WO2017000439A1 - 一种恶意行为的检测方法、系统、设备及计算机存储介质 - Google Patents

一种恶意行为的检测方法、系统、设备及计算机存储介质 Download PDF

Info

Publication number
WO2017000439A1
WO2017000439A1 PCT/CN2015/092567 CN2015092567W WO2017000439A1 WO 2017000439 A1 WO2017000439 A1 WO 2017000439A1 CN 2015092567 W CN2015092567 W CN 2015092567W WO 2017000439 A1 WO2017000439 A1 WO 2017000439A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
malicious
detected
reputation score
reputation
Prior art date
Application number
PCT/CN2015/092567
Other languages
English (en)
French (fr)
Inventor
邹荣新
Original Assignee
百度在线网络技术（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 百度在线网络技术（北京）有限公司 filed Critical 百度在线网络技术（北京）有限公司
Priority to US15/528,291 priority Critical patent/US20170318041A1/en
Publication of WO2017000439A1 publication Critical patent/WO2017000439A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a method, system, device, and computer storage medium for detecting malicious behavior.
  • the embodiments of the present invention provide a method, a system, a device, and a computer storage medium for detecting malicious behavior, which are used to solve the problem of using the continuously changing domain name or updating malicious file content to avoid malicious behavior detection in the prior art. Can improve the detection rate of malicious behavior.
  • An aspect of the embodiments of the present invention provides a method for detecting malicious behavior, including:
  • IP address corresponding to the Uniform Resource Locator URL accessed by the client, as the IP address to be detected
  • the foregoing aspect and any possible implementation manner further provide an implementation manner, after querying an IP address reputation database according to the to-be-detected IP address, to obtain a reputation score of the to-be-detected IP address,
  • the method further includes:
  • a reputation score of the malicious IP address and the malicious IP address Corresponding to storing a reputation score of a normal IP address and a normal IP address, a reputation score of the malicious IP address and the malicious IP address, to generate the IP address reputation database.
  • the reputation score of the malicious IP address in the IP address reputation database does not change within the validity period, after the validity period, the reputation score of the malicious IP address is lowered.
  • the method further includes:
  • the prompt information is displayed, and the prompt information is used to indicate that the user performs a corresponding operation;
  • the detection result is that the IP address to be detected belongs to a normal IP address or an unknown IP address, no prompt information is displayed.
  • An aspect of an embodiment of the present invention provides a detection system for malicious behavior, including:
  • An obtaining unit configured to obtain a network interconnection protocol IP address corresponding to a uniform resource locator URL accessed by the client, as the IP address to be detected;
  • the detecting unit is configured to perform malicious behavior detection on the IP address to be detected to obtain a detection result.
  • detecting unit is specifically configured to:
  • system further comprising:
  • An acquisition unit configured to collect a malicious IP address
  • a calculating unit configured to obtain, according to at least one of an acquisition source of the malicious IP address and a data update frequency of the collection source, a reputation score of the malicious IP address;
  • a storage unit configured to correspondingly store a reputation score of a normal IP address and a normal IP address, a reputation score of the malicious IP address and the malicious IP address, to generate the IP address letter Reputation library.
  • the reputation score of the malicious IP address in the IP address reputation database does not change within the validity period, after the validity period, the reputation score of the malicious IP address is lowered.
  • system further comprising:
  • the output unit is configured to: display the prompt information if the IP address to be detected belongs to the malicious IP address, and the prompt information is used to indicate that the user performs the corresponding operation; or, if the detection result is the The detection IP address belongs to a normal IP address or an unknown IP address, and no prompt message is displayed.
  • the technical solution provided by the embodiment of the present invention can detect the malicious behavior by using the IP address, and the detection of the malicious behavior is performed for the IP address. Therefore, the attacker can continuously replace the domain name or update the malicious file content in the prior art. In order to avoid the problem of detection of malicious behavior, the technical solution provided by the embodiments of the present invention can improve the detection rate of malicious behavior.
  • FIG. 1 is a schematic flowchart of a method for detecting malicious behavior according to an embodiment of the present invention
  • FIG. 2 is a system architecture diagram of a method for detecting malicious behavior according to an embodiment of the present invention
  • FIG. 3 is a functional block diagram of a detection system for malicious behavior provided by an embodiment of the present invention.
  • the word “if” as used herein may be interpreted as “when” or “when” or “in response to determining” or “in response to detecting.”
  • the phrase “if determined” or “if detected (conditions or events stated)” may be interpreted as “when determined” or “in response to determination” or “when detected (stated condition or event) “Time” or “in response to a test (condition or event stated)”.
  • FIG. 1 it is a schematic flowchart of a method for detecting malicious behavior according to an embodiment of the present invention. As shown in the figure, the method includes the following steps:
  • the execution body of S101-S102 may be a detection system of malicious behavior, and the system may be located in an application of a local terminal, or may be a plug-in or a software development kit (Software Development Kit) located in an application of the local terminal.
  • the functional unit, such as the SDK may be located on the server side, or may be partially located in the local terminal, and the rest may be located on the server side, which is not specifically limited in the embodiment of the present invention.
  • terminals involved in the embodiments of the present invention may include, but are not limited to, a personal computer (PC), a personal digital assistant (PDA), a wireless handheld device, a tablet computer, and a tablet computer.
  • PC personal computer
  • PDA personal digital assistant
  • Mobile phones MP3 players, MP4 players, etc.
  • the application may be an application (nativeApp) installed on the terminal, or may be a web application (webApp) of the browser on the terminal, which is not limited by the embodiment of the present invention.
  • the method for obtaining the IP address corresponding to the uniform resource locator URL accessed by the client in S101 is specifically described as a method for detecting the IP address.
  • the step may specifically include:
  • FIG. 2 is a system architecture diagram of a method for detecting malicious behavior according to an embodiment of the present invention.
