WO2015007231A1

WO2015007231A1 - Method and device for identification of malicious url

Info

Publication number: WO2015007231A1
Application number: PCT/CN2014/082468
Authority: WO
Inventors: 张辉; 刘健; 申飞龙
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2013-07-19
Filing date: 2014-07-18
Publication date: 2015-01-22
Also published as: CN103338211A

Abstract

A method and device for identification of a malicious URL. The method comprises: a URL that is comprised in the content of a communication message is matched with URLs in a predetermined URL blacklist; if the URL match is successful, a risk warning is generated, otherwise, an IP address of a transmitting-end device of the communication message is matched with IP addresses in a predetermined IP address blacklist; and if the IP address match is successful, then a risk warning is generated.

Description

Method and device for identifying malicious URL

Technical field

The present invention relates to the field of computer security, and more particularly to a method and apparatus for authenticating a malicious URL. Background of the invention

A URL (Uniform Resource Locator), also referred to as a web address, referred to as a web address, is the address of a standard resource on the Internet. The URL user can access the corresponding web content in the network. A malicious URL is the URL of a type of fraud, phishing, phishing, or hang-up web page. When a user visits such a webpage inadvertently, the user may suffer from, for example, economic loss, disclosure of personal privacy information, or adverse effects such as the current computer infection with a Trojan virus.

Current security software can authenticate malicious URLs and alert users after identifying malicious URLs to protect user information and property.

In the prior art, the identification of a malicious URL is mainly based on the content of the webpage. For example, the webpage content of the webpage can be identified to identify whether the webpage URL is a malicious URL. In this manner, it is necessary to collect keywords of malicious features in advance, then match the text content of the webpage of the authenticated URL, and identify the URL that meets the matching matching rule as a malicious URL. However, in this way, the hacker can basically display the text content on the webpage through complex coding, page encryption, JS multiple jumps, exploiting the vulnerability of a large website to upload fake phishing pages of QQ space. . In this way, malicious URLs are difficult to detect, which reduces the identification of malicious URLs. SUMMARY OF THE INVENTION Embodiments of the present invention provide a method and an apparatus for authenticating a malicious URL to improve the authentication effect of a malicious URL.

A method for authenticating a malicious URL, comprising the steps of:

Matching the URL included in the content of the communication message with the preset URL blacklist; if the URL matches successfully, a risk prompt is generated, otherwise:

The IP address of the sender device of the communication message is matched with the preset IP address blacklist; if the IP address matches successfully, a risk prompt is generated.

An authentication device for a malicious URL, comprising:

a URL matching unit, configured to match a URL included in the content of the communication message with a preset URL blacklist;

The IP address matching unit is configured to: when the URL matching fails, match an IP address of the sending end device of the communication message with a preset IP address blacklist; the risk prompting unit is configured to successfully match the URL When the IP address is successfully matched, a risk prompt is generated.

With the embodiment of the present invention, it is possible to identify whether the URL propagated by the communication message is a malicious URL, and make a risk prompt to the user when the authentication result is YES. The embodiment of the present invention can prompt the user before the user accesses the malicious URL, so the webpage content of the malicious URL does not need to be authenticated. Therefore, even if the hacker makes the webpage basically display the text content by technical means, the malicious URL can be identified by using the embodiment of the present invention. That is, with the embodiment of the present invention, the authentication effect of the malicious URL can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the prior art description will be briefly described below, and obviously, in the following description The drawings are only some embodiments of the invention, and are common to the art. For the sake of the technicians, other drawings can be obtained from these drawings without any creative work.

1 is a flowchart of a method for authenticating a malicious URL according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for authenticating a malicious URL according to another embodiment of the present invention; FIG. 3 is a diagram of a malicious URL according to another embodiment of the present invention; FIG. 4 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to an embodiment of the present invention; FIG. 5 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to another embodiment of the present invention; A schematic structural diagram of an authentication device for a malicious URL in an embodiment. FIG. 7 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to another embodiment of the present invention. The embodiments of the present invention will be described clearly and completely in conjunction with the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of them. An embodiment. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In order to solve the problem that the authentication of the malicious URL is not good in the prior art, the embodiment of the present invention provides a method for authenticating a malicious URL, as shown in FIG.

S11. The URL included in the content of the communication message is matched with the preset URL blacklist. If the URL is successfully matched, a risk prompt is generated. Otherwise, the process proceeds to step S12.

