Malicious link intelligent detection method, system, equipment and medium

Abstract

The invention relates to the technical field of network security, in particular to a malicious link intelligent detection method, system and device and a medium. Through the arrangement of the black list library and the white list library, the detection quantity of the to-be-detected link is reduced, so that the detection efficiency of the malicious link is improved; by setting the grey list library and scoring the URL of the to-be-detected link when accessing the to-be-detected link in the grey list library each time, the accuracy of the to-be-detected link is continuously optimized, and the access strategy and the detection strategy of the to-be-detected link are optimized according to the score value; the detection efficiency of the malicious link is further improved, and the detection accuracy of the malicious link is continuously improved; according to the method, the to-be-detected links which are accessed previously are scored, coded and classified, then the blacklist library, the white list library and the grey list library are continuously optimized, the detection strategy and the access strategy are continuously optimized, and therefore the detection efficiency and accuracy of the malicious links are continuously improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, system, device and medium for intelligently detecting malicious links. Background Art

[0002] Malicious links are those that contain malicious code or lead to malicious websites, designed to compromise the security of user devices or steal user information. These links may be disguised as normal websites or messages to trick users into clicking on them, thereby triggering malicious programs such as Trojan viruses or Trojan horses, which can infect user devices or steal user information.

[0003] Existing detection technologies such as feature detection and anomaly detection are prone to a large number of false positives due to the difficulty in accurately setting the threshold. For example, if the threshold of the statistical method in anomaly detection is set too low, a large number of false positives will be generated; if it is set too high, it may lead to missed negatives. In addition, the detection method of protocol analysis is also prone to missed negatives because it does not support all protocol types, thus affecting the accuracy of detection.

[0004] It can be seen that how to improve the detection efficiency and accuracy of malicious links is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a malicious link intelligent detection method, system, device and medium, which are intended to solve the technical problem of how to improve the detection efficiency and accuracy of malicious links in the prior art.

[0006] The present application provides a malicious link intelligent detection method, comprising the following steps:

[0007] Get the link to be tested;

[0008] Identify the URL of the link to be tested to obtain an identification result;

[0009] According to the identification result, a blacklist database, a whitelist database or a graylist database is queried to obtain a query result;

[0010] Determine an access strategy according to the query result;

[0011] The query results include a first result, a second result, a third result, and a fourth result;

[0012] The first result is configured as the URL of the link to be tested belongs to the blacklist library, the second result is configured as the URL of the link to be tested belongs to the whitelist library, the third result is configured as the URL of the link to be tested belongs to the graylist library, and the fourth result is configured as the URL of the link to be tested belongs to neither the blacklist library nor the whitelist library nor the graylist library;

[0013] The access strategy includes a first strategy, a second strategy, a third strategy and a fourth strategy;

[0014] The first strategy is configured to block access to the link to be tested, the second strategy is configured to directly access the link to be tested, the third strategy is configured to access the link to be tested in a sandbox and score the URL of the link to be tested, and the fourth strategy is configured to access the link to be tested in a sandbox and score the URL of the link to be tested and encode the URL of the link to be tested according to a preset encoding strategy and a score value;

[0015] If the query result is the first result, executing the first strategy;

[0016] If the query result is the second result, executing the second strategy;

[0017] If the query result is the third result, executing the third strategy;

[0018] If the query result is the fourth result, the fourth strategy is executed.

[0019] Optionally, identifying the URL of the link to be tested includes the following steps:

[0020] Detect whether the URL of the link to be tested has a corresponding code to obtain a judgment result;

[0021] Determine the recognition result according to the judgment result;

[0022] Wherein, if the judgment result is that the URL of the link to be tested has the corresponding code, then the code of the URL of the link to be tested is obtained, and the recognition result is determined according to the code of the URL of the link to be tested;

[0023] If the judgment result is that the URL of the link to be tested has no corresponding code, a temporary code is assigned to the URL of the link to be tested, and the recognition result is determined according to the temporary code of the URL of the link to be tested.

[0024] Optionally, querying a blacklist library, a whitelist library or a graylist library according to the identification result includes the following steps:

[0025] Determine the list library to be queried according to the recognition result;

[0026] Query the list database to obtain query results;

[0027] Wherein, the code includes a first code, a second code and a third code;

[0028] The list library includes the blacklist library, the whitelist library and the greylist library;

[0029] The first code is identified by a first character, the second code is identified by a second character, and the third code is identified by a third character;

[0030] If it is detected that the code is the first code, query the blacklist database to determine the first result;

[0031] If it is detected that the code is the second code, query the whitelist library to determine the second result;

[0032] If it is detected that the code is the third code, query the gray list library to determine the third result;

[0033] If it is detected that the code is the temporary code, the list library is not queried, and the fourth result is determined.

[0034] Optionally, the first characters include uppercase alphabetic characters, the second characters include lowercase alphabetic characters, and the third characters include numeric characters.

[0035] Optionally, the fourth strategy includes the following steps:

[0036] Access the link to be tested in the sandbox;

[0037] Detecting the object pointed to by the link to be tested and the behavior implemented after the response, so as to obtain the detection result;

[0038] Scoring the URL of the link to be tested using a preset scoring strategy according to the detection result to obtain a scoring value;

[0039] The URL of the link to be tested is encoded according to a preset encoding strategy and with reference to the scoring value.

[0040] Optionally, the preset encoding strategy includes the following steps:

[0041] Detecting the encoding structure of the URL of the link to be tested;

[0042] Comparing the score value with a first score threshold and a second score threshold to obtain a comparison result;

[0043] Determine whether the encoding of the URL of the link to be tested needs to be translated according to the encoding structure and the comparison result, and if it is determined that the encoding of the URL of the link to be tested needs to be translated, proceed to the next step;

[0044] Selecting a character library for encoding according to the comparison result to obtain characters for encoding translation;

[0045] The encoding of the URL of the link to be tested is translated using characters used for encoding translation, so as to translate the encoding of the URL of the link to be tested into an encoding that matches a corresponding character library.

[0046] Optionally, the preset scoring strategy includes the following steps:

[0047] Analyze the components of the URL of the link to be tested;

[0048] Obtaining malicious values ​​of various components of the URL of the link to be tested;

[0049] Scoring each component of the URL of the link to be tested respectively according to the malicious value to obtain a first scoring value group;

[0050] Scoring the direction pointed to by the link to be tested after responding and the behavior implemented to obtain a second scoring value group;

[0051] The first scoring value group and the second scoring value group are comprehensively analyzed to obtain the scoring value.

[0052] On the other hand, the present application also provides a malicious link intelligent detection system, including:

[0053] An identification unit, the identification unit is used to identify the URL of the link to be tested;

[0054] A storage unit, the storage unit is used to store a blacklist library, a whitelist library and a graylist library about the URL of the link to be tested;

[0055] A query unit, the query unit is used to query a blacklist library, a whitelist library or a graylist library according to the identification result of the URL of the link to be tested;

[0056] A processing unit, the processing unit is used to determine the access strategy of the link to be tested according to the query result of the query unit;

[0057] A scoring unit, the scoring unit is used to score the URL of the link to be tested according to a preset scoring strategy;

[0058] An encoding unit, wherein the encoding unit is used to encode the URL of the link to be tested according to a preset encoding strategy and a scoring value.

[0059] On the other hand, the present application also provides a malicious link intelligent detection device, including:

[0060] A memory, the memory being used to store one or more program instructions;

[0061] A processor is used to run one or more program instructions to execute the steps of the malicious link intelligent detection method.

[0062] On the other hand, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer processor, the steps of the malicious link intelligent detection method are implemented.

