URL (Uniform Resource Locator) detection method and device, network equipment and storage medium

Abstract

The embodiment of the invention provides a URL (Uniform Resource Locator) detection method and device, network equipment and a storage medium, and relates to the technical field of information security, the method can be applied to a terminal, in particular to a terminal in an FTTR (Fiber To The Rate) scene, and the method comprises the following steps: determining whether a URL to be accessed is matched with a URL in a stored hotspot URL set or not; the hotspot URL set comprises malicious URLs which are periodically acquired from the cloud and have the activeness meeting a preset condition; if yes, determining that the URL to be accessed is a malicious URL; if not, sending the to-be-accessed URL to the cloud, so that the cloud performs malicious detection on the to-be-accessed URL by using a pre-trained URL detection model; receiving a detection result sent by the cloud and obtained by performing malicious detection on the URL to be accessed; and determining whether the URL to be accessed is a malicious URL based on a detection result. Through the embodiment of the invention, the speed of detecting the malicious URL can be taken into account while missing detection of the malicious URL is reduced.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a URL detection method, apparatus, network device, and storage medium. Background Technology

[0002] In FTTR (Fiber to the Room) scenarios, users face the risk of network attacks. URLs (Uniform Resource Locators) are widely used in network attacks. Therefore, terminals in FTTR scenarios need to detect the URLs they are trying to access in order to intercept or alert on malicious URLs.

[0003] Current URL detection relies on whitelists and blacklists in a database. A URL is considered safe if it matches a URL in the whitelist, and malicious if it matches a URL in the blacklist. However, this method struggles to comprehensively cover malicious URLs, easily leading to missed detections. Furthermore, the database requires storing large amounts of URL data, which can slow down the detection process. Summary of the Invention

[0004] The purpose of this invention is to provide a URL detection method, apparatus, network device, and storage medium to solve the problems of malicious URLs being easily missed and slow detection speed. The specific technical solution is as follows:

[0005] This invention first provides a URL detection method applied to a terminal, the method comprising:

[0006] Determine whether the URL to be accessed matches a URL in a stored set of hot URLs; wherein, the set of hot URLs includes malicious URLs whose activity levels meet preset conditions and are periodically obtained from the cloud.

[0007] If a match is found, the URL to be accessed is determined to be a malicious URL;

[0008] If there is no match, the URL to be accessed is sent to the cloud so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed.

[0009] Receive the detection result obtained by performing a malicious detection on the URL to be accessed, sent from the cloud.

[0010] Based on the detection results, it is determined whether the URL to be accessed is a malicious URL.

[0011] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0012] In one embodiment of the present invention, the method further includes:

[0013] If the URL to be accessed matches a URL in the set of hot URLs, the URL to be accessed is sent to the cloud so that the cloud updates the activity level of the URL to be accessed.

[0014] In one embodiment of the present invention, the method further includes:

[0015] If the URL to be accessed matches a URL in the set of hot URLs, the execution operation for the URL to be accessed is determined based on a preset first execution strategy.

[0016] If the URL to be accessed does not match the URLs in the set of hot URLs, the execution operation for the URL to be accessed is determined based on the preset second execution strategy and the detection result.

[0017] Perform the execution operation on the URL to be accessed.

[0018] This invention also provides a URL detection method applied in the cloud, the method comprising:

[0019] After receiving the URL to be detected sent by the terminal, the features of the URL to be detected in a specified dimension are extracted, and the extracted features are input into a pre-trained URL detection model to perform malicious detection on the URL to be detected; the detection result obtained from the malicious detection is sent to the terminal.

[0020] The system periodically identifies malicious URLs whose current activity levels meet preset conditions and sends these malicious URLs to the terminal, thereby enabling the terminal to update its stored set of hot URLs. The set of hot URLs is used by the terminal to perform malicious detection on the URLs.

[0021] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0022] In one embodiment of the present invention, the method further includes:

[0023] If the detection result indicates that the URL to be detected is a malicious URL, the activity level of the URL to be detected is updated.

[0024] And / or,

[0025] Upon receiving malicious URL information sent by the terminal, the activity level of the URL represented by the malicious URL information is updated.

[0026] This invention also provides a URL detection device for use on a terminal, the device comprising:

[0027] The matching module is used to determine whether the URL to be accessed matches a URL in a stored set of hot URLs; wherein, the set of hot URLs includes malicious URLs whose activity levels meet preset conditions and are periodically obtained from the cloud.