After generating a malicious URL, a hacker often needs to add a malicious URL to a communication message through a messaging software such as an instant messaging software or a mail system for widespread malicious transmission. For example, after the hacker generates a malicious URL for QQ hacking: www.xxx.yyy.com/zzl, it will also use a instant messaging software such as QQ to send a large number of instant messages including the malicious URL. User of the communication software. Once the user who received the communication message opens the malicious URL in the communication message: www.xxx.yyy.com/zzl, it is likely to cause the QQ password to be leaked, which may cause economic loss, personal privacy to the user. Information Adverse effects such as leaks. In addition, malicious URLs can be widely maliciously spread by mass mailing. For example, a hacker can send a mail group including the malicious URL to a mail user, thereby threatening the security of the mail user's computer.

Malicious propagation of malicious URLs generally has the following characteristics:

First, a batch of malicious domain names will be transmitted for a period of time. These malicious domain names will repeatedly spread maliciously before the security software recognizes these malicious domain names. For example, a malicious URL included in a malicious domain name: www.xxx.yyy.com/zzl will be sent to different user groups A, user group B and user group C in a period of time. That is to say, after the user of user group A is threatened by the malicious URL, other user groups may be threatened by the malicious URL for a period of time.

Second, when the URL sent by an IP address is a malicious URL, most of the URLs included in the communication message sent from the IP address are malicious URLs for a period of time. Since the hardware devices owned by hackers are limited in general, the IP addresses of these hardware devices are relatively fixed, so the IP address for generating malicious URLs is relatively fixed. In order to spread malicious URLs widely, multiple malicious URLs can be generated by one IP address. That is, other URLs generated by the IP address that generated a malicious URL may also be malicious URLs.

Based on the above features, the idea of the embodiment of the present invention is that after obtaining the URL in the communication message received by the user, the URL is authenticated, so that the malicious URL is alarmed during the malicious propagation phase. To this end, in the embodiment of the present invention, the URL included in the content of the communication message is first matched with the preset URL blacklist.

In the embodiment of the present invention, the authentication of the malicious URL is based on the preset blacklist of the URL and the blacklist of the IP address, that is, whether the URL is a malicious URL by URL matching and IP address matching.

In a practical application, the URL blacklist and the IP address blacklist in the embodiment of the present invention may be improved by timely updating and upgrading to identify the newly generated malicious URL. For example, when the process of authenticating a URL is implemented on a client device, the URL blacklist and IP address Blacklists can be stored on client devices. The update method of the URL blacklist and the IP address blacklist can be upgraded in the same way as the antivirus software virus database upgrade. The remote server is used to complete the update. Alternatively, the URL blacklist and the IP address blacklist are stored in the cloud server, and the cloud URL authentication server authenticates the URL included in the content of the communication message in a manner similar to the antivirus software cloud killing method.

Specifically, the URL included in the content of the communication message may be first matched with the URL blacklist. If the URL exists in the URL blacklist, the match is successful, meaning the URL is a malicious URL. At this point, a risk alert message can be generated to alert the URL in the user communication message that received the communication message that there is a risk.

In practical applications, the content of the user communication message, such as the content in the QQ message, can be monitored on the user's client device. When the content of the QQ message received by the user includes a URL, the URL is matched with the URL blacklist stored in the client device. For example, when the URL included in the QQ message content: "www.xxx.yyy.com/zzl" matches the URL blacklist successfully, the URL is a malicious URL. After the URL is successfully matched, a risk alert can be generated for the user. For example, a prompt box can be popped up to remind the user that the URL is risky to avoid the user suffering a loss due to accessing the URL.

S12. If the URL matching fails, the IP address of the sending device of the communication message is matched with the IP address of the preset IP address; if the IP address is successfully matched, a risk prompt is generated.

Although the URL matching failure can indicate that the URL is not in the URL blacklist, it does not indicate that the URL is not a malicious URL. This is because a device with an IP address can generate multiple URLs, and malicious URLs may not be included in the URL blacklist. That is to say, if the IP address of the sender device of the communication message is included in the IP address blacklist, even if the URL sent by it is not included in the URL blacklist, the URL is very likely to be a malicious URL. Therefore, the identification rate of malicious URL authentication can be further improved by IP address matching.