  • the execution body of S101 can be a client, or can also be a server. If the executor of the S101 is the client, the IP address corresponding to the URL accessed by the client may be obtained by the client as the IP address to be detected. If the execution entity of S101 is a server, the client accesses the client access. The IP address corresponding to the URL is used as the IP address to be detected, and then the client further obtains the IP address to be detected and sends the IP address to the server, so that the server can receive the to-be-detected sent by the client. IP address.
  • the method for the client to obtain the IP address corresponding to the accessed URL may include, but is not limited to, the following two types:
  • the first type the client sends a query request to the Domain Name System (DNS) according to the URL requested by the user.
  • DNS Domain Name System
  • the domain name system After receiving the query request, the domain name system obtains the domain name from the URL, and then queries in the mapping relationship between the domain name and the IP address stored in the domain name to obtain the IP address corresponding to the domain name included in the URL, and the domain name system.
  • the queried IP address is returned to the client, and the IP address can be used as the IP address corresponding to the URL accessed by the client.
  • the client can initiate a Hyper Text Transfer Protocol (HTTP) request for the URL according to the URL requested by the user.
  • HTTP Hyper Text Transfer Protocol
  • the server that provides the page resource indicated by the URL obtains the page resource and the IP address according to the URL accessed by the request, and then packages the page resource and the IP address and sends the page resource and the IP address to the client.
  • the client can obtain the IP address corresponding to the accessed URL from the received data packet.
  • the method for performing the malicious behavior detection on the IP address to be detected in S102 to obtain the detection result is specifically described in the embodiment of the present invention.
  • the step may specifically include:
  • the execution body of S102 can be a client, or can also be a server. If the execution entity of S101 is a server, then The execution body of S102 can be a server.
  • the method for performing malicious behavior detection on the IP address to be detected to obtain the detection result may include, but is not limited to:
  • the IP address reputation database is queried according to the IP address to be detected to obtain a reputation score of the IP address to be detected. Then, according to the reputation score of the IP address to be detected, the detection result of the malicious behavior detection of the IP address to be detected is obtained.
  • the IP address reputation database needs to be generated in advance.
  • the IP address reputation database is generated by a server.
  • the server needs to send the IP address reputation database to the client, so as to facilitate the After obtaining the IP address to be detected, the client may query the IP address reputation database to obtain the reputation score of the IP address to be detected.
  • the server may directly receive the IP address to be detected sent by the client after generating the IP address reputation database. The IP address reputation database is queried to obtain a reputation score of the IP address to be detected.
  • the method for the server to generate the IP address reputation database may include, but is not limited to:
  • the server collects a malicious IP address. Then, the server obtains a reputation score of the malicious IP address according to at least one of a collection source of the malicious IP address and a data update frequency of the collection source. Finally, the server corresponds to storing a reputation score of a normal IP address and a normal IP address, the malicious IP address, and the malicious IP address. Reputation scores to generate the IP address reputation library.
  • the malicious IP address may include, but is not limited to, the following types of IP addresses: the IP address of the botnet C&C, the IP address of the download source of the malicious code, the IP address corresponding to the phishing website, and the IP of the malicious scanning source. Address, IP address of spammer, etc.
  • the server may use the data platform and the third-party data platform related to itself as the collection source of the malicious IP address, and then collect the malicious IP from the data platform related to itself and the third-party data platform. address.
  • the third-party data platform may include, but is not limited to, common data such as: Virustotal, Clean MX, Malc0de, Malware Domain List, OpenBL, Phishtank, Spy Eye Tracker, The Spamhaus Project, Zeus Tracker, Brute Force Blocker, Chaos Reigns, and the like. platform.
  • common data such as: Virustotal, Clean MX, Malc0de, Malware Domain List, OpenBL, Phishtank, Spy Eye Tracker, The Spamhaus Project, Zeus Tracker, Brute Force Blocker, Chaos Reigns, and the like. platform.
  • the server may periodically collect the malicious IP address from the collection source according to a preset data update frequency to implement updating of the malicious IP address in the IP address reputation database.
  • the data update frequency of different acquisition sources may be the same or different. For example, some collection sources can be updated on an hourly basis, some collection sources can be updated on a daily basis, and some collection sources can be updated on a weekly basis.
  • the method for obtaining the reputation score of the malicious IP address by the server according to the source of the malicious IP address and the data update frequency of the collection source may include, but is not limited to:
  • the initial score of each malicious IP address collected is 50 points. You can first increase the score based on the initial score of the malicious IP address based on the source of the malicious IP data.
  • the reputation score of the malicious IP address is increased by 15 points based on the initial score; if the source of the malicious IP address is one of the third-party data platforms, the reputation of the malicious IP address is divided. The value is increased by 10 points based on the initial score; if the source of the malicious IP address is at least two of the third-party data platforms, it indicates that the malicious IP address is considered to be a malicious IP in at least two data platforms.
  • the address, the reputation score of the malicious IP address is increased by 30 points based on the initial score.
  • the frequency of the data of the collected source may be updated to increase the reputation score of the malicious IP address.
  • the reputation score of the malicious IP address can be further increased by 10 points. If the data update frequency of the source of the malicious IP address is updated on a daily basis, the reputation score of the malicious IP address can be further increased by 5 points. If the data update frequency of the source of the malicious IP address is updated on a weekly basis or for a longer period of time, the reputation score of the malicious IP address is not increased. If the malicious IP address is collected as a malicious IP address when the update is performed for 30 days, the reputation score of the malicious IP address may be further increased by 15 points. In this way, the reputation score of the malicious IP address can be obtained by using any of the above two methods for increasing the score, or the two methods for increasing the score can be used together to obtain the reputation score of the malicious IP address.