[0028] The first determining module is used to determine that the URL to be accessed is a malicious URL if a match is found.

[0029] The URL to be accessed module is used to send the URL to be accessed to the cloud if there is no match, so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed.

[0030] The detection result receiving module is used to receive the detection result obtained by performing malicious detection on the URL to be accessed, which is sent by the cloud.

[0031] The second determining module is used to determine whether the URL to be accessed is a malicious URL based on the detection result.

[0032] This invention also provides a URL detection device applied in the cloud, the device comprising:

[0033] The model detection module is used to extract the features of the URL to be detected in a specified dimension after receiving the URL to be detected sent by the terminal, input the extracted features into a pre-trained URL detection model to perform malicious detection on the URL to be detected, and send the detection result obtained from the malicious detection to the terminal.

[0034] The hotspot URL sending module is used to periodically determine malicious URLs whose current activity meets preset conditions, and send the determined malicious URLs to the terminal so that the terminal updates the stored hotspot URL set; wherein, the hotspot URL set is used by the terminal to perform malicious detection on URLs.

[0035] This invention also provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0036] Memory, used to store computer programs;

[0037] The processor, when executing a program stored in memory, implements any of the URL detection methods described above.

[0038] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the URL detection methods described above.

[0039] This invention also provides a computer program product containing instructions that, when run on a computer, causes the computer to execute any of the URL detection methods described above.

[0040] Beneficial effects of the embodiments of the present invention:

[0041] The URL detection method provided in this invention involves a terminal storing a set of hot URLs. This set includes malicious URLs whose activity levels meet preset conditions and are periodically retrieved from the cloud. If the URL to be accessed matches a URL in the hot URL set, the terminal can determine that the URL is malicious. If they do not match, the terminal can send the URL to be accessed to the cloud, allowing the cloud to use a pre-trained URL detection model to detect it and obtain a detection result. The detection result is then used to determine whether the URL is malicious. Therefore, this solution allows for rapid detection of common malicious URLs by storing only the hot URL set locally, eliminating the need for large amounts of URL data. URLs that do not match the hot URL set are detected by the cloud-based URL detection model, avoiding reliance on a database and reducing missed detections of malicious URLs. Thus, this solution reduces missed detections of malicious URLs while maintaining speed in detecting them.

[0042] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0044] Figure 1 This is a schematic diagram illustrating the principle of a threat protection method against malicious URLs.

[0045] Figure 2 This is a first interactive schematic diagram of the URL detection method provided in the embodiment of the present invention;

[0046] Figure 3 This is a logical schematic diagram of the URL detection method provided in an embodiment of the present invention;

[0047] Figure 4 This is a second interactive schematic diagram of the URL detection method provided in the embodiments of the present invention;

[0048] Figure 5 This is a third interactive schematic diagram of the URL detection method provided in the embodiments of the present invention;

[0049] Figure 6 This is an overall architecture diagram of the URL detection method provided in the embodiments of the present invention;

[0050] Figure 7 This is a flowchart illustrating the URL detection method applied to a terminal provided in an embodiment of the present invention;

[0051] Figure 8 This is a flowchart illustrating the URL detection method applied to the cloud provided in an embodiment of the present invention;

[0052] Figure 9 This is a schematic diagram of the structure of the URL detection device applied to a terminal provided in an embodiment of the present invention;

[0053] Figure 10 This is a schematic diagram of the process of a URL detection device applied to the cloud, as provided in an embodiment of the present invention.

[0054] Figure 11 This is a flowchart illustrating the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of the present invention.

[0056] With the widespread use of internet applications, numerous malicious URLs are employed for phishing, malware distribution, and C2 (command and control) communication attacks. In FTTR (Fiber to the Room) scenarios, users also face the risk of malicious URLs. Threat protection against malicious URLs in related technologies largely relies on signature databases. For example, the principle of one method for protecting against malicious URLs is as follows: Figure 1As shown, the URL filtering module generates corresponding URL filtering rules based on the feature database and configuration information set by technical personnel, and sends them to the application layer detection engine. After identifying the URL in the message, the application layer detection engine matches the URL according to the filtering rules and returns the matching result to the URL filtering module. Finally, the URL filtering module determines the action to be taken on the message based on the matching result, thus processing the message. However, the related technologies have the following problems in detecting malicious URLs:

[0057] Update Delay: Requires periodic downloads of the latest signature database and cannot respond to new and unknown threats in real time. Limited Detection Scope: Has weak ability to identify malicious URLs hidden through obfuscation, encoding, and shortened link redirects. Performance Bottleneck: Faced with billions of URLs in the signature database, database queries place high demands on storage and I / O (input / output) performance, easily leading to slow detection speeds and high latency for users.