For example, since the URL: www.xxx.yyy.com/zzl has not been forced into the URL The blacklist, so the URL: www.xxx.yyy.com/zzl is not identified as a malicious URL. However, according to the characteristics of the IP protocol, the IP address corresponding to the URL: www.xxx.yyy.com/zzl can be obtained: aaa.bbb.ccc.ddd. The IP address matching in the embodiment of the present invention can identify whether the sending end device of the communication message is a terminal device for sending a malicious URL. That is, when the IP address: aaa.bbb.ccc.ddd exists in the blacklist of the IP address, the sender device of the sender device is a malicious URL. If a URL is included in the communication message sent by the sender device, the URL may be a malicious URL. By matching IP addresses, you can identify malicious URLs that do not exist in the URL blacklist.

Similarly, after the IP address is successfully matched, a risk prompt can be generated for the user. For example, a prompt box can be popped up to alert the user that the URL is at risk, in order to avoid the user being compromised by accessing the URL.

In the embodiment of the present invention, the malicious URL has the feature of propagating through the group communication message, and the URL included in the communication message is authenticated, so that the user can obtain the risk reminder before accessing the malicious URL, thereby avoiding the risk. The user's loss due to accessing a malicious URL. Since the method for authenticating a malicious URL provided by the embodiment of the present invention does not need to identify the content of the webpage to identify whether the URL is malicious, the hacker cannot pass the complicated coding, the page encryption, the JS multiple jump, and the use of the large website. Vulnerabilities upload technical methods such as phishing pages of fake QQ space to prevent malicious URLs from being detected. Therefore, the method for authenticating a malicious URL provided by the embodiment of the present invention can effectively improve the authentication effect of a malicious URL.

In another embodiment of the present invention, the method for authenticating a malicious URL shown in FIG. 1 may further include the step of domain name matching. Specifically, after the URL matching fails, the method for authenticating the malicious URL may further include: matching the domain name of the URL with the default suspicious domain name database; if the domain name matches successfully, performing IP address matching.

A malicious URL also has a feature that generally generates a large number of malicious URLs through the same domain name. For example, the name of i or www.xxx.yyy.com can include www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, Many malicious URLs such as www.xxx.yyy.com/zz4. If the URL: www.xxx.yyy.com/zzl URL has lost 3⁄4:, the name www.xxx.yyy.com already exists in the suspicious domain name library, then all URLs under the domain name may be malicious URLs. . To do this, you need to further authenticate the URL: www.xxx.yyy.com/zzl, that is, after the domain name is successfully matched, determine the URL by matching the IP address: www.xxx.yyy.com/zzl is Malicious URL

Based on the authentication method of the malicious URL shown in Fig. 1, Fig. 2 is a flow chart showing the method of authenticating the malicious URL in another embodiment of the present invention. As shown in Figure 2, the method includes the following steps:

521. The URL included in the content of the communication message is matched with the preset URL blacklist. If the URL is successfully matched, a risk prompt is generated. Otherwise, step S22 is performed.

522. Match the domain name of the URL with the default suspicious domain name database. If the domain name matches successfully, go to step S23.

523. Match the IP address of the device at the sending end of the communication message with the blacklist of the preset IP address; if the IP address is successfully matched, a risk prompt is generated.

In the embodiment of the present invention, the specific implementation manners of step S21 and step S23 are similar to the specific implementation manners of step S11 and step S12 shown in FIG. 1, and details are not described herein again.

In the embodiment of the present invention, the method for authenticating the malicious URL may further include an automatic upgrade step of the URL blacklist, the suspicious domain name database, and the IP address blacklist to improve the recognition rate of the malicious URL. FIG. 3 is a flowchart of a method for authenticating a malicious URL according to another embodiment of the present invention. The method includes an upgrade procedure of a URL blacklist, a suspicious domain name database, and an IP address blacklist, as follows.

When a malicious URL is identified, it can be inferred that other URLs corresponding to the domain name of the malicious URL may also be malicious URLs. Therefore, in the embodiment of the present invention, the domain name of the malicious URL may be added to the preset suspicious domain name database, so that the suspicious domain name database may be updated in time, so that other malicious URLs corresponding to the domain name may also be identified in time. come out.

