A method and device for identifying malicious websites

Abstract

The present invention provides a method and apparatus for identifying malicious websites, belonging to the field of network security technology. The method includes: obtaining a URL string corresponding to network traffic, network traffic features, and artificial URL features; splicing the network traffic features and the artificial URL features to obtain spliced artificial features, and converting the URL string into a vector; inputting the spliced artificial features and the vector into a malicious website identification model to obtain a malicious website identification result output by the model. The above method combines the features in the URL string, the artificial URL features constructed based on prior knowledge, and the network traffic features, avoiding the domain transfer problem caused by simply using models such as bert to process URL features for malicious website identification, as well as the problem of requiring a large amount of labeled data for model fine-tuning, and helping to improve the interpretability of the model. By taking network traffic features into consideration, the accuracy of malicious website identification is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a method and device for identifying malicious websites. Background Art

[0002] In recent years, lawbreakers have frequently used malicious websites to defraud money through phishing, fraud and other means. Malicious websites may disguise themselves as legitimate websites to obtain sensitive information such as users' personal information, account passwords, etc., so as to carry out phishing fraud; malicious websites may also embed viruses or malware, and infect users' computers, mobile phones and other devices through user clicks or downloads, resulting in the leakage of users' privacy data and the paralysis of computer systems. In order to expose and combat malicious websites, it is particularly important to accurately identify malicious websites.

[0003] In the current related technologies, the detection and identification of malicious websites usually use the following two methods:

[0004] The first is based on the bert model, which directly treats the Uniform Resource Locator (URL) sequence as general text for processing, so as to identify malicious websites. Since the bert model is pre-trained based on a large-scale corpus, and the URL features of malicious websites may be different from those of conventional text data, there are domain transfer problems. The specific domain features of the URLs of malicious websites may not be fully learned by the BERT model, and a large amount of data may be required to fine-tune the model to adapt to specific tasks. In addition, the pre-training of the bert model is based on the assumption that the masked words can be inferred from the context. This assumption is robust, but in the malicious website classification task based on URLs, this assumption may not exist, resulting in poor malicious website identification effects.

[0005] The second is to use machine learning to identify malicious websites based on the URL features summarized manually. Since the forms and features of malicious websites are constantly changing and evolving, and new threats and malicious behaviors are emerging continuously, relying solely on the features summarized manually cannot adapt to these new forms in a timely manner. In addition, the features summarized manually inevitably lose the word order information of the original URL, and the manual features may not be able to capture some potentially important features, thus affecting the malicious website identification effect. Summary of the Invention

[0006] Embodiments of the present invention provide a method and device for identifying malicious websites to solve the technical problem of poor identification effect existing in the existing malicious website identification methods.

[0007] In a first aspect, an embodiment of the present invention provides a method for identifying malicious websites, including:

[0008] Obtain the URL string, network traffic characteristics, and artificial URL characteristics corresponding to the network traffic;

[0009] Concatenate the network traffic characteristics and the artificial URL characteristics to obtain concatenated artificial features, and convert the URL string into a vector;

[0010] Input the concatenated artificial features and the vector into a malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model;

[0011] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the concatenated artificial features, and identify malicious websites based on the fused feature parameters.

[0012] In one embodiment, the malicious website recognition model includes a classifier and multiple stacked modules, and each module is composed of a self-attention layer and a cross-attention layer;

[0013] The self-attention layer is used to obtain the original sequence of the vector, convert each element in the original sequence into three parts: query, key, and value through different linear transformations; after multiplying the query and the key, normalize the dot product result of the query and the key to obtain a normalized self-attention value, and then multiply the normalized self-attention value by the value to obtain a new sequence with the same dimension as the original sequence;

[0014] The cross-attention layer is used to obtain the new sequence and the concatenated artificial features, convert each element in the new sequence into two parts: key and value through different linear transformations, and use the concatenated artificial features after dimensionality increase as the query part; after multiplying the key and the value, normalize the dot product result of the key and the value to obtain a normalized self-attention value, and then multiply the normalized self-attention value by the query to obtain feature parameters;

[0015] The classifier consists of a multi-layer perceptron and is used to perform classification calculations on the feature parameters to obtain the recognition result of malicious websites.

