摘要:随着Web应用的日益广泛，Web浏览过程中，恶意网页对用户造成的危害日趋严重.恶意URL是指其所对应的网页中含有对用户造成危害的恶意代码，会利用浏览器或插件存在的漏洞攻击用户，导致浏览器自动下载恶意软件.基于对大量存活恶意URL特征的统计分析，并重点结合了恶意URL的重定向跳转、客户端环境探测等逃避检测特征，从页面内容、JavaScript函数参数和Web会话流程这3个方面设计了25个特征，提出了基于多特征融合和机器学习的恶意URL检测方法——HADMW.测试结果表明：该方法取得了96.2%的精确率和94.6%的召回率，能够有效地检测恶意URL.与开源项目以及安全软件的检测结果相比，HADMW取得了更好的效果.



Abstract:With the popularity of Web applications, malicious webpages are increasingly harmful to users in the process of Web browsing. The malicious URL mentioned in this paper refers that the corresponding webpage contains malicious codes that are harmful to users. These malicious code exploits the vulnerabilities of browsers or plugins to attack users with download malware automatically. Based on the statistics and analysis of amounts of living malicious URL, and considering the anti-detection technologies being more used in malicious webpage such as the client environment detection and redirections, 25 features in three aspects are designed, namely, content of webpage, parameters of JavaScript function, and Web session flows. And a detection method-HADMW is proposed based on these 25 features and machine learning. The experimental results suggest that HADMW can achieve 96.2% accuracy and 94.6% recall rate, and it can detect malicious URL effectively. At the same time, compared with the detection results of open projects and security software, HADMW achieves better results.



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/5983