Malicious website detection method and device and electronic equipment

Abstract

The invention discloses a malicious website detection method and device and electronic equipment, and the method comprises the steps: obtaining a target URL corresponding to a webpage opening instruction when the webpage opening instruction is received; obtaining a URL feature value of the target URL, wherein the URL feature value corresponds to an input parameter of a machine learning model of a server; obtaining a weight parameter of a prediction function of the machine learning model after the training of the server is completed; based on the weight parameter, the URL feature value and a prediction function pre-stored in the client, performing calculation at the client to obtain a prediction value; judging whether the predicted value is within a preset range or not; and if the predicted value is not in the preset range, judging that the target URL is a malicious URL. By means of the scheme, prediction of the malicious website is achieved at the client side, comparison of a blacklist website library is not needed, a machine learning model does not need to be deployed at the client side, operations such as exporting, loading and starting of the model are avoided, and malicious website protection time is shortened.

Description

technical field [0001] The present invention relates to the technical field of software, in particular to a malicious website detection method, device and electronic equipment. Background technique [0002] With the development of Internet technology, browsers have brought a lot of convenience to users' lives. Users can browse the world at home through browsers, but it also brings some troubles to users. For example, improper protection of malicious URLs will not only waste The user's time may even lead to virus invasion and cause privacy leakage and property loss to the user. [0003] In the prior art, the URLs of malicious webpages, that is, the protection technology of malicious URLs, is mostly a blacklist database query. For example, for the URL "soxx678.com", to determine whether it is a malicious URL, you need to get "soxx5678.com" and the blacklist URL The list in the library matches. This blacklist URL library may be in the cloud, or it may be downloaded locally. T...

AI Technical Summary

Problems solved by technology

The blacklist URL library is often updated with a lag and cannot detect malicious URLs that are not included. Usually, after a new malicious URL comes out, the blacklist library cannot detect it within 1 to 3 days or even a week

If the blacklist URL library is queried in the cloud through the cloud, the local side needs to interact with the cloud network, which takes a long time

If the blacklist library is downloaded locally, the blacklist URL library will occupy a large amount of local storage space, and the local query time will increase with the increase of the blacklist library

Images