[0016] In one embodiment, after multiplying the query and the key, before normalizing the dot product result of the query and the key, it further includes: scaling the dot product result of the query and the key; after multiplying the key and the value, before normalizing the dot product result of the key and the value, it further includes: scaling the dot product result of the key and the value;

[0017] Before using the dimension - elevated spliced artificial features as the query part, it further includes: elevating the dimension of the spliced artificial features so that the query, key, and value have the same dimension.

[0018] In one embodiment, the malicious website recognition model is trained using a training dataset. The training dataset includes multiple groups of samples, and each group of samples includes the spliced artificial features, the vectors, and a label for marking whether the sample is a malicious website. During the training process, the Focal Loss function is adopted, and the formula is as follows:

[0019]

[0020] where p represents the predicted confidence of the current sample, y represents the label for marking whether the sample is a malicious website, α represents the balancing factor, and γ represents the modulation factor.

[0021] In one embodiment, the network traffic features include at least one of the following: the number of exchanged bytes, the number of exchanged tcp packets, the number of packets obtained from the server, the number of data packets transmitted from the client and the server, the total number of connected IPs, the number of generated IP data packets, the number of bytes transmitted from the client and the server, and the number of bytes obtained from the server.

[0022] The artificial URL features include at least one of the following: the length of the URL string, the number of numeric characters, whether the IP address is in the host name, whether there is a " / / " symbol in the path of the URL, the path length, the host name length, and the number of multiple preset special symbols.

[0023] In one embodiment, before inputting the spliced artificial features into the malicious website recognition model, it further includes:

[0024] Data standardization is performed on each feature in the spliced artificial features using the following formula:

[0025]

[0026] where z represents the result of data standardization, X min represents the maximum value of any feature, and X max represents the minimum value of any feature.

[0027] In a second aspect, an embodiment of the present invention provides a malicious website recognition device, including:

[0028] A data acquisition module for acquiring the URL string corresponding to the network traffic, network traffic features, and artificial URL features.

[0029] A data preprocessing module, configured to splice the network traffic features and the artificial URL features to obtain spliced artificial features, and convert the URL string into a vector;

[0030] An identification module, configured to input the spliced artificial features and the vector into a malicious website identification model, and obtain a malicious website identification result output by the malicious website identification model;

[0031] Wherein, the malicious website identification model is configured to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters.

[0032] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of any one of the above-mentioned malicious website identification methods are implemented.

[0033] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above-mentioned malicious website identification methods are implemented.

[0034] In a fifth aspect, an embodiment of the present invention further provides a computer program product. When the computer program is executed by a processor, the steps of any one of the above-mentioned malicious website identification methods are implemented.

[0035] The malicious website identification method and device provided by the embodiments of the present invention obtain a URL string, network traffic features, and artificial URL features corresponding to network traffic; splice the network traffic features and the artificial URL features to obtain spliced artificial features, and convert the URL string into a vector; input the spliced artificial features and the vector into a malicious website identification model, and obtain a malicious website identification result output by the malicious website identification model. Through the application of the above methods and devices, the features in the URL string, the artificial URL features constructed based on prior knowledge, and the network traffic features are organically combined, avoiding the domain transfer problem caused by simply using language models such as bert to process URL features for malicious website identification, and avoiding the problem of requiring a large amount of labeled data for model fine-tuning, which helps to improve the interpretability of the model. In addition, by considering the network traffic features, the basis for judging malicious websites is increased, and the accuracy of malicious website identification is improved. Description of the Drawings

[0036] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on these drawings.

