can be divided into normal websites and malicious websites. Through the malicious website detection system deployed on the application data security gateway, if the website detection is a malicious website, the malicious website is filtered out and an alarm is processed by the gateway. If it is a legal website, the terminal user can normally access and transmit data, prevent the website from collecting user personal information through vulnerabilities or content attacks, and cause threats to user information and property safety.

[0273] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by programs instructing related hardware, and the programs can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), etc.

[0274] The above is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the scope of the present application disclosed herein can be easily thought of by those skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims. The information disclosed in the background section of this document is only intended to deepen the understanding of the overall background of the present application, and should not be considered as acknowledging or implying in any form that the information constitutes prior art known to those skilled in the art.< / iframe> ​​ ​

Claims

1. A method of detecting malicious website attacks, characterized by, Comprise: Step 1, website quantitative feature extraction: obtain the web page source code of the website to be detected, and extract the quantitative features of the website to be detected from the web page source code, the quantitative features including: content features and link features; in step 1, the content features and link features of the website to be detected are extracted from the web page source code in the following way, including: The web page source code is split in units of tags, and the HTML code in units of tags is obtained from the split <title>、< / title> <meta> 、、 The HTML code corresponding to each label extracts the content features and link features of the website to be detected; wherein, The content features of the website to be detected include: the number of stop words feature value, the number of error words feature value, the number of keywords feature value, and the number of web page text vocabulary feature value; The link features of the website to be detected include: the page rank value, the number of empty link feature value, the number of web page redirection link feature value, and the number of web page external link feature value; Step 2, website semantic feature extraction: select important labels closely related to website semantics from the web page source code of the website to be detected, extract semantic information of each label from the selected important labels, and synthesize the semantic features of the website to be detected; in step 2, the important labels closely related to the website semantics are selected from the web page source code of the website to be detected, the semantic information of each label is extracted from the selected important labels, and the semantic features of the website to be detected are synthesized in the following way, including: selected from the web source code of the website to be detected, <keyword> 、 <description>and <title>Four kinds of labels are used as important labels closely related to website semantics;< / title> The selected text in the same label is regarded as a whole, the word2vec algorithm is used to predict the current word from the context vocabulary in each label to obtain the vectorization representation of the current word, the output vector of each word obtained is aggregated into a label vector in units of labels, and a label matrix is generated by combining all label vectors. The query vector sequence, key vector sequence and value vector sequence are obtained by using the label matrix through the self-attention mechanism, the attention value of each label is calculated through the query vector sequence, key vector sequence and value vector sequence, and the calculation formula of the attention value of the label is: ； wherein, is an attention value; Q, K, V are query vector sequence, key vector sequence and value vector sequence, respectively, is a scale; calculated in the above-described manner, <keyword> 、 <description>and <title>The attention value of the label is calculated in the following way to synthesize the semantic features of the website to be detected, which is:< / title> ； ； In the formula, F9 is the semantic feature of the website to be detected. is a row vector of the output vector, wherein each row respectively represents, <keyword> ， <description>and <title>The attention value of the label;< / title> to be a webpage semantic vector; respectively, <keyword> , <description> , <title>The semantic vector of the label;< / title> Step 3, generating the feature vector of the website: combining the quantitative features of the website to be detected obtained in step 1 with the semantic features of the website to be detected obtained in step 2 to form the feature vector of the website to be detected; Step 4, detecting malicious website: taking the feature vector of the website to be detected as input, using the website topology augmented graph data constructed in the way of oversampling expanded graph topology as training data to pre-train the graph convolutional neural network classifier to predict the type classification of the website to be detected, the type classification including: malicious website and legal website.

2. The method of detecting malicious website attacks of claim 1, wherein, In the method, the graph convolutional neural network classifier is trained by using the website topology augmented graph data constructed in the way of oversampling expanded graph topology as training data, including: Step 401, feature extraction is performed on the existing website topology: the feature vector of the input website is extracted by the graph neural network classifier, the website node representation is learned, and the website node attribute and graph topology information are obtained; Step 402, generating the feature attribute of the minority class node in the embedding space: generating a new node attribute belonging to the malicious website node category by interpolating the feature values of the malicious websites and their nearest neighbors in the embedding space; Step 403, constructing the link relationship between the new synthetic node and the old node: After the new synthetic node, the link relationship between the new and old nodes needs to be constructed, the original website topology graph is expanded, the correlation between the new synthetic node and the old node is calculated by using the weighted inner product decoder, the edge generation is derived, and the original website topology graph is expanded to obtain the website topology augmented graph data; Step 404, training the graph convolutional neural network classifier with the obtained website topology augmented graph data as the training data.