[0058] To address the aforementioned issues, embodiments of the present invention provide a URL detection method, apparatus, network device, and storage medium. Specifically, embodiments of the present invention provide URL detection methods applicable to both terminals and the cloud. Terminals can be network devices directly accessed and used by users, such as user-side network devices in FTTR scenarios, including computers, smartphones, and firewall devices (such as NGFWs). Of course, the present invention is not limited to FTTR application scenarios. For example, it can also be used in various scenarios such as enterprise campus networks, data centers, and carrier access networks.

[0059] In one specific implementation, the terminal can also be a security program running on a user-side network device, such as EDR (Endpoint Detection and Response). The cloud, on the other hand, can be a network device connected to the terminal via the internet, used to provide computing services to the terminal remotely.

[0060] For ease of understanding, the interaction process between the terminal and the cloud in implementing the message retransmission method provided in this embodiment of the invention will be described below.

[0061] like Figure 2 As shown, the interaction process between the terminal and the cloud includes the following steps:

[0062] S201: The cloud periodically identifies malicious URLs whose current activity levels meet preset conditions and sends the identified malicious URLs to the terminal.

[0063] The cloud can collect detected malicious URLs from connected terminals or obtain recently active malicious URLs from third-party intelligence platforms.

[0064] The activity level of a malicious URL can be positively correlated with the number of times the URL was accessed within a first specified time period, and / or the increase in the number of times the URL was accessed between two adjacent second specified time periods. For example, the first specified time period could be from one month ago to the present moment; the two adjacent second specified time periods could be from two days ago to one day ago, and from one day ago to the present moment. The increase in the number of times the URL was accessed between two adjacent second specified time periods is the difference between the number of times the URL was accessed in the latter second specified time period and the number of times it was accessed in the former second specified time period.

[0065] In one implementation, the activity level of a malicious URL can be calculated using the following formula:

[0066] Score = α × Number of Visits + β × Growth Rate. Here, Score represents activity level, α and β are weighting parameters, and α + β = 1; the number of visits specifically refers to the number of times the URL was accessed within a first specified time period, and the growth rate specifically refers to the increase in the number of visits to the URL between two adjacent second specified time periods. Calculating the activity level of malicious URLs in this way can identify commonly used malicious URLs in recent times. By storing malicious URLs whose activity levels meet preset conditions on the terminal, currently common malicious URLs can be quickly detected.

[0067] Malicious URLs that meet preset activity criteria can be malicious URLs with an activity level greater than a preset threshold, or a specified number of malicious URLs with the highest activity level. For example, the specified number could be 1000.

[0068] When the periodic acquisition time is reached, the terminal can send a malicious URL acquisition request to the cloud. Upon receiving the malicious URL acquisition request, the cloud can send a malicious URL with an activity level that meets preset conditions to the terminal.

[0069] S202, The terminal receives a malicious URL sent from the cloud to update the stored set of hot URLs;

[0070] Specifically, the terminal can store the set of hot URLs in ReDiS (Remote Dictionary Server) or Memcached (a distributed high-speed caching system).

[0071] When the terminal is updating, it can combine the currently received malicious URLs into an updated set of hot URLs and delete the historically stored set of hot URLs.

[0072] S203, determine whether the URL to be accessed matches a URL in the stored set of hot URLs;

[0073] The URL to be accessed can be a URL carried in an HTTP (Hypertext Transfer Protocol) request message or an HTTPS (Hypertext Transfer Protocol Secure) request message to be sent by the terminal. Specifically, regular expression matching can be used to determine whether the URL to be accessed matches a URL in the stored set of hot URLs.

[0074] S204, if a match is found, then the URL to be accessed is determined to be a malicious URL.

