Method and device for identifying a malicious website

Abstract

The present invention discloses a method and device for identifying a malicious website, relates to the technical field of internet, and can efficiently identify the malicious website. The method of the present invention includes: first capturing user feature information input in a log-in page, then searching for a set of trusted domain names corresponding to the user feature information in a white list, finally comparing the domain name of the log-in page with all trusted domain names in the set of trusted domain names, and if the domain name of the log-in page does not belong to the set of trusted domain names, prompting the user with a warning. The present invention is mainly used in the procedure of identifying a phishing website.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method and device for identifying malicious websites. Background technique [0002] The rapid development of Internet technology has brought more and more convenience to people's lives. People can easily share and download various resources and obtain various important information through the Internet. At the same time, the security situation of the Internet is not optimistic. A large number of phishing websites have seriously violated the interests of Internet users and affected the security order of the Internet. [0003] Phishing websites usually refer to malicious websites that pretend to be regular websites such as banks and e-commerce, and steal private information such as bank account numbers and passwords submitted by users. Vulnerabilities in the website server program insert dangerous page codes into some web pages of the website to steal users' private informat...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the above-mentioned identification of phishing websites, the inventor found at least the following problems in the prior art: the manual review method has relatively large limitations, and the review quality depends on the professionalism of the reviewers, and it is prone to missed and false detections At the same time, due to the limited number of auditors, the identification of phishing websites has a strong lag, and the timely and effective identification of websites cannot be guaranteed.

As for the automatic identification method, phishing websites can use object-based and event-driven client-side scripting language (Javascript) obfuscation, keyword obfuscation and other technical means to bypass the detection of third-party software, such as compiling the page source code into like figure 1 irregular string as shown, or as figure 2 As shown in , interfering characters are inserted between characters through keyword obfuscation. These obfuscation methods will prevent third-party software from effectively extracting keywords used as identification basis

[0005] It can be seen from this that for the identification of phishing websites at present, an effective solution has not been given in the prior art

Images