[0037] Figure 1 It is a schematic flowchart of the malicious website identification method provided by the embodiments of the present invention;

[0038] Figure 2 It is a schematic diagram of the execution process of the malicious website identification method in the embodiments of the present invention;

[0039] Figure 3 It is a schematic diagram of the self-attention mechanism in the embodiments of the present invention;

[0040] Figure 4 It is a schematic diagram of the cross-attention mechanism in the embodiments of the present invention;

[0041] Figure 5 It is a schematic structural diagram of the malicious website identification device provided by the embodiments of the present invention;

[0042] Figure 6 It is a schematic structural diagram of the electronic device provided by the embodiments of the present invention.

[0043] Among them, the reference numerals are:

[0044] 51: Data acquisition module; 52: Data preprocessing module; 53: Identification module. Detailed implementation manners

[0045] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention in conjunction with the accompanying drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0046] It should be noted that in the description of the present invention, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element. The orientation or positional relationship indicated by terms such as "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be construed as a limitation of the present invention. Unless otherwise expressly specified and limited, the terms "mount", "connect", "couple" shall be construed broadly, for example, it may be a fixed connection, a detachable connection or an integral connection; it may be a mechanical connection or an electrical connection; it may be directly connected or indirectly connected through an intermediate medium, and may be the internal communication of two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention may be understood according to specific circumstances.

[0047] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually of the same category, and do not limit the number of objects. For example, the first object may be one or more. In addition, "and / or" means at least one of the connected objects, and the character " / ", generally indicates an "or" relationship between the associated objects before and after.

[0048] The following will combine Figures 1-4 to describe the malicious website identification method of the present invention.

[0049] Figure 1 is a schematic flowchart of the malicious website identification method provided by the embodiment of the present invention. Referring to Figure 1 , the embodiment of the present invention provides a malicious website identification method, including but not limited to the following steps:

[0050] S1. Obtain the URL string corresponding to the network traffic, the network traffic characteristics and the artificial URL characteristics.

[0051] Specifically, the URL string is a string composed of each character in the URL sequence of a website. For example, http: / / 108.179.216.140 / ~bankofamerica / is a URL string as an example.

[0052] In a real scenario, a communication operator can obtain network traffic data for accessing a certain website. The network traffic characteristics in the present invention refer to the network traffic characteristics for accessing a certain website obtained from the network traffic, as shown in Table 1, including but not limited to at least one of the number of exchanged bytes, the number of exchanged tcp packets, the number of packets obtained from the server, the number of data packets transmitted between the client and the server, the total number of connected IPs, the number of generated IP data packets, the number of bytes transmitted between the client and the server, and the number of bytes obtained from the server.

[0053] Table 1 Schematic Table of Network Traffic Characteristics

[0054]

[0055]

[0056] Artificial URL characteristics refer to the characteristics related to the URL sequence with prior knowledge selected manually. The common forms of the URL sequences corresponding to malicious websites are shown in Table 2.

[0057] Table 2 Schematic Table of Common Concentrated Malicious Website URLs

[0058]

[0059] In a preferred embodiment of the present invention, according to the above common URL sequences of malicious websites, as shown in Table 3, the selected artificial URL characteristics include but not limited to at least one of the URL string length, the number of numeric characters, whether the IP address is in the host name, whether there is a " / / " symbol in the path of the URL, the path length, the host name length, and the number of multiple preset special symbols. Among them, the number of multiple special symbols includes but not limited to at least one of the number of special symbol ".", the number of special symbol "-", the number of special symbol "@", the number of special symbol "~", the number of special symbol "%", the number of special symbol "&", and the number of special symbol "#".

[0060] Table 3 Schematic Table of Artificial URL Characteristics

[0061]

[0062]

[0063] S2. Concatenate the network traffic features and the artificial URL features to obtain concatenated artificial features, and convert the URL string into a vector.

[0064] Specifically, as Figure 2 shown, in this step, the network traffic features and the artificial URL features are concatenated. Assuming that the network traffic features contain 5 features and the artificial URL features contain 6 features, the concatenated artificial features obtained after concatenation contain a total of 11 features.