[0063] The beneficial effect achieved by the present application is that: in the process of detecting malicious links, the link to be tested is first obtained, and the URL of the link to be tested is identified, and whether the URL of the link to be tested belongs to a blacklist library, a whitelist library or a graylist library is identified. After obtaining the query result, the access policy of the link to be tested can be determined according to the query result. If the URL of the link to be tested belongs to the blacklist library, it indicates that the link to be tested was previously detected as a malicious link, and access to the link to be tested is blocked at this time; if the URL of the link to be tested belongs to the whitelist library, it indicates that the link to be tested was previously detected as a trusted link, and the link to be tested is directly accessed at this time; if the URL of the link to be tested belongs to the graylist library, it indicates that the link to be tested was previously detected as having a high risk of adverse consequences from accessing the link to be tested, and at this time, the link to be tested is accessed in the sandbox, and the URL of the link to be tested is scored, and the URL of the link to be tested is reclassified according to the score, so as to optimize the access strategy for subsequent access to the link to be tested; if the link to be tested does not belong to any of the blacklist library, the whitelist library or the graylist library, it indicates that the link to be tested has not been visited before, and at this time, the link to be tested is accessed in the sandbox, and the URL of the link to be tested is scored, and the URL of the link to be tested is encoded according to the preset encoding strategy reference score value, and then the URL of the link to be tested is classified according to the encoding of the URL of the link to be tested, so that a more optimized access strategy can be implemented when the link to be tested is visited again later. In this way, by setting up the blacklist library and the whitelist library, the detection amount of the links to be tested is reduced, thereby improving the detection efficiency of malicious links; by setting up the graylist library, and scoring the URL of the link to be tested each time the link to be tested in the graylist library is accessed, the accuracy of the link to be tested is continuously optimized, and the access strategy and detection strategy of the link to be tested are optimized according to the score value, thereby further improving the detection efficiency of malicious links and continuously improving the accuracy of malicious link detection; by scoring, encoding and classifying the links to be tested that have been visited before, the blacklist library, the whitelist library and the graylist library are continuously optimized, and the detection strategy and access strategy are continuously optimized, thereby continuously improving the detection efficiency and accuracy of malicious links. In this way, as the number and number of links to be tested increase, the access strategy and detection strategy are continuously optimized, thereby continuously improving the detection efficiency and accuracy of malicious links. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1is a flowchart of the steps of the intelligent detection method of malicious links in an embodiment of the present invention;

[0065] Figure 2 is a flow chart of the steps of identifying the URL of a link to be tested in an embodiment of the present invention;

[0066] Figure 3 is a flowchart of the steps of querying a blacklist library, a whitelist library or a graylist library according to the identification result in an embodiment of the present invention;

[0067] Figure 4 is a flowchart of the steps of the fourth strategy in an embodiment of the present invention;

[0068] Figure 5 is a flowchart of the steps of presetting the encoding strategy in an embodiment of the present invention;

[0069] Figure 6 It is a flowchart of the steps of the preset scoring strategy in an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar units or units with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention. In addition, it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0071] In the description of the present invention, it is necessary to understand that the orientation or positional relationship indicated by terms such as "length", "width", "up", "down", "left", "right", "horizontal", "top" and "bottom" are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or unit referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0072] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0073] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or can communicate with each other; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can be the internal connection of two units or the interaction relationship between two units. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0074] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0075] The disclosure below provides many different embodiments or examples to realize different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or reference letters in different examples, and this repetition is for the purpose of simplification and clarity, which itself does not indicate the relationship between the various embodiments and / or settings discussed. In addition, the examples of various specific processes and materials provided by the present invention, but those of ordinary skill in the art can be aware of the application of other processes and / or the use of other materials.

[0076] See also Figure 1 In some embodiments of the present application, the present application provides a malicious link intelligent detection method, comprising the following steps:

[0077] S1. Get the link to be tested;

[0078] S2, identifying the URL of the link to be tested to obtain an identification result;

[0079] S3. Query the blacklist database, whitelist database or graylist database according to the identification result to obtain the query result;

[0080] S4. Determine the access strategy based on the query results;

[0081] The query results include a first result, a second result, a third result, and a fourth result;

[0082] The first result is configured as the URL of the link to be tested belongs to the blacklist library, the second result is configured as the URL of the link to be tested belongs to the whitelist library, the third result is configured as the URL of the link to be tested belongs to the graylist library, and the fourth result is configured as the URL of the link to be tested belongs to neither the blacklist library nor the whitelist library nor the graylist library;

[0083] The access policies include a first policy, a second policy, a third policy, and a fourth policy;

[0084] The first strategy is configured to block access to the link to be tested, the second strategy is configured to directly access the link to be tested, the third strategy is configured to access the link to be tested in the sandbox and score the URL of the link to be tested, and the fourth strategy is configured to access the link to be tested in the sandbox and score the URL of the link to be tested and encode the URL of the link to be tested according to a preset encoding strategy and a score value;

[0085] If the query result is the first result, the first strategy is executed;

[0086] If the query result is the second result, the second strategy is executed;

[0087] If the query result is the third result, the third strategy is executed;

[0088] If the query result is the fourth result, the fourth strategy is executed.

[0089] It is understandable that in the process of detecting malicious links, the link to be tested is first obtained, and the URL of the link to be tested is identified, and whether the URL of the link to be tested belongs to the blacklist library, the whitelist library or the graylist library is identified. After obtaining the query result, the access policy of the link to be tested can be determined according to the query result.

[0090] If the URL of the link to be tested belongs to the blacklist library, it indicates that the link to be tested was previously detected as a malicious link, and access to the link to be tested is blocked at this time; if the URL of the link to be tested belongs to the whitelist library, it indicates that the link to be tested was previously detected as a trusted link, and the link to be tested is directly accessed at this time; if the URL of the link to be tested belongs to the graylist library, it indicates that the link to be tested was previously detected as having a high risk of adverse consequences from accessing the link to be tested, and at this time, the link to be tested is accessed in the sandbox, and the URL of the link to be tested is scored, and the URL of the link to be tested is reclassified according to the score, so as to optimize the access strategy for subsequent access to the link to be tested; if the link to be tested does not belong to any of the blacklist library, the whitelist library or the graylist library, it indicates that the link to be tested has not been visited before, and the access risk of the link to be tested is unknown, and at this time, the link to be tested is accessed in the sandbox, and the URL of the link to be tested is scored, and the URL of the link to be tested is encoded according to the preset encoding strategy reference score value, and then the URL of the link to be tested is classified according to the encoding of the URL of the link to be tested, so that a more optimized access strategy can be implemented when the link to be tested is visited again later.

[0091] In this way, by setting up the blacklist library and the whitelist library, the detection amount of the links to be tested is reduced, thereby improving the detection efficiency of malicious links; by setting up the graylist library, and scoring the URL of the link to be tested each time the link to be tested in the graylist library is accessed, the accuracy of the link to be tested is continuously optimized, and the access strategy and detection strategy of the link to be tested are optimized according to the score value, thereby further improving the detection efficiency of malicious links and continuously improving the accuracy of malicious link detection; by scoring, encoding and classifying the links to be tested that have been visited before, the blacklist library, the whitelist library and the graylist library are continuously optimized, and the detection strategy and access strategy are continuously optimized, thereby continuously improving the detection efficiency and accuracy of malicious links.

[0092] In this way, as the number and frequency of links to be tested increase, the access strategy and detection strategy are continuously optimized, thereby continuously improving the detection efficiency and accuracy of malicious links.

[0093] See also Figure 2 In some embodiments of the present application, identifying the URL of the link to be tested includes the following steps:

[0094] S21, detecting whether the URL of the link to be tested has a corresponding code to obtain a judgment result;

[0095] S22, determining a recognition result according to the judgment result;

[0096] If the judgment result is that the URL of the link to be tested has a corresponding code, the code of the URL of the link to be tested is obtained, and the recognition result is determined according to the code of the URL of the link to be tested;

[0097] If the judgment result is that the URL of the link to be tested has no corresponding code, a temporary code is assigned to the URL of the link to be tested, and the recognition result is determined according to the temporary code of the URL of the link to be tested.