[0075] Furthermore, if the URL to be accessed matches a URL in the set of hot URLs, the terminal can also determine the execution operation for the URL to be accessed based on a preset first execution strategy; and then execute the execution operation on the URL to be accessed.

[0076] For example, the actions to be performed can include blocking, alerting, and allowing. Blocking means preventing access to the URL, that is, intercepting the message carrying the URL to be accessed; alerting means allowing access to the URL but generating an alert log; allowing means allowing access to the URL, that is, letting the message carrying the URL to be accessed pass through. The first execution strategy can be set based on experience and needs. For example, if the matching degree between the URL to be accessed and URLs in the hot URL set is greater than or equal to a first threshold, then the action to be performed is blocking; if the matching degree is less than the first threshold but greater than a second threshold, then the action to be performed is alerting; if the matching degree is less than or equal to the second threshold, then the action to be performed is allowing.

[0077] S205 If there is no match, send the URL to be accessed to the cloud.

[0078] S206. After receiving the URL to be detected sent by the terminal, the cloud extracts the features of the URL to be detected in the specified dimensions and inputs the extracted features into the pre-trained URL detection model to perform malicious detection on the URL to be detected.

[0079] In one implementation, the features of a specified dimension may include: lexical features, such as URL length, hostname length, path length, number of parameters, special character count (such as @, -, % and other non-alphanumeric characters), whether an IP address is included, top-level domain (TLD) type, etc.; the features of a specified dimension may also include content features, such as subdomains, sensitive words (such as "login", "bank"), TLS SNI information (Transport Layer Security Server Name Indication), etc.

[0080] The URL detection model can be an LSTM (Long-Short Term Memory) model. When training the URL detection model, malicious URLs can be collected as positive samples from the terminal or a third-party intelligence platform, and benign URLs can be collected as negative samples, thus creating a binary classification dataset. The samples in the dataset can be divided into 80% for training, 10% for validation, and 10% for testing. Then, features of the sample URLs used for training in a specified dimension can be extracted. The extracted features are input into the URL detection model to obtain the prediction results output by the URL detection model. Subsequently, the model loss is calculated based on the prediction results and the ground truth labels of the sample URLs to tune the model parameters until convergence, resulting in a successfully trained URL detection model.

[0081] In addition, the cloud can monitor false positives and false negatives, regularly fine-tune the URL detection model with new data, and integrate active learning such as VirusTotal (a suspicious file analysis platform) API (Application Programming Interface), that is, use highly active URLs provided by the VirusTotal platform to fine-tune the URL detection model.

[0082] S207, send the detection results obtained from the malicious detection to the terminal;

[0083] The detection result can indicate whether the URL to be accessed is malicious, or it can be the risk level of the URL. Specifically, the URL detection model can output a confidence score indicating whether the URL to be accessed is malicious. The cloud then determines the score of the URL to be accessed based on this confidence score; the higher the confidence score, the higher the score. Furthermore, based on the correspondence between the score range and the risk level, the risk level of the URL to be accessed can be determined. For example, the correspondence between the score range and the risk level can be shown in Table 1 below.

[0084] Table 1

[0085]

[0086] S208, the terminal receives the detection results from the cloud, which are obtained from the malicious detection of the URL to be accessed, and determines whether the URL to be accessed is a malicious URL based on the detection results.

[0087] If the URL to be accessed does not match a URL in the hot URL set, the cloud can, after receiving the detection results sent by the cloud, determine the execution operation for the URL to be accessed based on a preset second execution strategy and the detection results; and then execute the operation on the URL to be accessed. By processing the URL to be accessed accordingly based on the preset execution strategy and detection results, the terminal can reduce the security risks posed by malicious URLs to the terminal.

[0088] In one implementation, the execution operation may include blocking, alarming, and allowing, and the second execution strategy may include the correspondence between risk level and execution operation, for example, the correspondence may be as shown in Table 2 below.

[0089] Table 2

[0090]

[0091] For example, Figure 3 This is a logical diagram of one embodiment. For a URL to be accessed, the terminal first performs hotspot data matching, that is, determines whether the URL to be accessed matches a URL in a stored set of hotspot URLs. If the URL to be accessed matches a URL in the set of hotspot URLs, a policy action can be determined. This involves determining the action to be taken based on a first execution policy, which may include blocking, alerting, or allowing access. If there is no match, the URL to be accessed is sent to the cloud for malicious detection. The cloud determines the risk level of the URL and sends the detection result back to the terminal. The terminal can then determine a policy action based on a second execution policy and the detection result. This multi-level judgment and processing scheme allows the terminal to combine the advantages of hotspot data and cloud models to perform malicious URL detection, solving the performance bottleneck problem caused by a large number of URL queries.