[0065] To convert the URL string into a vector, first filter out commonly occurring segments such as "www" and "http", then split the URL string into individual characters, and then use one-hot encoding to convert each character into a number according to a specific correspondence. Since the neural network requires that the length of each input is fixed, while the length of the URL string is not fixed, it is also necessary to set a fixed length L to crop or pad the URL string with 0. Finally, use the embedding layer in the neural network to convert the numbers into vectors. In addition, since the same field has different meanings when it appears in different regions, it is also necessary to add relative position encoding to the url string.

[0066] S3. Input the concatenated artificial features and the vector into the malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model.

[0067] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the concatenated artificial features, and identify malicious websites based on the fused feature parameters.

[0068] Specifically, the malicious website recognition model in the present invention is obtained by training with a training data set. The training data set includes multiple groups of samples, and each group of samples includes the concatenated artificial features, the vector, and a label for marking whether the sample is a malicious website. Considering the situation that the number of malicious websites in the real scenario is much lower than the number of normal websites, the present invention uses the Focal Loss function to optimize the model during training, and the formula is as follows:

[0069]

[0070] Among them, p represents the predicted confidence of the current sample, y represents the label for marking whether the sample is a malicious website, α represents the balance factor, and γ represents the modulation factor.

[0071] The focal loss function is used because in reality, if a general loss function such as cross-entropy is used, the model will tend to classify all websites as normal websites. However, using methods such as resampling or undersampling not only changes the original distribution of the input, but also may cause problems such as model overfitting. For example, data oversampling increases the number of samples in the smaller class, and data undersampling reduces the number of samples in the larger class. Using the Focal Loss function can solve the above problems while keeping the input distribution unchanged. The main role of Focal Loss is to readjust the loss contributions of easy samples (low prediction confidence) and hard samples (high prediction confidence), increasing the network's attention to the learning of hard samples. α mainly adjusts the weights of positive and negative samples, and γ dynamically adjusts the loss contributions of samples. For samples with higher confidence, the modulation factor will generate a lower weight, and vice versa. At this time, if the samples are imbalanced, assuming that the negative samples are much more than the positive samples, the model will inevitably overfit the negative samples at the initial stage, and the predicted confidence p calculated for all samples is very small. Since p is very small, the loss of negative samples almost decays to 0, while the loss of positive samples hardly decays, leaving only a few positive samples generating losses, and the sample imbalance is automatically solved.

[0072] As Figure 2 As shown, the malicious website recognition model provided by the present invention includes a classifier and multiple stacked modules, and each module is composed of a self-attention layer and a cross-attention layer. The purpose of setting multiple modules is to increase the representation and fitting ability for complex problems, and to add the cross-attention layer multiple times to ensure that the spliced artificial features with prior knowledge are considered by the model.

[0073] Since there are certain differences between the URLs of malicious websites and natural languages, using a pre-trained bert model to process URLs will encounter the problem of domain transfer. And because the context correlation degree of URLs is weaker than that of natural languages, it is not suitable to use the MLM loss for training. In view of this feature, the present invention designs a neural network structure that alternately stacks self-attention layers and cross-attention layers, enabling the artificially extracted features with prior knowledge to guide the neural network for feature extraction, accelerating the convergence speed of the model, and improving the recognition accuracy.

[0074] Specifically, as Figure 3 shown, the self-attention layer is used to obtain the original sequence of vectors obtained by converting the URL string as the input, and each element in the original sequence is converted into three parts: query, key, and value through different linear transformations. Preferably, each element in the original sequence can be multiplied by three learnable and randomly initialized weight matrices respectively to obtain query, key, and value vectors.

