Malicious code detection method and system based on plurality of URLs (Uniform Resource Locator)

Abstract

The invention discloses a malicious code detection method based on a plurality of URLs (Uniform Resource Locator), comprising the following steps of: capturing all network communication data packets within appointed time intervals; sequentially analyzing all the network communication data packets and extracting the URL in each data packet; carrying out formalization treatment on all the extracted URLs; matching the URLs (which are subjected to the formalization treatment) as URLs to be detected with a characteristic database; and if the matching is successful, carrying out matching with a data model base, determining threat types and outputting corresponding detection results. The invention further discloses a malicious code detection device based on the plurality of URLs. According to the malicious code detection method and system disclosed by the invention, the disadvantages and the limitation of current anti-virus software characteristic code matching and URL filtering are solved; and the detectable rate of a malicious Trojan program is greatly improved.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a multi-URL (Uniform Resource Locator, Uniform Resource Locator)-based malicious code detection method and system. Background technique [0002] The rapid development of the Internet in China, as of the end of June 2011, the scale of Chinese Internet users reached 485 million. The Internet underground economic industry chain has also continued to grow and develop, gradually forming a system architecture with a certain scale from the original single-chain structure. Malicious code from the initial infection to destroy the user system to steal personal or corporate user virtual, real property, private information, tamper with information, illegally control the user system, etc., its purpose is to obtain huge profits through illegal means. [0003] In order to protect the interests of the majority of netizens from infringement, anti-virus manufacturers and relevan...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a method and device for detecting malicious codes based on multiple URLs, which solves the deficiencies and limitations of current anti-virus software feature code matching and URL filtering, and greatly improves the detection rate of malicious Trojan horse programs

Images