The application discloses a dark web address detection method, and relates to the technical field of
network security, and comprises the following steps: S100, a normal website top-level
domain name library and a dark web website top-level
domain name library are established; S200, a set of uncamouflaged dark web addresses is collected and is recorded as C0; a set of normal website addresses is collected and is recorded as S0; S300, all top-level domain names in C0 that are in the dark web website top-level
domain name library are replaced by domain names in the normal website top-level domain name library respectively, so that a set of camouflaged dark web addresses C1, C2, C3, … CN is obtained, N is an integer, and is equal to the number of domain names in the normal website top-level domain name library; S400, C0, C1, C2, C3, … CN and S0 are combined to form
training data sets {C0, S0}, {C1, S0}, {C2, S0}, {C3, S0}, … {CN, S0}, etc., the method disclosed by the application is suitable for the characteristics of the dark web, features suitable for dark web URL classification are proposed, and the dark web URL is detected by using dark web feature strings and dark web website URL features.