[0098] It is understandable that if the URL of the link to be tested belongs to the blacklist library, whitelist library or graylist library, it means that before obtaining the link to be tested this time, the link to be tested has been tested, and the URL of the link to be tested has also been scored and encoded. In this way, it is possible to determine whether the URL of the link to be tested belongs to the blacklist library, whitelist library or graylist library by detecting whether the URL of the link to be tested has a corresponding code, and then query the blacklist library, whitelist library or graylist library according to the code of the URL of the link to be tested, so as to determine the risk level of adverse effects that will be caused by the response of the link to be tested.

[0099] If the URL of the link to be tested is found to belong to the blacklist library, it can be determined that the risk level of adverse effects caused by the response of the link to be tested is the highest, and access to the link to be tested is blocked.

[0100] If the URL of the link to be tested is found to be in the whitelist library, it can be determined that the risk level of adverse effects caused by the response of the link to be tested is the lowest, and the link to be tested is directly accessed.

[0101] If the URL of the link to be tested is found to be in the grey list, it can be determined that the link to be tested may cause adverse effects after responding, and the link to be tested is accessed in the sandbox. After accessing the link to be tested, the link to be tested is identified and analyzed in the sandbox, and the potential threats in the code are revealed using obfuscation technology and reverse engineering.

[0102] Before the link to be tested responds, the URL of the link to be tested is statically analyzed. The content pointed to by the link to be tested is scanned by the anti-virus engine to detect whether the link to be tested is associated with known malware or behavior, and whether the content pointed to by the link to be tested carries malicious code. Hash value detection is performed on the link to be tested to identify potential malicious patterns or signatures. The code string in the URL of the link to be tested is detected to obtain function call interpretation, behavior and module call information, and to find possible malicious indications or sensitive information. Query external databases and resources to evaluate the malicious value of the link to be tested. Analyze the structure of the URL of the link to be tested, check the domain name, subdomain name and path in the URL of the link to be tested, identify patterns related to known malware or phishing websites, and identify whether the URL of the link to be tested is related to malware or phishing websites by checking the domain name and IP address, so as to block or allow specific traffic and protect users from threats. By analyzing the domain name and subdomain name structure of the URL of the link to be tested, resources can be more accurately located, and access control policies can be implemented to ensure that users can only access authorized resources.

[0103] After the link to be tested responds, the URL of the link to be tested is dynamically analyzed. Real-time behavior detection is performed on the URL of the link to be tested, analyzing the URL in the HTTP request message that the user is accessing, and monitoring its access and operation to system resources, such as file reading and writing, registry modification, network communication, etc. Detect malicious behavior in the response to the link to be tested, and use technologies such as dynamic scanning engines to determine whether the URL has malicious behavior, such as Trojan horse hanging, malicious code execution, etc., and provide real-time feedback. Analyze the network traffic of the response to the link to be tested, monitor the network traffic related to the URL, analyze its communication content with external servers, and detect whether there is data leakage or malicious data transmission. Identify signs of infection, identify signs of infection of malicious URLs on the host, such as file writing, registry modification, etc., so as to take timely countermeasures. The behavior log of the response to the link to be tested will serve as the basis for subsequent analysis.

[0104] After accessing the link to be tested, the URL of the link to be tested is re-scored according to the analysis results, and then the URL of the link to be tested is reclassified according to the score obtained by the scoring. If the score value is greater than or equal to the first scoring threshold, it indicates that the link to be tested will cause adverse effects after responding, that is, the URL of the link to be tested can be included in the blacklist library, and continued access to this link to be tested is blocked. If the score value is less than the first scoring threshold and greater than or equal to the second scoring threshold, it indicates that there will be hidden dangers of causing adverse effects after the link to be tested responds, that is, the URL of the link to be tested can be included in the graylist library, and the link to be tested can continue to be accessed in the sandbox. If the score value is less than the second scoring threshold, it indicates that the link to be tested will not cause adverse effects after responding, that is, the URL of the link to be tested can be included in the whitelist library, and the link to be tested can continue to be accessed outside the sandbox.

[0105] After re-scoring the URL of the link to be tested, if the URL of the link to be tested is reclassified from the gray list library to the black list library or the white list library, the encoding of the URL of the link to be tested is re-identified using the characters corresponding to the black list library or the characters corresponding to the white list library, so that when the link to be tested is accessed again, the URL of the link to be tested can be identified through the encoding of the URL of the link to be tested, so as to determine whether the URL of the link to be tested belongs to the black list library, the white list library or the gray list library, and then determine the corresponding access strategy according to the list library to which the URL of the link to be tested belongs.

[0106] If the URL of the link to be tested does not belong to the blacklist library, whitelist library or graylist library, it means that before obtaining the URL of the link to be tested, the link to be tested has not been accessed on this device, and the URL of the link to be tested has not been detected, scored or encoded. When it is detected that the URL of the link to be tested has not been encoded, a temporary encoding is given to the URL of the link to be tested, and the query list library is skipped, and the link to be tested is directly accessed in the sandbox.

[0107] After the URL of the link to be tested and the corresponding resources are detected and analyzed in the sandbox, the URL of the link to be tested is scored according to the analysis results. After the URL of the link to be tested is scored according to the analysis results, the URL of the link to be tested is further classified according to the scores obtained by the scoring.

[0108] If the score value is greater than or equal to the first score threshold, the URL of the link to be tested is encoded according to the encoding strategy corresponding to the blacklist library, and the URL of the link to be tested is included in the blacklist library, and further access to the link to be tested is blocked. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the URL of the link to be tested is encoded according to the encoding strategy corresponding to the graylist library, and the URL of the link to be tested is included in the graylist library, and further access to the link to be tested is continued in the sandbox. If the score value is less than the second score threshold, the URL of the link to be tested is encoded according to the encoding strategy corresponding to the whitelist library, and the URL of the link to be tested is included in the whitelist library, and further access to the link to be tested is continued outside the sandbox.

[0109] By assigning a temporary code to the URL of the link to be tested that is visited for the first time, and then identifying the URL of the link to be tested with the temporary code during the process of identifying and analyzing the URL of the link to be tested, it is ensured that the analysis result of the URL of the link to be tested can accurately correspond to the URL of the link to be tested, thereby improving the accuracy and reliability of the detection result.

[0110] By formulating different encoding strategies according to different list libraries, encoding the URL of the link to be tested according to different encoding strategies, and then judging which list library the URL of the link to be tested belongs to according to the encoding of the URL of the link to be tested, without going through a complicated detection process, thereby improving detection efficiency and accuracy.

[0111] In some embodiments of the present application, assigning a temporary URL code to the link to be tested includes the following steps:

[0112] Identify the structure of the URL of the link to be tested;

[0113] Check whether each component structure of the URL of the link to be tested appears for the first time;

[0114] If the component structure does not appear for the first time, the original temporary coding segment is used to encode the component structure that does not appear for the first time;

[0115] If the component structure appears for the first time, the first-appearing component structure is encoded in a further way;

[0116] The codes of each component structure are integrated to obtain a complete temporary code.

[0117] It is understandable that each time the URL of the link to be tested is encoded, the encoding process and the encoding result are written into the encoding log. By querying the encoding log, it is determined whether each component structure of the URL of the link to be tested appears for the first time. By querying the encoding log, the encoding fragments of the component structure that does not appear for the first time are obtained. After obtaining the complete temporary encoding, the correctness of the temporary encoding of the URL of the link to be tested is verified by querying the encoding log.

[0118] It can be understood that the further method means: according to the coding rules, the coding segments are sorted in a progressive manner, and the value of the next coding segment is one step ahead of the value of the previous coding segment. For example, the letters in the alphabet are sorted in a progressive manner, A, B, C, D, etc. are all coding segments in the alphabet, B is the next coding segment of A, if A is the last coding segment selected, then B will be selected as the coding segment in the next coding; when the code is judged to be two digits, the further method can also be used for coding, for example, AB is the next digit of AA, AC is the next digit of AB, and BA is the next digit of AZ.