The name of the domain name www.xxx.yyy.com is still included. Www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, www.xxx.yyy.com/zz4 and many other malicious URLs. If the URL: www.xxx.yyy.com/zzl is successfully matched by the URL, the URL is a malicious URL. In the implementation of the present invention, in order to prevent other users from the URL of the domain name www.xxx.yyy.com to which the www.xxx.yyy.com/zzl belongs, while the risk is prompted for the malicious URL, Www.xxx.yyy.com joins the suspicious domain name library. Thus, when the other URLs under the name of the domain name www.xxx.yyy.com, ^ mouth www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3 or www.xxx.yyy.com/zz4, etc. When performing authentication, even if these URLs are not included in the URL blacklist, they can be identified by domain name matching.

Similarly, when a malicious URL is identified, it can be determined that the sender of the communication message transmitting the malicious URL is the source of the malicious URL. Therefore, other URLs sent from the IP address of the device of the communication message can also be identified as malicious URLs. Therefore, in the embodiment of the present invention, the IP address of the device at the sending end of the communication message may be added to the blacklist of the preset IP address, so that the blacklist of the IP address is updated in time, thereby enabling the sending end of the communication message. Other malicious URLs sent by the device's IP address can also be identified in time.

For example, after the malicious URL: www.xxx.yyy.com/zzl is identified, according to the characteristics of the IP protocol, the malicious URL can be obtained: IP address corresponding to www.xxx.yyy.com/zzl: aaa. Bbb.ccc.ddd. By adding the IP address: aaa.bbb.ccc.ddd to the IP address blacklist, all malicious URLs included in the communication message sent by the sender device of the communication message corresponding to the IP address can be identified.

Than ^ mouth, "叚包括 includes evil, meaning URL: www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, www.xxx.yyy. The communication messages of com/zz4 are sent through the terminal device with the IP address aaa.bbb.ccc.ddd. When the malicious URL: www.xxx.yyy.com/zzl is identified and the IP address is: aaa.bbb.ccc After .ddd is added to the IP address blacklist, if the URL: www.xxx.yyy.com/zz4 is authenticated at this time, the IP address corresponding to the URL: www.xxx.yyy.com/zz4 can be used: Aaa.bbb.ccc.ddd already exists in the IP address blacklist and identifies the URL: www.xxx.yyy.com/zz4 is a malicious URL.

In addition, when authenticating a URL, even if the URL match fails, matching the URL based on the subsequent IP address is likely to be identified as a malicious URL. Therefore, in the embodiment of the present invention, the malicious URL authentication method may further include: adding the URL to the URL blacklist after the IP address is successfully matched, so that the URL blacklist can be updated in time.

In practical applications, URL matching, IP address matching, and domain name matching in the embodiments of the present invention can be implemented on the receiving end device of the communication message. In other words, the user's final list, IP address blacklist, and suspicious domain name library can be upgraded through a remote server.

In addition, URL matching, IP address matching, and domain name matching in the embodiments of the present invention may be implemented by a server that forwards a communication message. That is, in the process of forwarding the communication message by the server, the server performs URL matching on the URL included in the content of the communication message, and after the URL matching fails, the domain name of the URL is matched with the default suspicious domain name database, and the domain name is matched. After the success, the IP address of the sending device of the communication message is matched with the IP address blacklist. At this point, the URL blacklist, IP address blacklist, and suspicious domain name repository can all be stored in the cloud server.

In summary, in the embodiment of the present invention, according to the propagation characteristics of the malicious URL, a URL blacklist, a suspicious domain name database, and an IP address blacklist are pre-set. By obtaining the URL of the content of the communication message, the domain name of the URL, and the IP address of the device of the communication message, the information can be matched with the pre-set URL blacklist, the suspect domain name pool, and the IP address blacklist. It is identified whether the URL propagated through the communication message is a malicious URL, and the user is prompted for a risk when the URL is a malicious URL. Since the user can prompt the user after obtaining the communication information including the malicious URL, the user does not need to authenticate the webpage content of the malicious URL. Therefore, even if the hacker makes the webpage basically display the text content by technical means, the embodiment of the present invention can identify the malicious URL. That is, with the embodiment of the present invention, the authentication effect of the malicious URL can be effectively improved. In addition, in the embodiment of the present invention, by updating the URL blacklist, the IP address blacklist, and the suspicious domain name database, the malicious URL included in other communication information sent by the same domain name or the same IP address can be effectively identified. Thereby, the identification effect of the malicious URL is further improved.

FIG. 4 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to an embodiment of the present invention. As shown in FIG. 4, the device includes: a URL matching unit 01, an IP address matching unit 02, and a risk prompting unit 03. The URL matching unit 01 is configured to match the URL included in the content of the communication message with the preset URL blacklist. The IP address matching unit 02 is configured to match the IP address of the sending end device of the communication message with the preset IP address blacklist when the URL matching fails. The risk prompting unit 03 is configured to generate a risk prompt when the URL matching is successful or the IP address matching is successful.