3. The method of detecting malicious website attacks according to claim 1 or 2, characterized in that, In the method, the structure of the graph convolutional neural network classifier is a double-layer graph convolutional neural network composed of an input layer, a hidden layer and an output layer; Wherein, the input of the input layer is the adjacency matrix of the website topology augmented graph data and the feature vector of each website, and the graph convolution formula of the input layer is: ； wherein, is a convolution kernel of the graph convolutional neural network classifier; x is an input website node; is a Chebyshev coefficient vector; is is a degree matrix of , A is an adjacency matrix of the graph; I N is an identity matrix; The hidden layer acts as a feature extractor and receives the output of the input layer, and the transfer function of the hidden layer is: ； wherein each parameter has the meaning of: is a nonlinear activation function; is a degree matrix of ; , A is an adjacency matrix of the website topology graph in the network, I N is an identity matrix of the website topology graph in the network; H （l） is a feature of the graph neural network layer, W (l) is a weight of the graph neural network layer; The forward propagation formula of the output layer is: ； wherein, is a weight matrix from the input layer to the hidden layer; is a weight matrix from the hidden layer to the output layer, X is a website node embedding feature; The loss function of the output layer classification is: ； wherein Loss is a classification loss function of the output layer; is the set of website node indices with labels; F represents the number of feature vectors; and Z is the output vector after propagation through the graph convolutional neural network classifier.