[0092] In this embodiment, since the terminal only stores a set of hot URLs locally, instead of storing a large amount of URL data, commonly used malicious URLs can be quickly detected. For accessed URLs that do not match those in the hot URL set, the detection is handled by a cloud-based URL detection model. This avoids reliance on a database for URL detection, enabling real-time response to new and unknown threats and reducing missed detections of malicious URLs. Therefore, this solution reduces missed detections of malicious URLs while maintaining speed in detecting them, achieving rapid, localized, and low-bandwidth-dependent detection and interception of URL threats.

[0093] In one embodiment of the present invention, such as Figure 4 As shown, when the URL to be accessed matches a URL in the set of hot URLs, the interaction process between the terminal and the cloud may also include the following steps:

[0094] S401, The terminal sends malicious URL information to the cloud indicating that the URL to be accessed is a malicious URL;

[0095] S402: After receiving malicious URL information sent by the terminal, the cloud updates the activity level of the URL represented by the malicious URL information.

[0096] Since the number of times the URL to be accessed has increased by one, and the terminal has determined that the URL to be accessed is a malicious URL, the terminal sends malicious URL information to the cloud indicating that the URL to be accessed is a malicious URL. The cloud can then update the number of times the URL to be accessed has been accessed, and thus calculate the activity level of the URL to be accessed.

[0097] In one embodiment of the present invention, such as Figure 5 As shown, if the URL to be accessed does not match the URLs in the hot URL set, after step S206 above, the cloud can also execute step S501 to update the activity level of the URL to be accessed if the detection result indicates that the URL to be accessed is a malicious URL.

[0098] In this embodiment, when the detection result indicates that the URL to be detected is a malicious URL, the activity level of the URL to be detected is updated; and / or, after receiving malicious URL information sent by the terminal, the activity level of the URL represented by the malicious URL information is updated, so that the cloud can continuously update the activity level of malicious URLs and ensure that the terminal can obtain the latest hot URL data.

[0099] To facilitate understanding, the following will be combined with... Figure 6 The embodiments of the present invention will be described by way of example. The overall architecture of the embodiments of the present invention can be as follows: Figure 6As shown: The cloud-based system includes a cloud query service, a URL detection model, a malicious URL data lake, and hotspot data (i.e., a set of hotspot URLs). The cloud can collect malicious URL data from terminals such as NGFW and EDR. Specifically, when NGFW and EDR detect a malicious URL, they can send information such as the malicious URL's domain name, path, query parameters, TLS SNI, etc., to the malicious URL data lake in the cloud. The cloud can also periodically obtain the latest malicious URLs from third-party intelligence platforms and store them in the malicious URL data lake. Furthermore, the cloud can train the URL detection model based on the malicious URLs in the malicious URL data lake and periodically send malicious URLs whose activity levels meet preset conditions to the terminals, enabling the terminals to update their local hotspot data regularly.

[0100] The terminal can use the stored hotspot data to perform malicious detection on URLs, or use the cloud query service to perform unknown URL queries. That is, it sends URLs to be accessed that do not match the URLs in the stored hotspot URL set to the cloud, so that the cloud can use the URL detection model to perform malicious detection on the URLs to be accessed.

[0101] As can be seen, this embodiment combines the advantages of hot data and cloud models to perform malicious URL detection, solving the performance bottleneck caused by a large number of URL queries and achieving low-latency, high-precision real-time detection.

[0102] This invention also provides a URL detection method, applied to a terminal, such as... Figure 7 As shown, the method includes:

[0103] S701, determine whether the URL to be accessed matches a URL in the stored hot URL set; wherein, the hot URL set includes malicious URLs whose activity meets preset conditions and are periodically obtained from the cloud.

[0104] S702, if a match is found, the URL to be accessed is determined to be a malicious URL;

[0105] S703 If there is no match, send the URL to be accessed to the cloud so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed.

[0106] S704 receives the detection results from the cloud, which are obtained from the malicious detection of the URL to be accessed.