[0075] The self-attention mechanism is a mechanism used in deep learning models, which is good at capturing the internal correlations of data or features. It can solve the long-distance dependence problem by calculating the mutual influence between tokens. The self-attention mechanism first calculates the attention values, which are the dot product results of keys and queries. After multiplying the query and the key, a normalization function is used to normalize the dot product result of the query and the key, so that the sum of each attention value is 1, and the normalized self-attention values are obtained. Then, the normalized self-attention values are multiplied by the values to obtain a new sequence with the same dimension as the original sequence, which is used as the output result of the self-attention layer in the model and is input into the next layer in the model, that is, the cross-attention layer. In an optional embodiment, in order to avoid the dot product result of the key and the query being too large and exceeding the representation ability of the computer, the result is usually scaled. The self-attention mechanism (self-attention) can be expressed by the following mathematical formula:

[0076]

[0077] where X is the input sequence, XW Q 、XW K and XW v are the weight matrices of the query, key and value vectors respectively, and d k is the dimension of the key vector.

[0078] As Figure 4 shown, the cross-attention layer is used to obtain the spliced artificial features and the new sequence output by the self-attention layer. Each element in the new sequence is converted into two parts, key and value, through different linear transformations, and the spliced artificial features are upsampled and used as the query part. It should be understood that the present invention does not limit the upsampling method used to upsample the spliced artificial features. Preferably, the embedding method can be used to upsample the spliced artificial features, and the purpose of upsampling is to make the query, key and value have the same dimension.

[0079] After multiplying the key and the value, a normalization function is used to normalize the dot product result of the key and the value to obtain the normalized self-attention values, and then the normalized self-attention values are multiplied by the query to obtain the feature parameters.

[0080] The difference between the cross-attention mechanism and the self-attention mechanism is that in the self-attention mechanism, the query, key, and value all come from the same sequence (the original sequence of vectors obtained by converting the URL string), which are just the products after different linear transformations. In the cross-attention mechanism, the key and value still come from the features extracted from the url string (the new sequence output by the self-attention layer), while the query comes from the artificially extracted concatenated artificial features. By using the cross-attention mechanism, it is required that the neural network be guided by the artificially extracted features with prior knowledge during the feature extraction process, and this process is repeated multiple times (multiple modules) in the neural network to ensure that the neural network can incorporate the prior knowledge in the artificially extracted features.

[0081] Preferably, the present invention uses global average pooling to process the feature parameters output by the cross-attention layer. Since relative position encoding is added to the url string in step S2, using global average pooling will not lose too much position information and can obtain a higher operation speed.

[0082] The classifier consists of a multi-layer perceptron and is used to perform classification calculations on the feature parameters to obtain the recognition result of malicious websites. The last layer in a series of derivative algorithms of the neural network is a classifier composed of a multi-layer perceptron, which is used to perform final classification calculations on the processed feature parameters to obtain the probability corresponding to each sample label. After obtaining the prediction result, the parameters in the model can also be continuously trained and updated through the backpropagation mechanism.

[0083] In an optional embodiment of the present invention, in view of the characteristic that the numerical feature ranges in the artificially extracted URL features and network traffic features of malicious websites are inconsistent, before inputting the concatenated artificial features into the malicious website recognition model, it is also necessary to perform a normalization operation on the data to prevent some features with a larger range or larger variance from occupying a larger proportion in the training of the model, thereby affecting the performance and trade-off of the model. Specifically, the following formula is used to perform data normalization on each feature in the concatenated artificial features:

[0084]

[0085] where z represents the result of data normalization, and X min represents the maximum value of any feature, and X max represents the minimum value of any feature.

[0086] In summary, the malicious website recognition method provided by the present invention organically combines the features in the URL string, the artificial URL features constructed based on prior knowledge, and the advantages of network traffic features, enabling the features summarized manually to guide the feature learning of the neural network, avoiding the domain transfer problem caused by simply using language models such as bert to process URL features for malicious website recognition, and avoiding the problem of requiring a large amount of labeled data for model fine-tuning, which helps to improve the interpretability of the model. In addition, by considering network traffic features, the basis for judging malicious websites is increased, the accuracy of malicious website recognition is improved, and it has good application effects.

