The invention relates to a malicious website identification method and
system based on
IP address feature analysis, and belongs to the technical field of
network security, and the method comprises the steps: collecting network flow data of an
IP address through a network flow log, a firewall log and a DNS query
record, and carrying out the preprocessing; constructing an IP dynamic graph structure by taking the IP addresses as nodes and the communication relationship between the IP addresses as edges according to the preprocessed network flow data; the IP dynamic graph structure is coded through a graph
attention network, the complex relation between nodes is captured, the
time sequence characteristics of
IP address behaviors are captured in combination with a long and short-
term memory network, and a behavior mode of the nodes is constructed; and calculating a
reconstruction error and a
local outlier factor LOF of the node according to a behavior pattern of the node, calculating an abnormal
score of the IP address, and when the abnormal
score is higher than a dynamic abnormal
detection threshold, performing deep analysis by combining
domain name characteristics, webpage content characteristics and network access behavior characteristics of the website, and identifying the malicious website.