Method and system for identifying whether webpage includes malicious content or not

Abstract

The invention discloses a method for identifying whether a webpage includes malicious content or not. One identification method comprises the following steps: resolving a URL (Uniform Resource Locator) of a webpage to be identified to extract a URL feature from the URL in order to generate a first feature set; generating a first feature vector according to the first feature set; and processing the first feature vector by using a first feature model, and outputting a first result in order to represent whether the webpage to be identified includes the malicious content or not. The invention also discloses another three identification methods, and corresponding systems for identifying whether the webpage includes the malicious content or not.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and a system for identifying whether malicious content is contained in a web page. Background technique [0002] With the development of the Internet, WEB-based applications are becoming more and more popular. People can query bank accounts and shop online through browsers. WEB provides people with a convenient and fast way of interaction. But the ensuing problem is: a large number of malicious website attacks are increasing year by year. They use a series of technical means to disguise their identities to deceive users' trust, and then seek illegal benefits. Users suffer huge economic losses under the attack of malicious websites. . Therefore, how to identify malicious content in web pages and prevent malicious websites has become a very meaningful research topic in the field of network security. [0003] The existing technologies for preventing malicious web...

AI Technical Summary

Problems solved by technology

But the ensuing problem is: a large number of malicious website attacks are increasing year by year. They use a series of technical means to disguise their identities to deceive users' trust, and then seek illegal benefits. Users suffer huge economic losses under the attack of malicious websites.

[0003] The existing technologies for preventing malicious websites are mainly to send a suspicious webpage URL to the blacklist database for query. However, due to the continuous updating of phishing websites, this method has a low detection rate for malicious websites such as phishing websites. high with hysteresis

Either scan the content of the webpage to find out whether there are malicious keywords in the webpage; or extract the basic features of the webpage image to calculate the similarity between the suspicious webpage and the real webpage, so as to judge whether the suspicious webpage is suspected of imitation, but the above Each method has its own limitations, resulting in a high rate of misjudgment

Images