[0087] Based on the same inventive concept, the present invention also provides a malicious website recognition device. The malicious website recognition device provided by the present invention will be described below, and the malicious website recognition device described below can be mutually referred to the malicious website recognition method described above.

[0088] As Figure 5 shown, the malicious website recognition device provided by the present invention includes:

[0089] A data acquisition module 51, configured to acquire a URL string corresponding to network traffic, network traffic features, and artificial URL features;

[0090] A data preprocessing module 52, configured to splice the network traffic features and the artificial URL features to obtain spliced artificial features, and convert the URL string into a vector;

[0091] An identification module 53, configured to input the spliced artificial features and the vector into a malicious website recognition model, and obtain a malicious website recognition result output by the malicious website recognition model;

[0092] Wherein, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and recognize malicious websites based on the fused feature parameters.

[0093] Figure 6 An example of the schematic physical structure of an electronic device is shown in Figure 6 shown. The electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640. Among them, the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logical instructions in the memory 630 to execute any of the above malicious website recognition methods, and the method includes:

[0094] Obtain the URL string corresponding to the network traffic, the network traffic features, and the artificial URL features.

[0095] Concatenate the network traffic features and the artificial URL features to obtain concatenated artificial features, and convert the URL string into a vector.

[0096] Input the concatenated artificial features and the vector into the malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model.

[0097] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the concatenated artificial features, and identify malicious websites based on the fused feature parameters.

[0098] In addition, when the logical instructions in the above-mentioned memory 630 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0099] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the malicious website recognition method provided by the above-mentioned various methods. The method includes:

[0100] Obtain the URL string corresponding to the network traffic, the network traffic features, and the artificial URL features.

[0101] Concatenate the network traffic features and the artificial URL features to obtain concatenated artificial features, and convert the URL string into a vector.

[0102] Input the concatenated artificial features and the vector into the malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model.

[0103] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters.

[0104] In another aspect, the present invention also provides a processor-readable storage medium storing a computer program for causing a processor to execute the malicious website recognition method provided in each of the above embodiments. The method includes:

[0105] Obtain the URL string corresponding to the network traffic, the network traffic features, and the artificial URL features.

[0106] Splice the network traffic features and the artificial URL features to obtain spliced artificial features, and convert the URL string into a vector.

[0107] Input the spliced artificial features and the vector into the malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model.

[0108] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters.

[0109] In another aspect, the present invention also provides a computer program for causing a processor to execute the malicious website recognition method provided in each of the above embodiments. The method includes:

[0110] Obtain the URL string corresponding to the network traffic, the network traffic features, and the artificial URL features.

[0111] Splice the network traffic features and the artificial URL features to obtain spliced artificial features, and convert the URL string into a vector.

[0112] Input the spliced artificial features and the vector into the malicious website recognition model to obtain the malicious website recognition result output by the malicious website recognition model.

[0113] Among them, the malicious website recognition model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units. That is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0115] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or equivalently replace some of the technical features. However, these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying malicious websites, characterized in that: include: Obtain URL strings, network traffic features, and artificial URL features corresponding to network traffic; splicing the network traffic feature and the artificial URL feature to obtain a spliced artificial feature, and converting the URL string into a vector; Inputting the spliced artificial features and the vector into a malicious website identification model to obtain a malicious website identification result output by the malicious website identification model; The malicious website identification model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters; The malicious website identification model includes a classifier and multiple stacked modules, each of which is composed of a self-attention layer and a cross-attention layer; The self-attention layer is used to obtain the original sequence of the vector, convert each element in the original sequence into three parts: query, key, and value through different linear transformations; after performing a dot product between the query and the key, the dot product of the query and the key is normalized to obtain a normalized self-attention value, and then the normalized self-attention value is dot-multiplied with the value to obtain a new sequence with the same dimension as the original sequence; The cross attention layer is used to obtain the new sequence and the spliced artificial features, convert each element in the new sequence into two parts, a key and a value, through different linear transformations, and use the spliced artificial features as the query part after dimensionality upgrade; after performing a dot product between the key and the value, the dot product result of the key and the value is normalized to obtain a normalized self-attention value, and then the normalized self-attention value is dot-multiplied with the query to obtain a feature parameter; The classifier is composed of a multi-layer perceptron, and is used to perform classification calculations on the feature parameters to obtain identification results of malicious websites.