After generating a malicious URL, a hacker often needs to add a malicious URL to a communication message through a messaging software such as an instant messaging software or a mail system for widespread malicious transmission. For example, after the hacker generates a malicious URL for QQ hacking: www.xxx.yyy.com/zzl, it will also use a instant messaging software such as QQ to send a large number of instant messages including the malicious URL. User of the communication software. Once the user who received the communication message opens the malicious URL in the communication message: www.xxx.yyy.com/zzl, it is likely to cause the QQ password to be leaked, which may cause economic loss, personal privacy to the user. Adverse effects such as leakage of information. In addition, malicious URLs can be spread maliciously through mass mailing. For example, a hacker can send a message group that includes the malicious URL to a mail user, thereby threatening the security of the mail user's computer.

First, a batch of malicious domain names will be transmitted for a period of time. These malicious domain names will repeatedly spread maliciously before the security software recognizes these malicious domain names. For example, a malicious URL included in a malicious domain name: www.xxx.yyy.com/zzl will be sent to different user groups A, user groups B, and user groups C for a period of time. That is to say, after the user of user group A is threatened by the malicious URL, other user groups may also be affected by the user for a certain period of time. The threat of malicious URLs.

Based on the above features, the idea of the embodiment of the present invention is that after obtaining the URL in the communication message received by the user, the URL is authenticated, so that the malicious URL is alarmed during the malicious propagation phase. To this end, in the embodiment of the present invention, the URL included in the content of the communication message is first matched with the preset URL blacklist by the URL matching unit 01.

In practical applications, the blacklist of URLs and the blacklist of IP addresses in the embodiments of the present invention may be improved by timely updating and updating to identify newly generated malicious URLs. For example, when the process of authenticating a URL is implemented on a client device, a blacklist of URLs and a blacklist of IP addresses can be stored on the client device. The update of the URL blacklist or IP address blacklist can be upgraded in the same way as the antivirus virus database upgrade. The remote server is used to complete the update. Alternatively, the URL blacklist and the IP address blacklist are stored in the cloud server, and the cloud URL authentication server authenticates the URL included in the content of the communication message in a similar manner to the antivirus software cloud killing method.

Specifically, the URL matching unit 01 first matches the URL included in the content of the communication message with the URL blacklist. If the URL exists in the URL blacklist, the match is successful, meaning that the URL is a malicious URL. At this time, the risk prompting unit 03 can generate wind The P佥 prompt message is at risk of prompting the URL in the user communication message that received the communication message.

In a practical application, the malicious URL authentication apparatus in the embodiment of the present invention can monitor the content of the user communication message, such as the content in the QQ message, on the client device of the user. When the content of the QQ message received by the user includes a URL, the URL is matched with the URL blacklist stored in the client device. For example, when the URL included in the QQ message content:

WWW. XXX. yyy.com/zzl " If the URL blacklist is successfully matched, the URL is a malicious URL. After the URL is successfully matched, the risk prompting unit 03 can generate a risk prompt for the user. For example, the prompt box can be popped up to remind the user. The URL is risky to prevent users from losing money by accessing the URL.

Although the URL matching failure by the URL matching unit 01 indicates that the URL is not in the URL blacklist, it does not indicate that the URL is not a malicious URL. This is because a device with an IP address can generate multiple URLs, and malicious URLs may not be included in the URL blacklist. That is, if the IP address of the sender device of the communication message is included in the blacklist of the IP address, even if the URL it sends is not included in the URL blacklist, the URL is very likely to be a malicious URL. Therefore, IP address matching by the IP address matching unit 02 can further improve the recognition rate of malicious URL authentication.