4. The method of detecting malicious website attacks of claim 1, wherein, The stop word quantity feature value refers to the word in the web text that has no actual meaning, and the calculation method of the stop word quantity feature value is as follows: ； ； Wherein, F1 is the number of stop words feature value; stop_rate is the stop word ratio, which refers to the ratio of the number of stop words in the webpage to the total number of words, and are the number of stop words and the total number of words in the webpage, respectively; is the threshold value of the stop word ratio, which is 0-1, and is taken as the base value by increasing 0.1 step by step, and other feature vectors remain unchanged, to record the highest accuracy value as the base value; ​ The error word quantity feature value refers to the word in the web text that is misspelled or does not exist, and the calculation method of the error word quantity feature value is as follows: ； ； Where F2 is the feature value of the number of erroneous words; error_rate is the ratio of erroneous words to the total number of words on the webpage. and These are the number of erroneous characters in the webpage and the total number of characters, respectively. This is a threshold for the error word ratio, ranging from 0 to 1, increasing by 0.1 at each iteration while keeping other feature vectors constant, to record the point of highest accuracy. The value is used as the base value; The calculation method of the keyword quantity feature value is as follows: ； Wherein, F3 is the key word quantity characteristic value; The key word in the web page is represented; The parameter of the key word quantity is taken as 100 in the web page, and the highest accuracy is recorded when the value is increased by 10, and the other characteristic vectors remain unchanged, and the value is taken as the base value. ​ The calculation method of the web page ranking value is as follows: ； Wherein, F5 is the webpage ranking value; PR is the PageRank value of the website node in the network topology graph; d is the damping factor, taking 0.85; is the website page currently calculated; is the website page set pointing to the website ; is the number of chain-out website pages; N is the number of all pages; The calculation method of the empty link quantity feature value is as follows: ； ； Wherein, F6 is the null link number characteristic value; null_rate is the null link rate of the webpage, and respectively are the number of null links and total links in the webpage; is the threshold value of the null link rate of the webpage, the value is between 0 and 1, and the value is taken as the base value when the accuracy rate is the highest by taking 0.1 as the ascending step and keeping other characteristic vectors unchanged; ​ The calculation method of the web page redirection link quantity feature value is as follows: ； ； Wherein, F7 is the webpage redirection link quantity characteristic value; redirect_rate is the webpage redirection link rate, and respectively are the redirection link quantity and the total link quantity; redirect_rate is the threshold value of the webpage redirection link rate, the value is between 0~1, to record the highest accuracy value as the base value when the value is increased by 0.1 successively and other characteristic vectors remain unchanged; ​ The calculation method of the web page external link quantity feature value is as follows: ； ； Wherein, F8 is the webpage external link quantity characteristic value; out_rate is the webpage redirection link rate, and respectively are the redirection link quantity and the total link quantity; is the threshold value of the webpage redirection link rate, the value is between 0-1, according to ascending 0.1, the other characteristic vectors remain unchanged, the value when the highest accuracy is recorded as the base value. ​ 5. A malicious website attack detection apparatus characterized by comprising: It comprises: A website quantitative feature extraction module, a website semantic feature extraction module, a website feature vector generation module and a malicious website detection module; wherein The website quantitative feature extraction module is in communication connection with the website feature vector generation module, can obtain the web page source code of the website to be detected, extracts the quantitative features of the website to be detected from the web page source code, and the quantitative features include: content features and link features; The website quantitative feature extraction module extracts the content features and link features of the website to be detected from the web page source code in the following manner, including: The web page source code is split in units of tags, and the HTML code in units of tags is obtained from the split <title>、< / title> <meta> The HTML code corresponding to each label extracts the content features and link features of the website to be detected; wherein ​ The content features of the website to be detected include: stop word quantity feature value, error word quantity feature value, keyword quantity feature value, web page text word quantity feature value; The website semantic feature extraction module is in communication connection with the website feature vector generation module, can select important tags closely related to website semantics from the web page source code of the website to be detected, extract semantic information of each tag from the selected important tags, and synthesize the semantic information of each tag into the semantic features of the website to be detected; the website semantic feature extraction module selects important tags closely related to website semantics from the web page source code of the website to be detected, extracts semantic information of each tag from the selected important tags, and synthesizes the semantic features of the website to be detected in the following manner, comprising: selected from the web source code of the website to be detected, <keyword> 、 <description>and <title>Four kinds of tags are selected as important tags closely related to website semantics;< / title> The selected text in the same tag is regarded as a whole, the word2vec algorithm is used to predict the current vector from the context words in each tag to obtain the vector representation of the current word, the output vector of each word obtained is aggregated into a tag vector in units of tags, and all tag vectors are combined to generate a tag matrix. The query vector sequence, the key vector sequence and the value vector sequence are obtained by using the tag matrix through the self-attention mechanism, the attention value of each tag is calculated through the query vector sequence, the key vector sequence and the value vector sequence, and the calculation formula of the attention value of the tag is: ； wherein, is an attention value; Q, K, V are query vector sequence, key vector sequence and value vector sequence, respectively, is a scale; calculated in the above-described manner, <keyword> 、 <description>and <title>The attention value of the tag is calculated and synthesized into the semantic features of the website to be detected in the following manner, which is:< / title> ； ； In the formula, F9 is the semantic feature of the website to be detected. is a row vector of the output vector, wherein each row respectively represents, <keyword> ， <description>and <title>The attention value of the tag;< / title> to be a webpage semantic vector; respectively, <keyword> 、 <description> 、 <title>The semantic vector of the tag;< / title> The website feature vector generation module is in communication connection with the malicious website detection module, and can synthesize the quantitative features of the website to be detected obtained by the website quantitative feature extraction module and the semantic features of the website to be detected obtained by the website semantic feature extraction module into the feature vector of the website to be detected; The malicious website detection module can take the feature vector of the website to be detected output by the website feature vector generation module as input, use the website topology augmented graph data constructed in the over-sampling expansion graph topology mode as training data to pre-train the graph convolutional neural network classifier, and predict the type classification of the website to be detected. The type classification includes: malicious website and legal website.