[0107] S705 determines whether the URL to be accessed is a malicious URL based on the detection results.

[0108] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0109] In one embodiment of the present invention, the method further includes:

[0110] If the URL to be accessed matches a URL in the set of hot URLs, the URL to be accessed is sent to the cloud so that the cloud updates the activity level of the URL to be accessed.

[0111] In one embodiment of the present invention, the method further includes:

[0112] If the URL to be accessed matches a URL in the set of hot URLs, the execution operation for the URL to be accessed is determined based on a preset first execution strategy.

[0113] If the URL to be accessed does not match the URLs in the set of hot URLs, the execution operation for the URL to be accessed is determined based on the preset second execution strategy and the detection result.

[0114] Perform the execution operation on the URL to be accessed.

[0115] This invention also provides a URL detection method, applied in the cloud, such as... Figure 8 As shown, the method includes:

[0116] S801: After receiving the URL to be detected sent by the terminal, extract the features of the URL to be detected in the specified dimension, input the extracted features into the pre-trained URL detection model to perform malicious detection on the URL to be detected, and send the detection result obtained from the malicious detection to the terminal.

[0117] S802, periodically determine malicious URLs whose current activity meets preset conditions, and send the determined malicious URLs to the terminal so that the terminal updates the stored set of hot URLs; wherein, the set of hot URLs is used by the terminal to perform malicious detection on URLs.

[0118] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0119] In one embodiment of the present invention, the method further includes:

[0120] If the detection result indicates that the URL to be detected is a malicious URL, the activity level of the URL to be detected is updated.

[0121] And / or,

[0122] Upon receiving malicious URL information sent by the terminal, the activity level of the URL represented by the malicious URL information is updated.

[0123] Based on the same inventive concept, embodiments of the present invention also provide a URL detection device, applied to a terminal, such as... Figure 9 As shown, the device includes:

[0124] The matching module 901 is used to determine whether the URL to be accessed matches a URL in a stored set of hot URLs; wherein, the set of hot URLs includes malicious URLs whose activity levels meet preset conditions and are periodically obtained from the cloud.

[0125] The first determining module 902 is used to determine that the URL to be accessed is a malicious URL if a match is found.

[0126] The URL to be accessed sending module 903 is used to send the URL to be accessed to the cloud if there is no match, so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed;

[0127] The detection result receiving module 904 is used to receive the detection result obtained by performing malicious detection on the URL to be accessed, which is sent by the cloud.

[0128] The second determining module 905 is used to determine whether the URL to be accessed is a malicious URL based on the detection result.

[0129] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0130] In one embodiment of the present invention, the device further includes:

[0131] The notification module is used to send the URL to be accessed to the cloud when the URL to be accessed matches a URL in the set of hot URLs, so that the cloud updates the activity level of the URL to be accessed.

[0132] In one embodiment of the present invention, the device further includes:

[0133] The strategy module is used to determine the execution operation for the URL to be accessed based on a preset first execution strategy when the URL to be accessed matches a URL in the set of hot URLs; and to determine the execution operation for the URL to be accessed based on a preset second execution strategy and the detection result when the URL to be accessed does not match a URL in the set of hot URLs.

[0134] An execution module is used to perform the execution operation on the URL to be accessed.

[0135] This invention also provides a URL detection device for use in the cloud, such as... Figure 10 As shown, the device includes:

[0136] The model detection module 1001 is used to extract the features of the URL to be detected in a specified dimension after receiving the URL to be detected sent by the terminal, input the extracted features into a pre-trained URL detection model to perform malicious detection on the URL to be detected, and send the detection result obtained from the malicious detection to the terminal.

[0137] The hotspot URL sending module 1002 is used to periodically determine malicious URLs whose current activity meets preset conditions, and send the determined malicious URLs to the terminal so that the terminal updates the stored hotspot URL set; wherein, the hotspot URL set is used by the terminal to perform malicious detection on URLs.

[0138] In one embodiment of the present invention, the activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed in two adjacent second specified time periods.

[0139] In one embodiment of the present invention, the device further includes:

[0140] An update module is configured to update the activity level of the URL to be detected when the detection result indicates that the URL to be detected is a malicious URL; and / or, after receiving malicious URL information sent by the terminal, update the activity level of the URL represented by the malicious URL information.