[0119] See also Figure 3 In some embodiments of the present application, querying a blacklist library, a whitelist library, or a graylist library according to the identification result includes the following steps:

[0120] S31, determining the list library to be queried according to the recognition result;

[0121] S32, querying the list library to obtain the query result;

[0122] The code includes a first code, a second code and a third code;

[0123] The list library includes blacklist library, whitelist library and greylist library;

[0124] The first code is identified by the first character, the second code is identified by the second character, and the third code is identified by the third character;

[0125] If the detected code is the first code, the blacklist database is queried to determine the first result;

[0126] If the encoding is detected to be the second encoding, the whitelist database is queried to determine the second result;

[0127] If the code is detected to be the third code, the gray list database is queried to determine the third result;

[0128] If it is detected that the code is a temporary code, the list library is not queried, and the fourth result is determined.

[0129] It is understandable that after the URL of the link to be tested is identified, the identification result is obtained. The identification result includes the URL of the link to be tested being encoded as the first code, the URL of the link to be tested being encoded as the second code, the URL of the link to be tested being encoded as the third code, and the URL of the link to be tested being unencoded. After obtaining the identification result, the list library to be queried is determined based on the identification result. Corresponding access strategies are determined for different list libraries, and the detection process is made more targeted, thereby simplifying the detection process and improving detection efficiency and accuracy.

[0130] The first code corresponds to the blacklist code and is identified by the first character. That is, if it is detected that the code of the URL of the link to be tested is identified by the first character, the blacklist library is queried, and then the access strategy is determined according to the query result in the blacklist library.

[0131] The second code corresponds to the whitelist code and is identified by the second character. That is, if it is detected that the code of the URL of the link to be tested is identified by the second character, the whitelist library is queried, and then the access policy is determined according to the query result in the whitelist library.

[0132] The third code corresponds to the gray list code and is identified by the third character. That is, if it is detected that the code of the URL of the link to be tested is identified by the third character, the gray list library is queried, and then the access strategy is determined according to the query result in the gray list library.

[0133] If the URL of the link to be tested has no encoding, a temporary encoding is assigned to the URL of the link to be tested, and the temporary encoding is marked with the fourth character. If it is detected that the encoding of the URL of the link to be tested is marked with the fourth character, the fourth strategy is directly used to access the link to be tested by querying the list library.

[0134] The URLs of the links to be tested in different list libraries are respectively identified by different character types. Then, in the process of identifying the URLs of the links to be tested, the list library to which the URLs of the links to be tested belong can be determined by identifying the encoded character types, thereby improving the detection efficiency and accuracy.

[0135] If it is detected that the encoding uses the first character identifier, it is determined that the URL of the link to be tested belongs to the blacklist library, and the first strategy can be used to access the link to be tested; if it is detected that the encoding uses the second character identifier, it is determined that the URL of the link to be tested belongs to the whitelist library, and the second strategy can be used to access the link to be tested; if it is detected that the encoding uses the third character identifier, it is determined that the URL of the link to be tested belongs to the graylist library, and the third strategy can be used to access the link to be tested; if it is detected that the encoding uses the fourth character identifier, it is determined that the link to be tested is accessed for the first time on this device, and the fourth strategy can be used to access the link to be tested.

[0136] In some embodiments of the present application, the first character includes an uppercase alphabetic character, the second character includes a lowercase alphabetic character, the third character includes a numeric character, and the fourth character includes a symbol character.

[0137] In the process of identifying the URL of the link to be tested, if it is detected that the encoding is identified by uppercase characters, it is determined that the URL of the link to be tested belongs to the blacklist library, and the first strategy can be used to access the link to be tested; if it is detected that the encoding is identified by lowercase characters, it is determined that the URL of the link to be tested belongs to the whitelist library, and the second strategy can be used to access the link to be tested; if it is detected that the encoding is identified by numeric characters, it is determined that the URL of the link to be tested belongs to the graylist library, and the third strategy can be used to access the link to be tested; if it is detected that the encoding is identified by symbol characters, it is determined that the link to be tested is accessed for the first time on this device. The URLs of the links to be tested in different list libraries are identified by different character types, and then in the process of identifying the URL of the link to be tested, the list library to which the URL of the link to be tested belongs can be determined by identifying the character type of the encoding, thereby improving the detection efficiency and accuracy.

[0138] In some embodiments of the present application, detecting whether the URL of the link to be tested has a corresponding code includes the following steps:

[0139] Analyze the structure of the URL of the link to be tested;

[0140] A query encoding library is formed according to the structure of the URL of the link to be tested to obtain the encoding query result;

[0141] The judgment result is determined based on the coding query result.

[0142] It is understandable that the structure of the URL of the link to be tested includes: protocol, host name, port number, path, query parameter and fragment identifier. Each component structure of the URL of the link to be tested corresponds to a unique code, and the codes corresponding to each component structure together constitute the code of the URL of the link to be tested.

[0143] The complete code of the URL to be tested and the codes corresponding to each component structure of the URL to be tested are recorded in the code library, and each component structure corresponds to a corresponding code.

[0144] In the process of querying the encoding library, the encoding of each component of the URL of the link to be tested is queried separately, so as to obtain the complete encoding of the URL of the link to be tested, thereby improving the query efficiency and accuracy.

[0145] If one or some components of the URL of the link to be tested appear for the first time, it can be determined that the link to be tested is accessed on this device for the first time, and then it is determined to adopt the fourth strategy to access the link to be tested. When encoding the URL of the link to be tested, the encoding strategy is determined according to the score value, and the structure that appears for the first time in the URL of the link to be tested is encoded according to the encoding strategy. Other parts that do not appear for the first time use the existing corresponding codes. In this way, the encoding efficiency and the detection efficiency are improved.

[0146] After obtaining the complete encoding of the URL of the link to be tested, the encoding of the URL of the link to be tested is recorded in the encoding library to determine whether the link to be tested is accessed for the first time on this device. If the encoding of the URL of the link to be tested is not recorded in the encoding library, it indicates that the link to be tested is accessed for the first time on this device, that is, the fourth strategy is adopted to access the link to be tested. If the encoding of the URL of the link to be tested is recorded in the encoding library, the score value corresponding to the URL of the link to be tested is queried according to the encoding of the URL of the link to be tested, and then the list library to be queried is determined according to the score value corresponding to the URL of the link to be tested.

[0147] After accessing the link to be tested, the URL of the link to be tested is scored to obtain a score value. If the score value is greater than or equal to the first score threshold, the blacklist library is queried. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the graylist library is queried. If the score value is less than the second score threshold, the whitelist library is queried.

[0148] In some embodiments of the present application, a list of URLs of the link to be tested and an access log of the link to be tested are recorded in the list library. The access log of the link to be tested records the current encoding of the URL of the link to be tested, the encoding translation record of the URL of the link to be tested, the scoring record of the URL of the link to be tested, and the current scoring value of the URL of the link to be tested. The list library includes a blacklist library, a graylist library, and a whitelist library. The query result includes which list library the URL of the link to be tested belongs to and the access log content of the link to be tested. After the URL of the link to be tested is reclassified to the corresponding list library according to the scoring value of the URL of the link to be tested, the access log of the link to be tested is moved to the corresponding list library together.

[0149] In some embodiments of the present application, forming a query code library according to the structure of the URL of the link to be tested includes the following steps:

[0150] Determine the number of objects corresponding to each component structure of the URL of the link to be tested in the encoding library;

[0151] Query the codes of the URL components of the link to be tested in order from most to least according to the number of objects corresponding to the URL components of the link to be tested;

[0152] Get the full encoding of the URL of the link to be tested.

[0153] The codes corresponding to the various component structures of the URL of the link to be tested are recorded in the code library, that is, each component structure corresponds to a corresponding code.

[0154] The number of objects corresponding to each component structure of the URL of the link to be tested is recorded in the code library. When querying the code library, the codes of each component structure of the URL of the link to be tested are queried in order from most to least according to the number of objects corresponding to each component structure of the URL of the link to be tested, thereby improving the query efficiency.