  • the reputation score of the malicious IP address in the IP address reputation database does not change within the validity period, after the validity period, the The reputation score of the malicious IP address.
  • the validity period of the reputation score is set to 30 days. If the reputation score of a malicious IP address in the IP address reputation database does not change within 30 days, after 30 days, the score may be increased according to the previously added score. The reputation score of the malicious IP address is decremented.
  • the minimum value of the reputation score of the malicious IP address is 1, and may not be decremented to 0. The reason is that in the embodiment of the present invention, the reputation score of the normal IP address can be set to 0, and the malicious IP address that has appeared, even if its reputation score is already reduced, cannot be regarded as a normal IP address, so its reputation The score cannot be reduced to zero.
  • the reputation score of the malicious IP address and the obtained malicious IP address is correspondingly stored to generate the IP address reputation database.
  • the generated IP address reputation database also needs to include a correspondence between a normal IP address and a reputation score of a normal IP address.
  • the normal IP address can be collected manually and a reputation score is configured for the normal IP address.
  • the reputation score of the normal IP address can be configured as 0. In this way, the reputation score of the normal IP address and the normal IP address can be correspondingly stored in the IP address reputation database.
  • the method for obtaining the detection result of the malicious behavior detection of the IP address to be detected according to the reputation score of the IP address to be detected may include, but is not limited to:
  • the IP address to be detected belongs to the whitelist, and the IP address to be detected is determined.
  • the detection result of the malicious behavior is that the IP address to be detected is a normal IP address. If the reputation score of the IP address to be detected is greater than 0 and less than or equal to 50, the detection result of the malicious behavior of the IP address to be detected is that the IP address to be detected is an unknown IP address. If the reputation score of the IP address to be detected is greater than 50 minutes and less than 75 minutes, the detection result of the malicious behavior of the IP address to be detected is that the IP address to be detected is a suspected malicious IP address.
  • the detection result of the malicious behavior of the IP address to be detected is that the IP address to be detected is a malicious IP address.
  • the step may specifically include:
  • the server outputs a detection result of the malicious behavior detection of the IP address to be detected to the client.
  • the detection result is that the IP address to be detected belongs to a malicious IP address
  • the client may display prompt information to the user, where the prompt information is used to indicate that the user performs a corresponding operation, for example, the access to the malicious IP address may be stopped.
  • the corresponding URL may be displayed.
  • the client may not display the prompt information to the user, and may continue to access the URL corresponding to the IP address to be detected.
  • the server may send the client to the client.
  • the end outputs the detection result.
  • the server may not output the detection result.
  • the client may display a prompt message to the user.
  • the prompt information is used to indicate that the user performs a corresponding operation, for example, the URL corresponding to the malicious IP address may be stopped.
  • the detection result is that the IP address to be detected belongs to a normal IP address or an unknown IP address
  • the guest may not display the prompt information to the user, and may continue to access the URL corresponding to the IP address to be detected.
  • the client may display a prompt message to the user through a pop-up prompt.
  • Embodiments of the present invention further provide an apparatus embodiment for implementing the steps and methods in the foregoing method embodiments.
  • FIG. 3 is a functional block diagram of a malicious behavior detecting system according to an embodiment of the present invention. As shown, the system includes:
  • the obtaining unit 30 is configured to obtain a network interconnection protocol IP address corresponding to the uniform resource locator URL accessed by the client, as the IP address to be detected;
  • the detecting unit 31 is configured to perform malicious behavior detection on the IP address to be detected to obtain a detection result.
  • the detecting unit 31 is specifically configured to:
  • system further includes:
  • the collecting unit 32 is configured to collect a malicious IP address.
  • the calculating unit 33 is configured to obtain a reputation score of the malicious IP address according to at least one of an acquisition source of the malicious IP address and a data update frequency of the collection source;
  • the storage unit 34 is configured to correspondingly store a reputation score of a normal IP address and a normal IP address, a reputation score of the malicious IP address and the malicious IP address, to generate the IP address reputation database.
  • the calculating unit 33 is further configured to:
  • the reputation score of the malicious IP address in the IP address reputation database does not change within the validity period, after the validity period, the reputation score of the malicious IP address is lowered.
  • system further includes:
  • the output unit 35 is configured to: if the detection result is that the IP address to be detected belongs to a malicious IP address, display prompt information, where the prompt information is used to indicate that the user performs a corresponding operation; or, if the detection result is the The IP address to be detected belongs to a normal IP address or an unknown IP address. The prompt message is not displayed.
  • the IP address of the network interconnection protocol corresponding to the Uniform Resource Locator URL accessed by the client is obtained as the IP address to be detected; thus, the malicious behavior detection of the IP address to be detected is performed to obtain Test results.
  • the technical solution provided by the embodiment of the present invention can detect the malicious behavior by using the IP address, and the detection of the malicious behavior is performed for the IP address. Therefore, the attacker can continuously replace the domain name or update the malicious file content in the prior art. In order to avoid the problem of detection of malicious behavior, the technical solution provided by the embodiments of the present invention can improve the detection rate of malicious behavior.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined. Or it can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
  • the above software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present invention. Part of the steps.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种恶意行为的检测方法、系统、设备和计算机存储介质。一方面，本发明实施例通过获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；从而，对所述待检测IP地址进行恶意行为检测，以获得检测结果。因此，本发明实施例提供的技术方案利用IP地址实现恶意行为的检测，用以解决现有技术中利用不断更换域名或者更新恶意文件内容来躲避恶意行为的检测的问题，能够提高恶意行为的检出率。