For example, since the URL: www.xxx.yyy.com/zzl has not been forced into the URL blacklist, the URL: www.xxx.yyy.com/zzl is not identified by the URL matching unit 01 as malicious. URL. However, according to the characteristics of the IP protocol, the IP address corresponding to the URL: www.xxx.yyy.com/zzl can be obtained: aaa.bbb.ccc.ddd. The IP address matching of the IP address matching unit 02 in the embodiment of the present invention can identify whether the transmitting end device of the communication message is a terminal device for sending a malicious URL. That is, when the IP address: aaa.bbb.ccc.ddd exists in the blacklist of the IP address, the sender device of the sender device is a malicious URL. If a URL is included in the communication message sent by the sender device, the URL is likely to be a malicious URL. By matching the IP address of the IP address matching unit 02, a malicious URL that does not exist in the URL blacklist can be identified. Similarly, after the IP address is successfully matched, the risk prompting unit 03 can generate a wind P佥 prompt for the user. For example, a prompt box may be popped up to alert the user that the URL is risky to avoid the user suffering a loss due to accessing the URL.

In the embodiment of the present invention, the malicious URL has the feature of propagating by using a group communication message, and matching and identifying the URL included in the communication message, so that the user can obtain a risk reminder before accessing the malicious URL, thereby avoiding The user's loss due to accessing a malicious URL. Since the malicious URL authentication apparatus provided by the embodiment of the present invention can identify whether the URL is malicious without identifying the content of the webpage, the hacker cannot pass the loopholes such as complex encoding, page encryption, JS multiple jumps, and utilizing large websites. Upload technical methods such as phishing pages of fake QQ space to prevent malicious URLs from being detected. Therefore, the authentication device for the malicious URL provided by the embodiment of the present invention can effectively improve the authentication effect of the malicious URL.

Based on the authentication device of the malicious URL shown in FIG. 4, FIG. 5 is a block diagram showing the structure of the authentication device for the malicious URL in another embodiment of the present invention. As shown in FIG. 5, the apparatus may further include a domain name matching unit 04. Specifically, after the URL matching fails, the domain name matching unit

The IP address matching unit 02 performs IP address matching.

A malicious URL also has a feature that generally generates a large number of malicious URLs through the same domain name. For example, the name of i or www.xxx.yyy.com can include www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, www. Many malicious URLs such as xxx.yyy.com/zz4. If the domain name matching unit 04 fails to match the URL of the URL: www.xxx.yyy.com/zzl, but the i or the name www.xxx.yyy.com already exists in the suspicious domain name database, all the URLs under the domain name are There may be a malicious URL. To this end, it is necessary to further authenticate the URL: www.xxx.yyy.com/zzl, that is, after the domain name matching unit 04 is successfully matched, the IP address matching unit 02 needs to perform IP address matching to determine the URL: www.xxx Is .yyy.com/zzl a malicious URL? The function of the unit included in the authentication device of the malicious URL provided by the embodiment shown in FIG. 5 is as follows.

The URL matching unit 01 matches the URL included in the content of the communication message with the preset URL blacklist.

The domain name matching unit 04 matches the domain name of the URL with the preset suspicious domain name database when the URL matching fails.

When the domain name matching succeeds, the IP address matching unit 02 matches the IP address of the sending end device of the communication message with the preset IP address blacklist.

The risk prompting unit 03 generates a risk prompt when the URL matching is successful or the IP address is successfully matched.

The URL matching unit 01 and the IP address matching unit 02 in the embodiment of the present invention are similar to the functions of the URL matching unit 01 and the IP address matching unit 02 shown in FIG. 1, and will not be described again.

FIG. 6 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to another embodiment of the present invention. As shown in FIG. 6, the malicious URL authentication apparatus may further include a URL blacklist updating unit 011, a suspect domain name database updating unit 041, and an IP address blacklist updating unit 021, thereby implementing a URL blacklist, a suspicious domain name database, and an IP address blacklist. Automatic upgrades to increase the recognition rate of malicious URLs.

When a malicious URL is identified, it can be inferred that other URLs corresponding to the domain name of the malicious URL may also be malicious URLs. To this end, in the embodiment of the present invention, the suspicious domain name database updating unit 041 can also add the domain name of the malicious URL to the preset suspicious domain name database, so that the suspicious domain name database can be updated in time, thereby making the domain name corresponding to the other Malicious URLs can also be identified in a timely manner.

The name of the i or name www.xxx.yyy.com is still included, including www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, www. Xxx.yyy.com/zz4 and many other malicious URLs. If the URL: www.xxx.yyy.com/zzl is successfully matched by the URL, the URL is a malicious URL. In In the implementation of the present invention, the suspicious domain name database is updated in order to prevent other malicious URLs in the name of the domain name www.xxx.yyy.com that the www.xxx.yyy.com/zzl belongs to. Unit 041 can add the domain name www.xxx.yyy.com to the suspect domain name library. In this way, when other URLs under the name of the domain name www.xxx.yyy.com, such as www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3 or www.xxx.yyy.com/zz4, etc. At the time of authentication, even if these URLs are not included in the URL blacklist, they can be identified by domain name matching.

