基于文档分层表示的恶意网页快速检测方法  

Hierarchical Representation Approach to Fast Detection of Malicious Webpages

作　　者：袁梁[1] 林金芳 YUAN Liang;LIN Jin-Fang(Normal College,Wuxi City College of Vocational Technology,Wuxi 214153,China;Collcge of Systems Engineering,National University of Defense Technology,Changsha 410073,China)

机构地区：[1]无锡城市职业技术学院师范学院,无锡214153 [2]国防科技大学系统工程学院,长沙410073

出　　处：《计算机系统应用》2019年第12期226-231,共6页Computer Systems & Applications

基　　金：国家自然科学基金(91430214)~~

摘　　要：近年来,恶意网页检测主要依赖于语义分析或代码模拟执行来提取特征,但是这类方法实现复杂,需要高额的计算开销,并且增加了攻击面.为此,提出了一种基于深度学习的恶意网页检测方法,首先使用简单的正则表达式直接从静态HTML文档中提取与语义无关的标记,然后采用神经网络模型捕获文档在多个分层空间尺度上的局部性表示,实现了能够从任意长度的网页中快速找到微小恶意代码片段的能力.将该方法与多种基线模型和简化模型进行对比实验,结果表明该方法在0.1%的误报率下实现了96.4%的检测率,获得了更好的分类准确率.本方法的速度和准确性使其适合部署到端点、防火墙和Web代理中.In recent years,the web content detection mainly focuses on how to extract features from HTML document through semantic analysis or emulation execution,while it is undesirable,because it significantly complicates implementation which requires high computational overhead,and opens up an attack surface within the detector.A deep learning approach to detect malicious web pages is proposed.Firstly,we take advantage of the non-complex regular expression to extract tokens from static HTML document,then capture locality representation at multiple hierarchical spatial scales over the document with neural network model,by which the mode can quickly find tiny fragments of malicious code in any length of web pages.The experimental results show that this approach achieves a detection rate of 96.4%at a false positive rate of 0.1%,much better than the baseline and simplified model at the classification accuracy.The speed and accuracy of proposed approach makes it appropriate for deployment to endpoints,firewalls and web proxies.

关 键 词：深度学习 恶意Web内容 网页分类 恶意网页识别 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程] TP393.08[自动化与计算机技术—控制科学与工程]