Description

一种恶意行为的检测方法、系统、设备及计算机存储介质
本申请要求了申请日为2015年06月30日，申请号为201510386083.7，发明名称为“一种恶意行为的检测方法及系统”的中国专利申请的优先权。
技术领域
本发明涉及计算机技术领域，尤其涉及一种恶意行为的检测方法、系统、设备及计算机存储介质。
背景技术
随着互联网技术的快速发展，网络中出现了大量的恶意攻击行为。攻击者使用物理设备并利用网络上获取到的资源，在网络上开展恶意攻击行为，如进行僵尸网络的自动更新下载、恶意代码的自动更新下载、网络钓鱼、使用网络自动化扫描器或者垃圾邮件自动发送等。
现有技术中是利用传统的检测软件来对恶意行为进行检测，如杀毒软件收集攻击者所使用的统一资源定位符(Uniform Resource Locator，URL)和恶意文件，然后对URL和恶意文件进行恶意行为的检测。然而，攻击者会通过不断的更换URL的域名或者更新恶意文件的内容等手段，来躲避杀毒软件的检测，降低了恶意行为的检出率。
发明内容
有鉴于此，本发明实施例提供了一种恶意行为的检测方法、系统、设备和计算机存储介质，用以解决现有技术中利用不断更换域名或者更新恶意文件内容来躲避恶意行为的检测的问题，能够提高恶意行为的检出率。
本发明实施例的一方面，提供一种恶意行为的检测方法，包括：
获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
对所述待检测IP地址进行恶意行为检测，以获得检测结果。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述对所述待检测IP地址进行恶意行为检测，以获得检测结果，包括：
根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值；
根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值之前，所述方法还包括：
采集恶意IP地址；
根据所述恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值；
对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的信誉分值，以生成所述IP地址信誉库。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述方法还包括：
根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式， 所述方法还包括：
若所述检测结果为所述待检测IP地址属于恶意IP地址，显示提示信息，所述提示信息用以指示用户进行相应的操作；或者，
若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，不显示提示信息。
本发明实施例的一方面，提供一种恶意行为的检测系统，包括：
获取单元，用于获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
检测单元，用于对所述待检测IP地址进行恶意行为检测，以获得检测结果。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述检测单元，具体用于：
根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值；
根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述系统还包括：
采集单元，用于采集恶意IP地址；
计算单元，用于根据所述恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值；
存储单元，用于对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的信誉分值，以生成所述IP地址信 誉库。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述计算单元，还用于：
根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述系统还包括：
输出单元，用于若所述检测结果为所述待检测IP地址属于恶意IP地址，显示提示信息，所述提示信息用以指示用户进行相应的操作；或者，若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，不显示提示信息。
由以上技术方案可以看出，本发明实施例具有以下有益效果：
本发明实施例提供的技术方案，能够利用IP地址来实现恶意行为的检测，恶意行为的检测是针对IP地址进行的，因此，能够解决现有技术中攻击者通过不断更换域名或者更新恶意文件内容来躲避恶意行为的检测的问题，因此，本发明实施例所提供的技术方案能够提高恶意行为的检出率。
附图说明
图1是本发明实施例所提供的恶意行为的检测方法的流程示意图；
图2是本发明实施例所提供恶意行为的检测方法的系统架构图；
图3是本发明实施例所提供的恶意行为的检测系统的功能方块图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面结合附图和具体实施例对本发明进行详细描述。
应当明确，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
在本发明实施例中使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本发明。在本发明实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。
应当理解，本文中使用的术语“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”或“响应于检测”。类似地，取决于语境，短语“如果确定”或“如果检测(陈述的条件或事件)”可以被解释成为“当确定时”或“响应于确定”或“当检测(陈述的条件或事件)时”或“响应于检测(陈述的条件或事件)”。
实施例一
本发明实施例给出一种恶意行为的检测方法，请参考图1，其为本发明实施例所提供的恶意行为的检测方法的流程示意图，如图所示，该方法包括以下步骤：
S101，获取客户端访问的URL所对应的IP地址，以作为待检测IP 地址。
S102，对所述待检测IP地址进行恶意行为检测，以获得检测结果。
需要说明的是，S101～S102的执行主体可以为恶意行为的检测系统，该系统可以位于本地终端的应用，或者还可以为位于本地终端的应用中的插件或软件开发工具包(Software Development Kit，SDK)等功能单元，或者还可以位于服务器侧，或者还可以部分位于本地终端，其余部分位于服务器侧，本发明实施例对此不进行特别限定。