[0141] This invention also provides a network device, such as... Figure 11 As shown, it includes a processor 1101, a communication interface 1102, a memory 1103, and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other through the communication bus 1104.

[0142] Memory 1103 is used to store computer programs;

[0143] The processor 1101, when executing the program stored in the memory 1103, implements any of the URL detection methods described above.

[0144] The communication bus mentioned in the above network devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0145] The communication interface is used for communication between the aforementioned network devices and other devices.

[0146] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0147] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0148] In another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of any of the above-described URL detection methods.

[0149] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the URL detection methods described above.

[0150] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0151] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0152] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, electronic devices, storage media, and computer program products are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0153] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for detecting a URL, characterized by, Applied to a terminal, the method includes: Determine whether the URL to be accessed matches a URL in a stored set of hot URLs; wherein, the set of hot URLs includes malicious URLs whose activity levels meet preset conditions and are periodically obtained from the cloud. If a match is found, the URL to be accessed is determined to be a malicious URL; If there is no match, the URL to be accessed is sent to the cloud so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed. Receive the detection result obtained by performing a malicious detection on the URL to be accessed, sent from the cloud. Based on the detection results, it is determined whether the URL to be accessed is a malicious URL.

2. The method of claim 1, wherein, The activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed between two adjacent second specified time periods.

3. The method according to claim 1 or 2, characterized in that, The method further includes: If the URL to be accessed matches a URL in the set of hot URLs, the URL to be accessed is sent to the cloud so that the cloud updates the activity level of the URL to be accessed.

4. The method according to claim 1, characterized in that, The method further includes: If the URL to be accessed matches a URL in the set of hot URLs, the execution operation for the URL to be accessed is determined based on a preset first execution strategy. If the URL to be accessed does not match the URLs in the set of hot URLs, the execution operation for the URL to be accessed is determined based on the preset second execution strategy and the detection result. Perform the execution operation on the URL to be accessed.

5. A URL detection method, characterized in that, Applied to the cloud, the method includes: After receiving the URL to be detected sent by the terminal, the features of the URL to be detected in a specified dimension are extracted, and the extracted features are input into a pre-trained URL detection model to perform malicious detection on the URL to be detected; the detection result obtained from the malicious detection is sent to the terminal. The system periodically identifies malicious URLs whose current activity levels meet preset conditions and sends these malicious URLs to the terminal, thereby enabling the terminal to update its stored set of hot URLs. The set of hot URLs is used by the terminal to perform malicious detection on the URLs.

6. The method according to claim 5, characterized in that, The activity of a malicious URL is positively correlated with the number of times the URL is accessed within a first specified time period, and / or the increase in the number of times the URL is accessed between two adjacent second specified time periods.

7. The method according to claim 5 or 6, characterized in that, The method further includes: If the detection result indicates that the URL to be detected is a malicious URL, the activity level of the URL to be detected is updated. And / or, Upon receiving malicious URL information sent by the terminal, the activity level of the URL represented by the malicious URL information is updated.

8. A URL detection device, characterized in that, Applied to a terminal, the device includes: The matching module is used to determine whether the URL to be accessed matches a URL in a stored set of hot URLs; wherein, the set of hot URLs includes malicious URLs whose activity levels meet preset conditions and are periodically obtained from the cloud. The first determining module is used to determine that the URL to be accessed is a malicious URL if a match is found. The URL to be accessed module is used to send the URL to be accessed to the cloud if there is no match, so that the cloud can use a pre-trained URL detection model to perform malicious detection on the URL to be accessed. The detection result receiving module is used to receive the detection result obtained by performing malicious detection on the URL to be accessed, which is sent by the cloud. The second determining module is used to determine whether the URL to be accessed is a malicious URL based on the detection result.

9. A URL detection device, characterized in that, The device, applied in the cloud, includes: The model detection module is used to extract the features of the URL to be detected in a specified dimension after receiving the URL to be detected sent by the terminal, input the extracted features into a pre-trained URL detection model to perform malicious detection on the URL to be detected, and send the detection result obtained from the malicious detection to the terminal. The hotspot URL sending module is used to periodically determine malicious URLs whose current activity meets preset conditions, and send the determined malicious URLs to the terminal so that the terminal updates the stored hotspot URL set; wherein, the hotspot URL set is used by the terminal to perform malicious detection on URLs.

10. A network device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images