Similarly, when the URL matching unit 01 identifies the malicious URL, it can determine that the communication message sending device that sent the malicious URL is the source of the malicious URL. Therefore, other URLs sent from the IP address of the messaging device can also be identified as malicious URLs. Therefore, in the embodiment of the present invention, the IP address blacklist updating unit 021 can add the IP address of the device of the communication message to the blacklist of the preset IP address, thereby updating the blacklist of the IP address in time, thereby making Other malicious URLs sent from the IP address of the sender device of the communication message can also be identified in time.

For example, after the malicious URL: www.xxx.yyy.com/zzl is identified, according to the characteristics of the IP protocol, the malicious URL can be obtained: IP address corresponding to www.xxx.yyy.com/zzl: aaa. Bbb.ccc.ddd„ The IP address blacklist update unit 021 adds the IP address: aaa.bbb.ccc.ddd to the blacklist of the IP address, and can identify the communication message sent by the device corresponding to the communication message corresponding to the IP address. All malicious URLs.

Than ^ mouth, "叚包括 includes evil, meaning URL: www.xxx.yyy.com/zzl, www.xxx.yyy.com/zz2, www.xxx.yyy.com/zz3, www.xxx.yyy. The communication messages of com/zz4 are sent through the terminal device with the IP address aaa.bbb.ccc.ddd. When the malicious URL: www.xxx.yyy.com/zzl is identified and the IP address is: aaa.bbb.ccc After .ddd is added to the blacklist of IP addresses, if the URL: www.xxx.yyy.com/zz4 is authenticated at this time, it can be based on the IP address corresponding to the URL: www.xxx.yyy.com/zz4: aaa. Bbb.ccc.ddd already exists in the IP address blacklist and identifies the URL: www.xxx.yyy.com/zz4 is a malicious URL. In the embodiment of the present invention, the malicious URL authentication apparatus may further include a URL blacklist updating unit 011, configured to add the URL to the URL blacklist after the IP address matching unit 02 performs the IP address matching successfully. When the URL is authenticated, even if the URL match fails, matching the URL based on the subsequent IP address is likely to be identified as a malicious URL. Therefore, the URL blacklist can be updated in time by the URL blacklist updating unit 011.

In an actual application, the URL matching unit, the IP address matching unit, and the domain name matching unit in the embodiment of the present invention may be set on the receiving end device of the communication message. For example, it can be set on the user's computer or mobile phone. The URL blacklist, IP address blacklist, and suspicious domain name library stored in these user terminal devices can also be upgraded through a remote server to improve the user's defense against new malicious URLs.

In addition, the URL matching unit, the IP address matching unit, and the domain name matching unit in the embodiment of the present invention may also be disposed in a server that forwards the communication message. The server may perform URL matching on the URL included in the content of the communication message during the process of forwarding the communication message. After the URL matching fails, the domain name of the URL is matched with the default suspicious domain name database, and the domain name is successfully matched. After that, the IP address of the sending device of the communication message is matched with the IP address blacklist. At this point, the URL blacklist, IP address blacklist, and suspicious domain name store can all be stored in the cloud server.

In summary, in the embodiment of the present invention, according to the propagation characteristics of the malicious URL, a URL blacklist, a suspicious domain name database, and an IP address blacklist are pre-set. By obtaining the URL included in the content of the communication message, the domain name of the URL, and the IP address of the device of the communication message sending device, the information can be matched with the pre-set URL blacklist, the suspect domain name library, and the IP address blacklist, thereby It is identified whether the URL propagated through the communication message is a malicious URL, and the user is prompted for a risk when the URL is a malicious URL. Since the user can prompt the user after obtaining the communication information including the malicious URL, the user does not need to authenticate the webpage content of the malicious URL. Therefore, even if the hacker makes the webpage basically display the text content by technical means, the embodiment of the present invention can identify the malicious URL. That is, with the embodiment of the present invention, the authentication effect of the malicious URL can be effectively improved. In addition, in the embodiment of the present invention, by updating the URL blacklist, the IP address blacklist, and the suspicious domain name database, the malicious URL included in other communication information sent by the same domain name or the same IP address can be effectively identified. Thereby, the identification effect of the malicious URL is further improved.