[0155] If the component structure of the URL of the link to be tested does not appear for the first time, the original temporary coding segment is selected to encode the component structure that does not appear for the first time. If one or some component structures of the URL of the link to be tested appear for the first time, it can be determined that the link to be tested is accessed for the first time on this device, and then a further method is adopted to assign the first-appearing part with a temporary coding segment to make the encoding of the URL of the link to be tested complete. In the subsequent steps, when it is found that the encoding of the URL of the link to be tested contains a temporary coding segment, it can be determined that the link to be tested is accessed for the first time on this device.

[0156] After obtaining the complete encoding of the URL of the link to be tested, the encoding of the URL of the link to be tested is recorded in the encoding library to determine whether the link to be tested is accessed for the first time on this device. If the encoding of the URL of the link to be tested is not recorded in the encoding library, it indicates that the link to be tested is accessed for the first time on this device, that is, the fourth strategy is adopted to access the link to be tested. If the encoding of the URL of the link to be tested is recorded in the encoding library, the score value corresponding to the URL of the link to be tested is queried according to the encoding of the URL of the link to be tested, and then the list library to be queried is determined according to the score value corresponding to the URL of the link to be tested.

[0157] In some embodiments of the present application, the blacklist library, the whitelist library, the graylist library, and the encoding library are trained through a cloud database and / or an external database.

[0158] Training the blacklist library, whitelist library, greylist library and encoding library through the cloud database and / or external database includes the following steps:

[0159] Query cloud databases and / or external databases to obtain database query results;

[0160] Scan the blacklist library, whitelist library, and graylist library according to the database query result to determine whether the blacklist library, whitelist library, and graylist library match the cloud database and / or the external database, and obtain the matching judgment result;

[0161] Determine the blacklist URL, whitelist URL, and graylist URL based on the matching judgment result;

[0162] Encode the blacklist URL, whitelist URL, and graylist URL separately, and add a unified universal temporary code at the beginning of each code to obtain the temporary list code;

[0163] Add blacklist URLs to the blacklist library, whitelist URLs to the whitelist library, graylist URLs to the graylist library, and temporary list codes to the code library;

[0164] Among them, the temporary list code includes a temporary blacklist code, a temporary whitelist code, and a temporary graylist code.

[0165] The matching judgment results include: the URL in the blacklist of the cloud database and / or the external database belongs to the blacklist library, the URL in the whitelist of the cloud database and / or the external database belongs to the whitelist library, the URL in the graylist of the cloud database and / or the external database belongs to the graylist library, the URL in the cloud database and / or the external database does not belong to any of the blacklist library, the whitelist library, and the graylist library, and the URL in the cloud database and / or the external database belongs to one of the blacklist library, the whitelist library, and the graylist library, but the classification result of the cloud database and / or the external database for the URL is different from the classification result of the URL in the list library of this device.

[0166] If the URL in the blacklist of the cloud database and / or external database belongs to the blacklist library, then the URL is skipped;

[0167] If the URL in the whitelist of the cloud database and / or external database belongs to the whitelist library, then the URL is skipped;

[0168] If the URL in the greylist of the cloud database and / or external database belongs to the greylist library, then the URL is skipped;

[0169] If the URL in the cloud database and / or the external database does not belong to any of the blacklist library, the whitelist library, and the graylist library: if the URL belongs to the blacklist in the cloud database and / or the external database, the URL is determined to be a blacklist URL, and the blacklist URL is encoded as a temporary blacklist code; if the URL belongs to the whitelist in the cloud database and / or the external database, the URL is determined to be a whitelist URL, and the whitelist URL is encoded as a temporary whitelist code; if the URL belongs to the graylist in the cloud database and / or the external database, the URL is determined to be a graylist URL, and the graylist URL is encoded as a temporary graylist code;

[0170] If the URL in the cloud database and / or the external database belongs to one of the blacklist library, whitelist library, and graylist library, but the classification result of the URL by the cloud database and / or the external database is different from the classification result of the URL by the list library in this device, then the URL is determined to be a graylist URL, and the graylist URL is encoded as a temporary graylist code.

[0171] In some embodiments of the present application, in the process of detecting malicious links, the URL of the link to be tested is first obtained, and then the URL of the link to be tested is identified, and then the encoding library is queried based on the identification result to obtain the encoding of the URL of the link to be tested, and then the encoding of the URL of the link to be tested is analyzed, and then the list library to be queried is determined based on the analysis result, and then the blacklist library, whitelist library or graylist library is queried to obtain the query result, and then the access policy is determined based on the query result.

[0172] In the process of identifying the URL of the link to be tested, the protocol, host name, port number, path, query parameter and fragment identifier of the URL of the link to be tested are analyzed.

[0173] Then, the protocol, host name, port number, path, query parameters and fragment identifier of the URL of the link to be tested are comprehensively queried in the encoding library to obtain the encoding corresponding to the protocol, host name, port number, path, query parameters and fragment identifier of the URL of the link to be tested, and the encoding corresponding to the protocol, host name, port number, path, query parameters and fragment identifier of the URL of the link to be tested are integrated to obtain the complete encoding of the URL of the link to be tested.

[0174] The encoding type of the URL of the link to be tested is determined according to the complete encoding of the URL of the link to be tested. The encoding types of the URL of the link to be tested include: temporary encoding, temporary blacklist encoding, temporary whitelist encoding, and temporary graylist encoding.

[0175] If the encoding type of the URL of the link to be tested is temporary encoding, it indicates that the link to be tested is not accessed for the first time on this device, that is, the score value of the URL of the link to be tested is queried, and the list library to be queried is determined according to the score value of the URL of the link to be tested. If the score value is greater than or equal to the first score threshold, the blacklist library is queried. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the graylist library is queried; if the score value is less than the second score threshold, the whitelist library is queried.

[0176] If the encoding type of the URL of the link to be tested is one of the temporary blacklist encoding, the temporary whitelist encoding, and the temporary graylist encoding, it indicates that the link to be tested is accessed for the first time on the device, that is, the fourth strategy is adopted to access the link to be tested.

[0177] In the process of accessing the link to be tested by adopting the fourth strategy, if the URL of the link to be tested is encoded as a temporary blacklist code, the content pointed to by the link to be tested is monitored in detail. If malicious behavior is detected, the access to the link to be tested is terminated, and the score value of the URL of the link to be tested is made greater than the first score threshold, and the URL of the link to be tested is included in the blacklist library; if no malicious behavior is detected, the score value of the URL of the link to be tested is made less than the first score threshold and greater than the second score threshold, and the URL of the link to be tested is included in the graylist library. If the URL of the link to be tested is encoded as a temporary graylist code or a whitelist code, it is detected whether there is malicious behavior after the link to be tested responds, and the URL of the link to be tested is scored according to the response result, so that the URL of the link to be tested is classified into the list library according to the score value after scoring, and if the score value is greater than or equal to the first score threshold, the URL of the link to be tested is included in the blacklist library. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the URL of the link to be tested is included in the graylist library, and if the score value is less than the second score threshold, the URL of the link to be tested is included in the whitelist library.

[0178] In some embodiments of the present application, encoding the blacklist URL, the whitelist library URL, and the graylist library URL respectively includes the following steps:

[0179] The fourth character is used to encode the URL of the link to be tested to obtain a temporary code;

[0180] Determine whether the URL of the link to be tested belongs to the blacklist URL, whitelist library URL, or graylist library URL;

[0181] Add the unified universal temporary code at the beginning of the temporary code to obtain the temporary list code;

[0182] Among them, the unified general temporary code includes the unified general temporary blacklist code, the unified general temporary graylist code, and the unified general temporary whitelist code;

[0183] If the link to be tested belongs to the blacklist URL, then add a unified universal temporary blacklist code to the beginning of the temporary code of the URL of the link to be tested;

[0184] If the link to be tested belongs to the grey list URL, then add a unified universal temporary grey list code to the beginning of the temporary code of the URL of the link to be tested;

[0185] If the link to be tested belongs to the whitelist URL, a unified universal temporary whitelist code is added to the beginning of the temporary code of the URL of the link to be tested.

[0186] By setting a unified universal temporary code, blacklist URLs, whitelist URLs, and graylist URLs can be distinguished, thereby improving recognition efficiency.