6. The malicious website attack detection apparatus according to claim 5, characterized by, The stop word quantity feature value refers to the word in the web page text without actual meaning, and the calculation method of the stop word quantity feature value is as follows: ； ； Wherein, F1 is the number of stop words feature value; stop_rate is the stop word ratio, which refers to the ratio of the number of stop words in the webpage to the total number of words, and are the number of stop words and the total number of words in the webpage, respectively; is the threshold value of the stop word ratio, which is 0-1, and the value is taken as the base value when the accuracy rate is the highest by increasing 0.1 step by step while keeping other feature vectors unchanged, ​ The error word quantity feature value refers to the word with spelling error or non-existent in the web page text, and the calculation method of the error word quantity feature value is as follows: ； ； Wherein, F2 is the error word number characteristic value; error_rate is the error word ratio, which refers to the ratio of the number of error words in the webpage to the total number of words, and respectively are the number of error words and the total number of words in the webpage; is the threshold value of the error word ratio, which is 0-1, and is taken as the base value by taking the highest accuracy rate as the base value according to the ascending 0.1 by 0.1, while other feature vectors remain unchanged; ​ The calculation method of the keyword quantity feature value is as follows: ； Wherein, F3 is the key word quantity characteristic value; Indicates the key word in the web page, Is the parameter of the number of key words, The value in the web page is within 100, and the highest accuracy is recorded when the other characteristic vectors remain unchanged by increasing by 10 each time. As the base value; The link features of the website to be detected include: webpage ranking value, empty link quantity feature value, webpage redirection link quantity feature value, and webpage external link quantity feature value; The calculation method of the webpage ranking value is as follows: ； wherein F5 is a webpage ranking value; PR is a PageRank value of a website node in a network topology graph; d is a damping factor; refers to a page set , is a current page; is a number of links from a webpage u; d is a damping factor; refers to a page set ; is a number of links from a webpage u; The calculation method of the empty link quantity feature value is as follows: ； ； Where F6 is the characteristic value of the number of empty links; null_rate is the null link rate of the webpage. and These are the number of empty links within the webpage and the total number of links, respectively. This is a threshold for the empty link rate of web pages, with a value between 0 and 1. The value is increased by 0.1 at each iteration, while other feature vectors remain unchanged, to record the point of highest accuracy. The value is used as the base value; The calculation method of the webpage redirection link quantity feature value is as follows: ； ； Wherein, F7 is the webpage redirection link quantity characteristic value; out_rate is the webpage redirection link rate, and respectively are the redirection link quantity and the total link quantity; is the threshold value of the webpage redirection link rate, the value is between 0-1, according to ascending 0.1, the other characteristic vectors remain unchanged, the value when the highest accuracy is recorded as the base value; ​ The calculation method of the webpage external link quantity feature value is as follows: ； ； Wherein, F8 is the webpage external link quantity characteristic value; out_rate is the webpage redirection link rate, and respectively are the redirection link quantity and the total link quantity; is the threshold value of the webpage redirection link rate, the value is between 0-1, according to ascending 0.1, other characteristic vectors remain unchanged, the value when the highest accuracy is recorded as the base value; ​ The structure of the graph convolutional neural network classifier of the malicious website detection module is a two-layer graph convolutional neural network composed of an input layer, a hidden layer and an output layer; The input of the input layer is an adjacency matrix of website topology augmented graph data and a feature vector of each website, and the graph convolution formula of the input layer is: ； wherein is a convolution kernel of the graph convolutional neural network classifier; ; the recursive definition of Chebyshev polynomials is , , ; L is a Laplacian matrix of the website topology augmented graph data, equal to D - A, D is a diagonal matrix, , A is an adjacency matrix of the graph, normalized as , is an identity matrix; The hidden layer acts as a feature extractor and receives the output of the input layer, and the transfer function of the hidden layer is: ； wherein each parameter has the meaning of: A is an adjacency matrix of a website topology graph in the network, I is an identity matrix of the website topology graph in the network; D is a degree matrix of H is a feature of a neural network layer, is a nonlinear activation function of the neural network; The forward propagation formula of the output layer is: ； wherein, is a weight matrix from the input layer to the hidden layer; is a weight matrix from the hidden layer to the output layer, X is a website node embedding feature; The loss function of the output layer classification is: ； wherein Loss is a classification loss function of the output layer; is the set of website node indices with labels; F denotes the number of feature vectors; and Z is the output vector after propagation through the graph convolutional neural network classifier.

7. A malicious website attack detection system characterized by, The application data security gateway adopts the malicious website attack detection device of claim 5 or 6. Each terminal device accesses the website of the Internet through the application data security gateway, and when any terminal device accesses the website of the Internet through the application data security gateway, the application data security gateway detects the accessed website, and if the accessed website is confirmed as a malicious website, the terminal device is prohibited from accessing the malicious website.

8. A processing device, characterized by The application data security gateway comprises: at least one memory for storing one or more programs; at least one processor capable of executing one or more programs stored in the memory, so that the processor can implement the method of any one of claims 1-4 when the one or more programs are executed by the processor. < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword> < / description> < / keyword>

Images