需要说明的是，本发明实施例中所涉及的终端可以包括但不限于个人计算机(Personal Computer，PC)、个人数字助理(Personal Digital Assistant，PDA)、无线手持设备、平板电脑(Tablet Computer)、手机、MP3播放器、MP4播放器等。
可以理解的是，所述应用可以是安装在终端上的应用程序(nativeApp)，或者还可以是终端上的浏览器的一个网页程序(webApp)，本发明实施例对此不进行限定。
实施例二
基于上述实施例一所提供的恶意行为的检测方法，本发明实施例对S101中获取客户端访问的统一资源定位符URL所对应的IP地址，以作为待检测IP地址的方法进行具体描述。该步骤具体可以包括：
请参考图2，其为本发明实施例所提供恶意行为的检测方法的系统架构图。可以理解的是，如图2所示，S101的执行主体可以为客户端，或者也可以为服务器。其中，若S101的执行主体为客户端，则可以由客户端获取所述客户端访问的URL所对应的IP地址，以作为待检测IP地址。若S101的执行主体为服务器，则由客户端获取所述客户端访问的 URL所对应的IP地址，以作为待检测IP地址，然后所述客户端进一步将获取所述待检测IP地址发送给所述服务器，这样，所述服务器就可以接收所述客户端发送的待检测IP地址。
举例说明，本发明实施例中，所述客户端获取访问的URL所对应的IP地址的方法可以包括但不限于以下两种：
第一种：所述客户端根据用户请求访问的URL，向域名系统(Domain Name System，DNS)发送查询请求。收到所述查询请求后，所述域名系统从该URL中获取域名，进而在自身存储的域名与IP地址的映射关系中进行查询，以获得URL中包含的域名所对应的IP地址，域名系统将查询到的IP地址返回给所述客户端，该IP地址可以作为客户端访问的URL所对应的IP地址。
第二种：所述客户端可以根据用户请求访问的URL，发起针对该URL的超文本传输协议(Hyper Text Transfer Protocol，HTTP)请求。提供该URL所指示的页面资源的服务器在收到HTTP请求后，根据请求访问的URL获得页面资源和IP地址，然后将页面资源和IP地址打包后发送给所述客户端。这样，所述客户端就可以从接收到的数据包中获得访问的URL所对应的IP地址。
实施例三
基于上述实施例一所提供的恶意行为的检测方法和实施例二，本发明实施例对S102中对所述待检测IP地址进行恶意行为检测，以获得检测结果的方法进行具体描述。该步骤具体可以包括：
可以理解的是，若S101的执行主体为客户端，S102的执行主体可以为客户端，或者也可以为服务器。若S101的执行主体为服务器，则 S102的执行主体可以为服务器。
举例说明，对所述待检测IP地址进行恶意行为检测，以获得检测结果的方法可以包括但不限于：
首先，根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值。然后，根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
在一个具体的实现过程中，在根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值之前，需要预先生成所述IP地址信誉库。
需要说明的是，本发明实施例中，由服务器生成所述IP地址信誉库。
在一个具体的实现过程中，若S102的执行主体为客户端，则所述服务器在生成所述IP地址信誉库后，需要将所述IP地址信誉库发送给所述客户端，以便于所述客户端可以在获得待检测IP地址后，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值。或者，如图2所示，若S102的执行主体为服务器，则所述服务器可以在生成所述IP地址信誉库后，若收到所述客户端发送的所述待检测IP地址，则可以直接查询IP地址信誉库，以获得所述待检测IP地址的信誉分值。
举例说明，本发明实施中，所述服务器生成所述IP地址信誉库的方法可以包括但不限于：
如图2所示，首先，所述服务器采集恶意IP地址。然后，所述服务器根据恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值。最后，所述服务器对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的 信誉分值，以生成所述IP地址信誉库。
可以理解的是，所述恶意IP地址可以包括但不限于以下类型的IP地址：僵尸网络C&C的IP地址、恶意代码的下载源的IP地址、钓鱼网址所对应的IP地址、恶意扫描源的IP地址、垃圾邮件发送者的IP地址等。
在一个具体的实现过程中，所述服务器可以将与自身相关的数据平台和第三方数据平台作为恶意IP地址的采集来源，进而从与自身相关的数据平台以及第三方数据平台采集所述恶意IP地址。
例如，所述第三方数据平台可以包括但不限于：Virustotal、Clean MX、Malc0de、Malware Domain List、OpenBL、Phishtank、Spy Eye Tracker、The Spamhaus Project、Zeus Tracker、Brute Force Blocker、Chaos Reigns等常见的数据平台。
在一个具体的实现过程中，所述服务器可以根据预设的数据更新频率，周期性的从采集来源采集所述恶意IP地址，以实现所述IP地址信誉库中恶意IP地址的更新。然而，不同的采集来源的数据更新频率可以相同，也可以不同。例如，有的采集来源可以按小时进行更新，有的采集来源可以按天进行更新，有的采集来源可以按周进行更新。
举例说明，所述服务器根据恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值的方法可以包括但不限于：
采集的每个恶意IP地址的初始分值为50分，可以先根据恶意IP数据的采集来源，在恶意IP地址的初始分值的基础上增加分值。
例如，如果某恶意IP地址是从与服务器相关的数据平台采集的恶意 IP地址，则该恶意IP地址的信誉分值在初始分值的基础上增加15分；如果某恶意IP地址的采集来源是所述第三方数据平台中的一个，则该恶意IP地址的信誉分值在初始分值的基础上增加10分；如果某恶意IP地址的采集来源是所述第三方数据平台中的至少两个，表示该恶意IP地址在至少两个数据平台中被认定是恶意IP地址，则该恶意IP地址的信誉分值在初始分值的基础上增加30分。
进一步的，还可以根据采集来源的数据更新频率，增加恶意IP地址的信誉分值。