[0187] By training the blacklist library, whitelist library, graylist library and encoding library, the detection mechanism is continuously optimized, thereby continuously improving the detection efficiency and accuracy.

[0188] In some embodiments of the present application, in the process of accessing the link to be tested using the fourth strategy, if it is detected that the URL encoding of the link to be tested is a temporary list encoding, encoding the URL of the link to be tested includes the following steps:

[0189] Deleting the unified general temporary code at the beginning of the temporary list code of the URL of the link to be tested, so that the format of the temporary code of the URL of the link to be tested is the same as the coding format of the URL of the link to be tested;

[0190] Get the score value of the URL of the link to be tested;

[0191] The temporary encoding of the URL of the link to be tested is translated according to the score value of the URL of the link to be tested to obtain the encoding of the URL of the link to be tested.

[0192] It is understandable that the temporary code of the URL of the link to be tested is encoded according to the encoding strategy of the encoding of the URL of the link to be tested, so the format of the temporary code of the URL of the link to be tested is the same as the format of the encoding of the URL of the link to be tested. However, if a unified universal temporary code is added to the head of the temporary code of the URL of the link to be tested, it will cause the temporary list code of the URL of the link to be tested to have one more string of unified universal temporary codes than the code of the URL of the link to be tested. After deleting the unified universal temporary code at the head of the temporary list code of the URL of the link to be tested, a temporary code with the same encoding format as the URL of the link to be tested can be obtained, so that in the translation process, the code of the URL of the link to be tested can be obtained by directly performing comparative translation, simplifying the translation process, and making the obtained code of the URL of the link to be tested more accurate.

[0193] After obtaining the score value of the URL of the link to be tested, the temporary code of the URL of the link to be tested is translated according to the score value of the URL of the link to be tested. If the score value is greater than or equal to the first score threshold, the temporary code of the URL of the link to be tested is translated into the first code. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the temporary code of the URL of the link to be tested is translated into the third code, and if the score value is less than the second score threshold, the temporary code of the URL of the link to be tested is translated into the second code.

[0194] The first code corresponds to the blacklist code and is identified by the first character. The second code corresponds to the graylist code and is identified by the second character. The third code corresponds to the whitelist code and is identified by the third character. The temporary code is identified by the fourth character.

[0195] In some embodiments of the present application, translating the temporary code of the URL of the link to be tested into the code of the URL of the link to be tested includes the following steps:

[0196] Get the score value of the URL of the link to be tested;

[0197] Compare the score value of the URL of the link to be tested with the first score threshold and the second score threshold to obtain a comparison result;

[0198] Query the translation character comparison table according to the comparison result;

[0199] The characters in the temporary encoding of the URL of the link to be tested are replaced according to the character comparison table to obtain the encoding of the URL of the link to be tested.

[0200] In some application scenarios of this application, the translation character comparison table is shown in the following table:

[0201]

[0202]

[0203] In some application scenarios of the present application, the URL of the link to be tested is http: / / www.example.com:80 / path / to / my file.html?key=value#section, where http is the protocol, www.example.com is the host, 80 is the port, / path / to / myfile.html is the path, key=value is the query parameter, and section is the segment identifier.

[0204] The temporary encoding of the URL of the link to be tested is (+!) / (+@) / (+#) / (+$) / (+%) / (+^), where (+!) represents the protocol, (+@) represents the host, (+#) represents the port, (+$) represents the path, (+%) represents the query parameter, and (+^) represents the fragment identifier.

[0205] If you want to translate the temporary encoding of the URL of the link to be tested into the blacklist encoding, you can query the translation character comparison table and replace the characters in the temporary encoding of the URL of the link to be tested. Then the encoding of the link to be tested is translated into A / B / C / D / E / F, where A represents the protocol, B represents the host, C represents the port, D represents the path, E represents the query parameter, and F represents the fragment identifier.

[0206] If you want to translate the temporary encoding of the URL of the link to be tested into the graylist encoding, you can query the translation character comparison table and replace the characters in the temporary encoding of the URL of the link to be tested. Then the encoding of the link to be tested is translated into a / b / c / d / e / f, where a represents the protocol, b represents the host, c represents the port, d represents the path, e represents the query parameter, and f represents the fragment identifier.

[0207] If you want to translate the temporary encoding of the URL of the link to be tested into the whitelist encoding, you can query the translation character comparison table and replace the characters in the temporary encoding of the URL of the link to be tested. Then the encoding of the link to be tested is translated into 01 / 02 / 03 / 04 / 05 / 06, where 01 represents the protocol, 02 represents the host, 03 represents the port, 04 represents the path, 05 represents the query parameter, and 06 represents the fragment identifier.

[0208] See also Figure 4 In some embodiments of the present application, the fourth strategy includes the following steps:

[0209] S41. Access the link to be tested in the sandbox;

[0210] S42, detecting the object pointed to by the link to be tested and the behavior implemented after the response, to obtain the detection result;

[0211] S43, scoring the URL of the link to be tested using a preset scoring strategy according to the detection result to obtain a scoring value;

[0212] S44, encoding the URL of the link to be tested according to the preset encoding strategy reference score value.

[0213] It is understandable that after accessing the link to be tested in the sandbox, the object pointed to by the link to be tested and the behavior implemented after the response are detected. The content pointed to by the link to be tested is scanned by the anti-virus engine to detect whether the link to be tested is associated with known malware or behavior, and whether the content pointed to by the link to be tested carries malicious code. The link to be tested is detected by hash value to identify potential malicious patterns or signatures. The code string in the URL of the link to be tested is detected to obtain function call interpretation, behavior and module call information, and to find possible malicious indications or sensitive information. Query external databases and resources to evaluate the malicious value of the link to be tested. Analyze the structure of the URL of the link to be tested, check the domain name, subdomain name and path in the URL of the link to be tested, identify patterns related to known malware or phishing websites, and identify whether the URL of the link to be tested is related to malware or phishing websites by checking the domain name and IP address, thereby blocking or allowing specific traffic to protect users from threats. By analyzing the domain name and subdomain name structure of the URL of the link to be tested to locate resources more accurately, and implementing access control policies, ensure that users can only access authorized resources. Perform real-time behavior detection on the URL of the link to be tested, analyze the URL in the HTTP request message that the user is accessing, and monitor its access and operation to system resources, such as file reading and writing, registry modification, network communication, etc. Detect malicious behavior in the response to the link to be tested, and use technologies such as dynamic scanning engines to determine whether the URL has malicious behavior, such as Trojan horse, malicious code execution, etc., and provide real-time feedback. Analyze the network traffic in response to the link to be tested, monitor the network traffic related to the URL, analyze its communication content with external servers, and detect whether there is data leakage or malicious data transmission. Identify signs of infection, identify signs of infection of malicious URLs on the host, such as file writing, registry modification, etc., so as to take timely countermeasures. The behavior log of the response to the link to be tested will serve as the basis for subsequent analysis.

[0214] After accessing the link to be tested, the URL of the link to be tested is scored according to the analysis results, and then the URL of the link to be tested is encoded according to the score obtained by the scoring. If the scoring value is greater than or equal to the first scoring threshold, it indicates that the link to be tested will cause adverse effects after responding, that is, the encoding of the URL of the link to be tested can be configured as a blacklist encoding, and the URL of the link to be tested can be included in the blacklist library, and continued access to this link to be tested is blocked. If the scoring value is less than the first scoring threshold and greater than or equal to the second scoring threshold, it indicates that there will be hidden dangers that cause adverse effects after the link to be tested responds, that is, the encoding of the URL of the link to be tested can be configured as a graylist encoding, and the URL of the link to be tested can be included in the graylist library, and the link to be tested can continue to be accessed in the sandbox. If the scoring value is less than the second scoring threshold, it indicates that the link to be tested will not cause adverse effects after responding, that is, the encoding of the URL of the link to be tested can be configured as a whitelist encoding, and the URL of the link to be tested can be included in the whitelist library, and the link to be tested can continue to be accessed outside the sandbox.