FIG. 7 is a schematic structural diagram of an apparatus for authenticating a malicious URL according to another embodiment of the present invention. The authentication device includes at least: a memory 71 and a processor 72 in communication with the memory 71, wherein the memory 71 includes URL matching instructions, IP address matching instructions, and risk alert instructions executable by the processor 72. The memory 71 can be a non-volatile computer readable storage medium, and the URL matching instructions, IP address matching instructions, and risk alert instructions can be machine readable instructions stored in the memory 71. Processor 72 can execute machine readable instructions stored in memory 71.

The URL matching command is used to match the URL included in the content of the communication message with the preset URL blacklist. The IP address matching command is configured to match the IP address of the sending end device of the communication message with the preset IP address blacklist when the URL matching fails. The risk alert command is used to generate a risk alert when the URL match is successful or the IP address matches successfully.

The memory 71 also stores a domain name matching command, configured to match the domain name of the URL with a preset suspicious domain name domain after the URL matching fails. If the domain name matches successfully, the IP address matching command performs the IP address matching.

The suspicious domain name database update instruction is also stored in the memory 71 for adding the domain name of the URL to the suspicious domain name library after the URL matching is successful.

The memory 71 also stores an IP address blacklist update command for adding the IP address of the sender device of the communication message to the IP address blacklist after the URL is successfully matched.

The memory 71 also stores a URL blacklist update command for adding the URL to the URL blacklist when the IP address matches successfully.

The URL matching instruction, the IP address matching instruction, and the domain name matching instruction are set in the receiving end device of the communication message. The URL matching instruction, the IP address matching instruction, and the domain name matching instruction are set to a server that forwards the communication message.

The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same or similar parts of the various embodiments may be referred to each other.

The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments are obvious to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein.

Claims

claims

1. A malicious URL identification method, characterized by including the steps:

URL matching is performed between the URL included in the content of the communication message and the preset URL blacklist; if the URL is successfully matched, a risk prompt is generated, otherwise:

The IP address of the sending device of the communication message is matched with the preset IP address blacklist; if the IP address is successfully matched, a risk prompt is generated.

2. The identification method according to claim 1, characterized in that, after the URL matching fails, further comprising: if the domain name matching is successful, performing the IP address matching.

3. The identification method according to claim 1, characterized in that, after the URL is successfully matched, it further includes:

Add the domain name of the URL to the suspicious domain name database.

4. The identification method according to claim 1, characterized in that, after the URL is successfully matched, it further includes:

Add the IP address of the sending device of the communication message to the IP address blacklist.

5. The identification method according to claim 1, characterized in that, after the IP address is successfully matched, it further includes:

Add the URL to the URL blacklist.

6. The identification method according to claim 2, characterized in that,

The URL matching, the IP address matching and the domain name matching are implemented by the receiving end device of the communication message.

7. The identification method according to claim 2, characterized in that,

The URL matching, the IP address matching and the domain name matching are implemented by the server that forwards the communication message.

8. A malicious URL identification device, characterized by including: URL matching unit, used to URL match the URL included in the content of the communication message with the preset URL blacklist;

The IP address matching unit is used to match the IP address of the sending device of the communication message with the preset IP address blacklist when the URL matching fails; the risk warning unit is used to perform IP address matching when the URL matching is successful. Or a risk prompt will be generated when the IP address is successfully matched.

9. The identification device according to claim 8, further comprising: a domain name matching unit, configured to match the domain name of the URL with a preset suspicious domain name database when the URL matching fails;

If the domain name is matched successfully, the IP address matching unit performs the IP address matching.

10. The identification device according to claim 8, further comprising: a suspicious domain name database update unit, configured to add the domain name of the URL to the suspicious domain name database after the URL is successfully matched.

11. The identification device according to claim 8, further comprising:

The IP address blacklist update unit is configured to add the IP address of the sending device of the communication message to the IP address blacklist after the URL is successfully matched.

12. The identification device according to claim 8, further comprising:

A URL blacklist update unit, configured to add the URL to the URL blacklist when the IP address is successfully matched.

13. The identification device according to claim 9, characterized in that,

The URL matching unit, the IP address matching unit and the domain name matching unit are provided at the receiving end device of the communication message.

14. The identification device according to claim 9, characterized in that,

The URL matching unit, the IP address matching unit and the domain name matching unit are configured on a server that forwards the communication message.