例如，如果恶意IP地址的采集来源的数据更新频率是按小时进行更新，则该恶意IP地址的信誉分值可以再增加10分。如果恶意IP地址的采集来源的数据更新频率是按天进行更新，则该恶意IP地址的信誉分值可以再增加5分。如果恶意IP地址的采集来源的数据更新频率是按周或者按照更长时间进行更新，则不增加该恶意IP地址的信誉分值。若该恶意IP地址连接30天在进行更新时被采集为恶意IP地址，则该恶意IP地址的信誉分值可以再增加15分。如此，利用上述两种增加分值的方法中任意一种可以获得恶意IP地址的信誉分值，也可以两种增加分值的方法一起使用，来获得恶意IP地址的信誉分值。
在一个具体的实现过程中，还可以根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
例如，所述信誉分值的有效期设为30天，若IP地址信誉库中某恶意IP地址的信誉分值在30天内都没有发生变化，在30天后，可以根据之前增加的分值，对所述恶意IP地址的信誉分值进行递减。
需要说明的是，所述恶意IP地址的信誉分值的最小值为1，不可以递减为0。其原因是本发明实施例中，可以将正常IP地址的信誉分值设置为0，而出现过的恶意IP地址，即使其信誉分值已经在减少，但是也不能作为正常IP地址，因此其信誉分值不能减到0。
在一个具体的实现过程中，对应存储所述恶意IP地址以及获得的所述恶意IP地址的信誉分值，以生成所述IP地址信誉库。另外，生成的所述IP地址信誉库还需要包含正常IP地址与正常IP地址的信誉分值的对应关系。
优选的，所述正常IP地址可以由人工进行采集，并为正常IP地址配置信誉分值，如正常IP地址的信誉分值可以配置为0。这样，就可以所述IP地址信誉库中就可以对应存储正常IP地址与正常IP地址的信誉分值。
举例说明，本发明实施例中，根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果的方法可以包括但不限于：
以待检测IP地址的信誉分值在0～100范围内为例，若所述待检测IP地址的信誉分值等于0，表示所述待检测IP地址属于白名单，确定所述待检测IP地址的恶意行为的检测结果为所述待检测IP地址为正常IP地址。若所述待检测IP地址的信誉分值大于0且小于或者等于50分，所述待检测IP地址的恶意行为的检测结果为所述待检测IP地址为未知IP地址。若所述待检测IP地址的信誉分值大于50分且小于75分，所述待检测IP地址的恶意行为的检测结果为所述待检测IP地址为疑似恶意IP地址。若所述待检测IP地址的信誉分值大于或者等于75分且小于或者 等于100分，表示所述待检测IP地址属于黑名单，确定所述待检测IP地址的恶意行为的检测结果为所述待检测IP地址为恶意IP地址。
实施例四
基于上述实施例一所提供的恶意行为的检测方法、实施例二和实施例三，对恶意行为的检测方法的可选步骤进行具体描述。该步骤具体可以包括：
如图2所示，在一个具体的实现过程中，若S102的执行主体为服务器，则本步骤中，所述服务器向所述客户端输出所述待检测IP地址的恶意行为检测的检测结果。若所述检测结果为所述待检测IP地址属于恶意IP地址，所述客户端可以向用户显示提示信息，所述提示信息用以指示用户进行相应的操作，例如可以停止访问该恶意IP地址所对应的URL。或者，若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，所述客户端可以不向用户显示提示信息，可以继续访问该待检测IP地址所对应的URL。
需要说明的是，若所述服务器获得所述待检测IP地址的恶意行为的检测结果，当所述检测结果是恶意IP地址、未知IP地址或者正常IP地址时，所述服务器可以向所述客户端输出所述检测结果。当所述检测结果是未知IP地址时，所述服务器可以不输出所述检测结果。
在一个具体的实现过程中，若S102的执行主体为客户端，则本步骤中，若所述检测结果为所述待检测IP地址属于恶意IP地址，所述客户端可以向用户显示提示信息，所述提示信息用以指示用户进行相应的操作，例如可以停止访问该恶意IP地址所对应的URL。或者，若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，所述客 户端可以不向用户显示提示信息，可以继续访问该待检测IP地址所对应的URL。
例如，所述客户端可以通过弹窗提示方式向用户显示提示信息。
本发明实施例进一步给出实现上述方法实施例中各步骤及方法的装置实施例。
请参考图3，其为本发明实施例所提供的恶意行为的检测系统的功能方块图。如图所示，该系统包括：
获取单元30，用于获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
检测单元31，用于对所述待检测IP地址进行恶意行为检测，以获得检测结果。
优选的，所述检测单元31，具体用于：
根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值；
根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
可选的，所述系统还包括：
采集单元32，用于采集恶意IP地址；
计算单元33，用于根据所述恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值；
存储单元34，用于对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的信誉分值，以生成所述IP地址信誉库。
可选的，所述计算单元33，还用于：
根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
可选的，所述系统还包括：
输出单元35，用于若所述检测结果为所述待检测IP地址属于恶意IP地址，显示提示信息，所述提示信息用以指示用户进行相应的操作；或者，若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，不显示提示信息。
由于本实施例中的各单元能够执行图1所示的方法，本实施例未详细描述的部分，可参考对图1的相关说明。
本发明实施例的技术方案具有以下有益效果：
本发明实施例中，通过获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；从而，对所述待检测IP地址进行恶意行为检测，以获得检测结果。
本发明实施例提供的技术方案，能够利用IP地址来实现恶意行为的检测，恶意行为的检测是针对IP地址进行的，因此，能够解决现有技术中攻击者通过不断更换域名或者更新恶意文件内容来躲避恶意行为的检测的问题，因此，本发明实施例所提供的技术方案能够提高恶意行为的检出率。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本发明所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机装置(可以是个人计算机，服务器，或者网络装置等)或处理器(Processor)执行本发明各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明保护的范围之内。