[0215] See also Figure 5 In some embodiments of the present application, the preset encoding strategy includes the following steps:

[0216] S51, detecting the encoding structure of the URL of the link to be tested;

[0217] S52, comparing the score value with the first score threshold and the second score threshold to obtain a comparison result;

[0218] S53, determining whether the encoding of the URL of the link to be tested needs to be translated according to the encoding structure and the comparison result, if it is determined that the encoding of the URL of the link to be tested needs to be translated, proceeding to the next step;

[0219] S54, selecting a character library for encoding according to the comparison result to obtain characters for encoding translation;

[0220] S55: Using characters for encoding translation to translate the encoding of the URL of the link to be tested, so as to translate the encoding of the URL of the link to be tested into an encoding that matches the corresponding character library.

[0221] It can be understood that the encoding structure of the URL of the link to be tested includes the encoded character type and the encoded component structure.

[0222] The coded character type can be used to determine whether the link to be tested is accessed for the first time in this device. If the coded character type is any one of the first character, the second character, or the third character, it indicates that the link to be tested is not accessed for the first time in this device; if the coded character type is the fourth character, it indicates that the link to be tested is accessed for the first time in this device.

[0223] By analyzing the composition structure of the code, it can be determined whether the code of the URL of the link to be tested is configured during the training process or configured through a temporary coding strategy in the previous step. If the code of the URL of the link to be tested contains a temporary list code, it indicates that the code of the URL of the link to be tested is configured during the training process; if the code of the URL of the link to be tested does not contain a temporary list code, it indicates that the code of the URL of the link to be tested is configured through a temporary coding strategy in the previous step.

[0224] After accessing the link to be tested, the URL of the link to be tested is scored to obtain a score value. The score value is compared with the first score threshold and the second score threshold. If the score value is greater than or equal to the first score threshold, the encoding of the URL of the link to be tested is translated into a blacklist encoding. If the score value is less than the first score threshold and greater than or equal to the second score threshold, the encoding of the URL of the link to be tested is translated into a graylist encoding. If the score value is less than the second score threshold, the encoding of the URL of the link to be tested is translated into a whitelist encoding.

[0225] See also Figure 6 In some embodiments of the present application, the preset scoring strategy includes the following steps:

[0226] S61, analyzing components of the URL of the link to be tested;

[0227] S62, obtaining malicious values ​​of each component of the URL of the link to be tested;

[0228] S63, scoring each component of the URL of the link to be tested respectively according to the malicious value to obtain a first scoring value group;

[0229] S64, scoring the direction pointed to by the link to be tested and the behavior implemented after the response, to obtain a second scoring value group;

[0230] S65: Comprehensively analyze the first scoring value group and the second scoring value group to obtain scoring values.

[0231] It is understandable that the components of the URL of the link to be tested include the protocol, host name, port number, path, query parameter and fragment identifier. Obtain the maliciousness value of each component of the URL of the link to be tested. The maliciousness value of each component of the URL of the link to be tested can be evaluated by querying local data and / or external data. If some of the components of the URL of the link to be tested have been scored before, the original score can be referred to to simplify the scoring process.

[0232] The score value of the URL of the link to be tested is obtained by comprehensively analyzing the first score value group and the second score value group, thereby improving the reliability and accuracy of the score value.

[0233] In some embodiments of the present application, the URLs of the links to be tested are ranked in the blacklist library, the whitelist library, and the graylist library according to the score values ​​of the URLs of the links to be tested.

[0234] Since the greater the score, the greater the risk of adverse consequences from accessing the link to be tested, the maliciousness of the link to be tested can be displayed in a ranking manner. Different access strategies are selected according to the maliciousness. The greater the maliciousness, the more stringent the detection means are, and the more resources are called for detection, thereby improving the accuracy and reliability of the detection and reducing the risk of adverse consequences. For links to be tested with a lower maliciousness, loose detection means can be selected, and a small amount of resources can be called for detection, so as to improve detection efficiency and reduce resource consumption.

[0235] In some embodiments of the present application, after each test is completed, a test log is generated, and the test logs of each link to be tested are merged respectively, so that each link to be tested corresponds to a unique test log. The content of the test log includes the test time, the number of tests, the test frequency, the previous score values, the number of encoding translations, the original encoding, and the current encoding.

[0236] In the process of scoring the URL of the link to be tested, the detection log can be scanned and identified, thereby obtaining information in the detection log, and scoring the URL of the link to be tested based on the information in the detection log.

[0237] In some embodiments of the present application, identifying the URL of the link to be tested includes the following steps:

[0238] Analyze the composition structure of the URL of the link to be tested to obtain the analysis result;

[0239] According to the analysis results, the encoding library is queried to determine whether a temporary encoding needs to be assigned to the URL of the link to be tested;

[0240] If a temporary code needs to be assigned to the URL of the link to be tested, the temporary code of the URL of the link to be tested is configured according to the temporary code strategy;

[0241] If it is not necessary to assign a temporary code to the URL of the link to be tested, then obtain the code of the URL of the link to be tested;

[0242] The code library is queried again according to the temporary code of the URL of the link to be tested or the code of the URL of the link to be tested to determine whether the link to be tested is accessed for the first time on the local machine;

[0243] If the link to be tested is accessed for the first time on the device, the fourth strategy is used to access the link to be tested;

[0244] If the link to be tested is not accessed for the first time on this device, query the detection log of the link to be tested;

[0245] Query the blacklist database, whitelist database, or graylist database based on the content in the detection log to obtain the query results;

[0246] An access policy is determined according to at least one of the detection log or the query result.

[0247] It can be understood that after analyzing the URL of the link to be tested, the coding library is queried to detect whether the component structure in the URL of the link to be tested appears for the first time. If a component appears for the first time, the complete code cannot be obtained, that is, it is necessary to assign a temporary code to the URL of the link to be tested, and then use a further method to encode the component structure that appears for the first time, while the part that does not appear for the first time uses the original coding fragment. In this way, by assigning a temporary code to the URL of the link to be tested, it can be determined that the link to be tested is accessed for the first time on this device.

[0248] If each component of the URL of the link to be tested does not appear for the first time, it means that the complete URL encoding of the link to be tested can be obtained according to the encoding fragments in the existing encoding library.

[0249] After obtaining the URL encoding of the link to be tested, the encoding library is queried again to detect whether the encoding library contains the URL encoding of the link to be tested. If the encoding library does not contain the URL encoding of the link to be tested, it can be determined that the link to be tested is accessed for the first time on this device.

[0250] If the code library contains the code of the URL of the link to be tested, but the code of the URL of the link to be tested is displayed as a unified general temporary code in the code library, it means that the code of the URL of the link to be tested is a temporary list code, and it can be determined that the link to be tested is accessed for the first time on this device.

[0251] If the link to be tested is accessed for the first time on the device, the fourth strategy is used to access the link to be tested.

[0252] If the code library contains the code of the URL of the link to be tested, and the code of the URL of the link to be tested is not represented by a unified universal temporary code in the code library, it can be determined that the link to be tested is not accessed for the first time on the device.

[0253] If the link to be tested is not accessed for the first time on this device, the detection log of the link to be tested is queried, and then the query result is obtained according to the blacklist library, whitelist library or graylist library of the detection log, and then the access policy is determined according to at least one of the detection log or the query result.

[0254] If the detection log indicates that the URL of the link to be tested was most recently encoded as a blacklist code, the code of the URL of the link to be tested is translated into the blacklist code using the first character, and the blacklist library is queried; if the detection log indicates that the URL of the link to be tested was most recently encoded as a graylist code, the code of the URL of the link to be tested is translated into the graylist code using the third character, and the graylist library is queried; if the detection log indicates that the URL of the link to be tested was most recently encoded as a whitelist code, the code of the URL of the link to be tested is translated into the whitelist code using the second character, and the whitelist library is queried.

[0255] In some embodiments of the present application, whether to re-score the URL of the link to be tested in the blacklist library and / or the whitelist library is determined according to the content in the detection log.