2. The malicious website identification method according to claim 1, characterized in that: After performing dot product on the query and key, and before normalizing the result of the dot product of the query and key, the process also includes: scaling the result of the dot product of the query and key; after performing dot product on the key and value, and before normalizing the result of the dot product of the key and value, the process also includes: scaling the result of the dot product of the key and value; Before the spliced artificial features are upgraded in dimension and used as the query part, the method further includes: upgrading the spliced artificial features in dimension so that the query, key and value have the same latitude.

3. The method for identifying malicious websites according to claim 1, wherein: The malicious website identification model is trained using a training data set, which includes multiple groups of samples. Each group of samples includes the spliced artificial features, the vector, and a label for marking whether the sample is a malicious website. The Focal Loss function is used in the training process, and the formula is as follows: ； in, represents the prediction confidence of the current sample, Indicates the label used to mark whether the sample is a malicious website. represents the balance factor, represents the modulation factor.

4. The method for identifying malicious websites according to claim 1, wherein: The network traffic characteristics include at least one of the number of bytes exchanged, the number of TCP packets exchanged, the number of packets obtained from the server, the number of packets transmitted from the client and the server, the total number of connected IPs, the number of IP packets generated, the number of bytes transmitted from the client and the server, and the number of bytes obtained from the server; The artificial URL features include: URL string length, number of numeric characters, whether the IP address is in the host name, whether there is a " / / " symbol in the URL path, path length, host name length and at least one of the preset number of special symbols.

5. The method for identifying malicious websites according to any one of claims 1 to 4, characterized in that: Before inputting the spliced artificial features into the malicious website identification model, the method further includes: The following formula is used to standardize the data of each feature in the spliced artificial features: ； Among them, z represents the result of data normalization, represents the maximum value of any feature, Represents the minimum value of any feature.

6. A malicious website identification device, characterized in that: include: The data acquisition module is used to obtain the URL string corresponding to the network traffic, network traffic characteristics and artificial URL characteristics; A data preprocessing module, configured to concatenate the network traffic feature and the artificial URL feature to obtain a concatenated artificial feature, and convert the URL string into a vector; an identification module, configured to input the spliced artificial features and the vector into a malicious website identification model to obtain a malicious website identification result output by the malicious website identification model; The malicious website identification model is used to extract features from the vector, fuse the features extracted from the vector with the spliced artificial features, and identify malicious websites based on the fused feature parameters; The malicious website identification model includes a classifier and multiple stacked modules, each of which is composed of a self-attention layer and a cross-attention layer; The self-attention layer is used to obtain the original sequence of the vector, convert each element in the original sequence into three parts: query, key, and value through different linear transformations; after performing a dot product between the query and the key, the dot product of the query and the key is normalized to obtain a normalized self-attention value, and then the normalized self-attention value is dot-multiplied with the value to obtain a new sequence with the same dimension as the original sequence; The cross attention layer is used to obtain the new sequence and the spliced artificial features, convert each element in the new sequence into two parts, a key and a value, through different linear transformations, and use the spliced artificial features as the query part after dimensionality upgrade; after performing a dot product between the key and the value, the dot product result of the key and the value is normalized to obtain a normalized self-attention value, and then the normalized self-attention value is dot-multiplied with the query to obtain a feature parameter; The classifier is composed of a multi-layer perceptron, and is used to perform classification calculations on the feature parameters to obtain identification results of malicious websites.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the malicious website identification method according to any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malicious website identification method according to any one of claims 1 to 5 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the malicious website identification method according to any one of claims 1 to 5 are implemented.

Images