Claims (12)

  1. 一种恶意行为的检测方法，其特征在于，所述方法包括：
    获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
    对所述待检测IP地址进行恶意行为检测，以获得检测结果。
  2. 根据权利要求1所述的方法，其特征在于，所述对所述待检测IP地址进行恶意行为检测，以获得检测结果，包括：
    根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值；
    根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    采集恶意IP地址；
    根据所述恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值；
    对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的信誉分值，以生成所述IP地址信誉库。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    若所述检测结果为所述待检测IP地址属于恶意IP地址，显示提示信息，所述提示信息用以指示用户进行相应的操作；或者，
    若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，不显示提示信息。
  6. 一种恶意行为的检测系统，其特征在于，所述系统包括：
    获取单元，用于获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
    检测单元，用于对所述待检测IP地址进行恶意行为检测，以获得检测结果。
  7. 根据权利要求6所述的系统，其特征在于，所述检测单元，具体用于：
    根据所述待检测IP地址，查询IP地址信誉库，以获得所述待检测IP地址的信誉分值；
    根据所述待检测IP地址的信誉分值，获得所述待检测IP地址的恶意行为检测的检测结果。
  8. 根据权利要求7所述的系统，其特征在于，所述系统还包括：
    采集单元，用于采集恶意IP地址；
    计算单元，用于根据所述恶意IP地址的采集来源和采集来源的数据更新频率中至少一个，获得所述恶意IP地址的信誉分值；
    存储单元，用于对应存储正常IP地址与正常IP地址的信誉分值、所述恶意IP地址与所述恶意IP地址的信誉分值，以生成所述IP地址信誉库。
  9. 根据权利要求8所述的系统，其特征在于，所述计算单元，还用 于：
    根据信誉分值的有效期，若所述IP地址信誉库中恶意IP地址的信誉分值在所述有效期内没有发生变化，在所述有效期之后，降低所述恶意IP地址的信誉分值。
  10. 根据权利要求6至9中任一项所述的系统，其特征在于，所述系统还包括：
    输出单元，用于若所述检测结果为所述待检测IP地址属于恶意IP地址，显示提示信息，所述提示信息用以指示用户进行相应的操作；或者，若所述检测结果为所述待检测IP地址属于正常IP地址或者未知IP地址，不显示提示信息。
  11. 一种设备，包括：
    一个或多个处理器；
    存储器；
    一个或多个程序，所述一个或多个程序存储在所述存储器中，当被所述一个或多个处理器执行时，执行以下操作：
    获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
    对所述待检测IP地址进行恶意行为检测，以获得检测结果。
  12. 一种非易失性计算机存储介质，所述计算机存储介质存储有一个或多个程序，当所述一个或多个程序被一个设备执行时，使得所述设备执行以下操作：
    获取客户端访问的统一资源定位符URL所对应的网络互连协议IP地址，以作为待检测IP地址；
    对所述待检测IP地址进行恶意行为检测，以获得检测结果。
PCT/CN2015/092567 2015-06-30 2015-10-22 一种恶意行为的检测方法、系统、设备及计算机存储介质 WO2017000439A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/528,291 US20170318041A1 (en) 2015-06-30 2015-10-22 Method and system for detecting malicious behavior, apparatus and computer storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510386083.7A CN104980446A (zh) 2015-06-30 2015-06-30 一种恶意行为的检测方法及系统
CN201510386083.7 2015-06-30

Publications (1)

Publication Number Publication Date
WO2017000439A1 true WO2017000439A1 (zh) 2017-01-05

Family

ID=54276549

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/092567 WO2017000439A1 (zh) 2015-06-30 2015-10-22 一种恶意行为的检测方法、系统、设备及计算机存储介质

Country Status (3)