[0256] After determining the encoding of the URL of the link to be tested, query the detection log of the URL of the link to be tested, so as to determine whether to re-score the URL of the link to be tested in the blacklist library or the whitelist library according to the detection time, detection number, detection frequency and other parameters recorded in the detection log.

[0257] According to the detection time, the interval between the last access to the link to be tested and the current access to the link to be tested can be known. If the interval exceeds the interval threshold, it is determined that the URL of the link to be tested in the blacklist library and / or the whitelist library needs to be re-scored, and the third strategy is adopted to access the link to be tested.

[0258] The number of times the link to be tested is accessed on this device can be known based on the number of detections. If the number of accesses is lower than the access number threshold, it is determined that the URL of the link to be tested in the blacklist library and / or whitelist library needs to be re-scored, and the third strategy is used to access the link to be tested.

[0259] The access frequency of the link to be tested on this device can be known according to the detection frequency. If the access frequency is lower than the access frequency threshold, it is determined that the URL of the link to be tested in the blacklist library and / or whitelist library needs to be re-scored, and the third strategy is adopted to access the link to be tested.

[0260] By re-scoring the URLs of the links to be tested in the blacklist library and / or the whitelist library, it is detected whether the scoring values ​​of the URLs of the links to be tested in the blacklist library and / or the whitelist library have changed, thereby preventing direct access to high-risk links or directly blocking access to low-risk links, thereby improving the accuracy and reliability of detection.

[0261] On the other hand, in some embodiments of the present application, the present application also provides a malicious link intelligent detection system, including:

[0262] An identification unit, the identification unit is used to identify the URL of the link to be tested;

[0263] A storage unit, the storage unit is used to store a blacklist library, a whitelist library and a graylist library of URLs of links to be tested;

[0264] A query unit, the query unit is used to query a blacklist library, a whitelist library or a graylist library according to the identification result of the URL of the link to be tested;

[0265] A processing unit, the processing unit is used to determine the access strategy of the link to be tested according to the query result of the query unit;

[0266] A scoring unit, which is used to score the URL of the link to be tested according to a preset scoring strategy;

[0267] The encoding unit is used to encode the URL of the link to be tested according to a preset encoding strategy and a scoring value.

[0268] On the other hand, in some embodiments of the present application, the present application also provides a malicious link intelligent detection device, including:

[0269] A memory, the memory is used to store one or more program instructions;

[0270] The processor is used to run one or more program instructions to execute the steps of the malicious link intelligent detection method.

[0271] On the other hand, in some embodiments of the present application, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer processor, the steps of the malicious link intelligent detection method are implemented.

[0272] In the description of this specification, the description with reference to the terms "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0273] In addition, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A malicious link intelligent detection method, characterized in that: The steps include: Get the link to be tested; Identify the URL of the link to be tested to obtain an identification result; According to the identification result, a blacklist database, a whitelist database or a graylist database is queried to obtain a query result; Determine an access strategy according to the query result; The query results include a first result, a second result, a third result, and a fourth result; The first result is configured as the URL of the link to be tested belongs to the blacklist library, the second result is configured as the URL of the link to be tested belongs to the whitelist library, the third result is configured as the URL of the link to be tested belongs to the graylist library, and the fourth result is configured as the URL of the link to be tested belongs to neither the blacklist library nor the whitelist library nor the graylist library; The access strategy includes a first strategy, a second strategy, a third strategy and a fourth strategy; The first strategy is configured to block access to the link to be tested, the second strategy is configured to directly access the link to be tested, the third strategy is configured to access the link to be tested in a sandbox and score the URL of the link to be tested, and the fourth strategy is configured to access the link to be tested in a sandbox and score the URL of the link to be tested and encode the URL of the link to be tested according to a preset encoding strategy and a score value; If the query result is the first result, executing the first strategy; If the query result is the second result, executing the second strategy; If the query result is the third result, executing the third strategy; If the query result is the fourth result, the fourth strategy is executed.

2. The malicious link intelligent detection method according to claim 1 is characterized in that: Identifying the URL of the link to be tested includes the following steps: Detect whether the URL of the link to be tested has a corresponding code to obtain a judgment result; Determine the recognition result according to the judgment result; Wherein, if the judgment result is that the URL of the link to be tested has the corresponding code, then the code of the URL of the link to be tested is obtained, and the recognition result is determined according to the code of the URL of the link to be tested; If the judgment result is that the URL of the link to be tested has no corresponding code, a temporary code is assigned to the URL of the link to be tested, and the recognition result is determined according to the temporary code of the URL of the link to be tested.

3. The malicious link intelligent detection method according to claim 2 is characterized in that: Querying the blacklist library, whitelist library or greylist library according to the identification result comprises the following steps: Determine the list library to be queried according to the recognition result; Query the list database to obtain query results; Wherein, the code includes a first code, a second code and a third code; The list library includes the blacklist library, the whitelist library and the greylist library; The first code is identified by a first character, the second code is identified by a second character, and the third code is identified by a third character; If it is detected that the code is the first code, query the blacklist database to determine the first result; If it is detected that the code is the second code, query the whitelist library to determine the second result; If it is detected that the code is the third code, query the gray list library to determine the third result; If it is detected that the code is the temporary code, the list library is not queried, and the fourth result is determined.

4. The malicious link intelligent detection method according to claim 3 is characterized in that: The first characters include uppercase alphabetic characters, the second characters include lowercase alphabetic characters, and the third characters include numeric characters.

5. The malicious link intelligent detection method according to claim 1 is characterized in that: The fourth strategy comprises the following steps: Access the link to be tested in the sandbox; Detecting the object pointed to by the link to be tested and the behavior implemented after the response, so as to obtain the detection result; Scoring the URL of the link to be tested using a preset scoring strategy according to the detection result to obtain a scoring value; The URL of the link to be tested is encoded according to a preset encoding strategy and with reference to the scoring value.

6. The malicious link intelligent detection method according to claim 1 is characterized in that: The preset encoding strategy includes the following steps: Detecting the encoding structure of the URL of the link to be tested; Comparing the score value with a first score threshold and a second score threshold to obtain a comparison result; Determine whether the encoding of the URL of the link to be tested needs to be translated according to the encoding structure and the comparison result, and if it is determined that the encoding of the URL of the link to be tested needs to be translated, proceed to the next step; Selecting a character library for encoding according to the comparison result to obtain characters for encoding translation; The encoding of the URL of the link to be tested is translated using characters used for encoding translation, so as to translate the encoding of the URL of the link to be tested into an encoding matching a corresponding character library.

7. The malicious link intelligent detection method according to claim 1 is characterized in that: The preset scoring strategy includes the following steps: Analyze the components of the URL of the link to be tested; Obtaining malicious values ​​of various components of the URL of the link to be tested; Scoring each component of the URL of the link to be tested respectively according to the malicious value to obtain a first scoring value group; Scoring the direction pointed to by the link to be tested after responding and the behavior implemented to obtain a second scoring value group; The first scoring value group and the second scoring value group are comprehensively analyzed to obtain the scoring value.

8. A malicious link intelligent detection system, characterized in that: include: An identification unit, the identification unit is used to identify the URL of the link to be tested; A storage unit, the storage unit is used to store a blacklist library, a whitelist library and a graylist library about the URL of the link to be tested; A query unit, the query unit is used to query a blacklist library, a whitelist library or a graylist library according to the identification result of the URL of the link to be tested; A processing unit, the processing unit is used to determine the access strategy of the link to be tested according to the query result of the query unit; A scoring unit, the scoring unit is used to score the URL of the link to be tested according to a preset scoring strategy; An encoding unit, wherein the encoding unit is used to encode the URL of the link to be tested according to a preset encoding strategy and a scoring value.

9. A malicious link intelligent detection device, characterized in that: include: A memory, the memory being used to store one or more program instructions; A processor, the processor being used to run one or more program instructions to execute the steps of the malicious link intelligent detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer processor, the steps of the malicious link intelligent detection method according to any one of claims 1 to 7 are implemented.

Images