Country Link
US (1) US20170318041A1 (zh)
CN (1) CN104980446A (zh)
WO (1) WO2017000439A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10848502B2 (en) * 2015-12-01 2020-11-24 Webroot Inc. Detection and prevention of hostile network traffic flow appropriation and validation of firmware updates
CN106912039B (zh) * 2015-12-23 2020-07-07 北京奇虎科技有限公司 无线网络的网络配置检测修复方法及装置
CN106912064B (zh) * 2015-12-23 2020-08-14 北京奇虎科技有限公司 无线网络的网络配置检测修复方法及装置
CN105959294B (zh) * 2016-06-17 2019-06-14 北京网康科技有限公司 一种恶意域名鉴别方法及装置
CN106302534B (zh) * 2016-09-30 2019-05-28 微梦创科网络科技（中国）有限公司 一种检测和处理非法用户的方法及系统
CN107612946B (zh) * 2017-11-03 2021-09-03 北京奇艺世纪科技有限公司 Ip地址的检测方法、检测装置和电子设备
CN108847962B (zh) * 2018-05-30 2022-01-07 新华三信息安全技术有限公司 一种信息审计方法及装置
CN109635215B (zh) * 2018-12-21 2021-02-19 百度在线网络技术（北京）有限公司 编码安全检测方法、装置、终端及可读存储介质
CN109617915B (zh) * 2019-01-15 2020-12-15 成都知道创宇信息技术有限公司 一种基于页面访问拓扑的异常用户挖掘方法
CN109617914A (zh) * 2019-01-15 2019-04-12 成都知道创宇信息技术有限公司 一种基于ip征信的云安全防护方法
CN110247916B (zh) * 2019-06-20 2021-07-27 四川长虹电器股份有限公司 恶意域名检测方法
CN110572416A (zh) * 2019-10-15 2019-12-13 赛尔网络有限公司 黑名单生成方法、装置、电子设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102663000A (zh) * 2012-03-15 2012-09-12 北京百度网讯科技有限公司 恶意网址数据库的建立方法、恶意网址的识别方法和装置
CN102739653A (zh) * 2012-06-06 2012-10-17 奇智软件（北京）有限公司 一种针对网址的检测方法及装置
CN103023905A (zh) * 2012-12-20 2013-04-03 北京奇虎科技有限公司 一种用于检测恶意链接的设备、方法及系统
CN103442361A (zh) * 2013-09-09 2013-12-11 北京网秦天下科技有限公司 移动应用的安全性检测方法及移动终端
CN104219230A (zh) * 2014-08-21 2014-12-17 腾讯科技（深圳）有限公司 识别恶意网站的方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070011744A1 (en) * 2005-07-11 2007-01-11 Cox Communications Methods and systems for providing security from malicious software
US20130007882A1 (en) * 2011-06-28 2013-01-03 The Go Daddy Group, Inc. Methods of detecting and removing bidirectional network traffic malware
US9270693B2 (en) * 2013-09-19 2016-02-23 The Boeing Company Detection of infected network devices and fast-flux networks by tracking URL and DNS resolution changes
US9769198B1 (en) * 2014-03-31 2017-09-19 Juniper Networks, Inc. Malware detection using internal and/or external malware detection operations
US9202249B1 (en) * 2014-07-03 2015-12-01 Palantir Technologies Inc. Data item clustering and analysis
KR101547999B1 (ko) * 2014-09-02 2015-08-27 한국전자통신연구원 악성링크 자동 탐지 장치 및 방법
US10154049B2 (en) * 2015-05-13 2018-12-11 Preempt Security, Inc. System and method for providing an in-line sniffer mode network based identity centric firewall

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102663000A (zh) * 2012-03-15 2012-09-12 北京百度网讯科技有限公司 恶意网址数据库的建立方法、恶意网址的识别方法和装置
CN102739653A (zh) * 2012-06-06 2012-10-17 奇智软件（北京）有限公司 一种针对网址的检测方法及装置
CN103023905A (zh) * 2012-12-20 2013-04-03 北京奇虎科技有限公司 一种用于检测恶意链接的设备、方法及系统
CN103442361A (zh) * 2013-09-09 2013-12-11 北京网秦天下科技有限公司 移动应用的安全性检测方法及移动终端
CN104219230A (zh) * 2014-08-21 2014-12-17 腾讯科技（深圳）有限公司 识别恶意网站的方法及装置

Also Published As

Publication number Publication date
CN104980446A (zh) 2015-10-14
US20170318041A1 (en) 2017-11-02

Similar Documents

Publication Publication Date Title
WO2017000439A1 (zh) 一种恶意行为的检测方法、系统、设备及计算机存储介质
US11343269B2 (en) Techniques for detecting domain threats
US10084814B2 (en) Analyzing DNS requests for anomaly detection
US10135766B2 (en) System and method for evaluating domains to send emails while maintaining sender reputation
US9503468B1 (en) Detecting suspicious web traffic from an enterprise network
US20180027291A1 (en) Information interception processing method, terminal, and computer storage medium
US8347396B2 (en) Protect sensitive content for human-only consumption
WO2017114205A1 (zh) 短链接处理方法、装置及服务器
US8627469B1 (en) Systems and methods for using acquisitional contexts to prevent false-positive malware classifications
WO2017114206A1 (zh) 短链接处理方法、装置及短链接服务器
US9225731B2 (en) System for detecting the presence of rogue domain name service providers through passive monitoring
WO2016101635A1 (zh) 一种同步登录状态的方法、装置、设备和计算机存储介质
US11681757B2 (en) Similar email spam detection
US10356050B1 (en) Mitigation of data leakage in HTTP headers
US8782157B1 (en) Distributed comment moderation
TW201414260A (zh) 惡意訊息之偵測及處理
EP3852327A1 (en) Exception access behavior identification method and server
US10122722B2 (en) Resource classification using resource requests
US10326731B2 (en) Domain name service information propagation
CN108156270B (zh) 域名请求处理方法和装置
US20150222649A1 (en) Method and apparatus for processing a webpage
US20130339456A1 (en) Techniques to filter electronic mail based on language and country of origin
WO2017019717A1 (en) Dynamic attachment delivery in emails for advanced malicious content filtering
WO2014067360A1 (zh) 一种网络应用系统中的电子邮件收发方法和系统
WO2020019514A1 (zh) 一种注入漏洞检测方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15896967

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15528291

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15896967

Country of ref document: EP

Kind code of ref document: A1