基于威胁情报和多分类器投票机制的恶意URL检测模型  

Malicious URL Detection Model Based on Threat Intelligence and Multi-classifier Voting Mechanism

作　　者：杨杉 肖治华 张成 YANG Shan;XIAO Zhihua;ZHANG Cheng(Information&Communication Branch of Hubei Electric Power Company,Wuhan 430077)

机构地区：[1]国网湖北省电力公司信息通信公司,武汉430077

出　　处：《计算机与数字工程》2020年第8期1969-1974,共6页Computer & Digital Engineering

摘　　要：随着互联网站点数量的飞速增加,访问Web页面的方式已经成为了民众获取信息的主要渠道,在此过程中也出现了大量的恶意URL,给正常信息维护与用户访问造成了严重的干扰,同时带来了巨大的损失。目前主流的黑名单防御机制滞后现象严重,防范效果较差,而机器学习技术虽然可极大地提高检测效率,但也存在特征单一、检测范围有限等问题。论文提出以威胁情报平台为基础,结合多分类器投票机制来提高检测准确度,设计并完善了相关的检测模型,同时实现了对威胁情报信息库的自动更新。With the rapid increase of Internet sites,the way to access Web pages has become the main channel for people to get information.In this process,a large number of malicious URLs have appeared,which has caused serious interference to normal information maintenance and user access,and also brought huge losses.As the mainstream detection method,blacklist mechanism has serious lag phenomenon and poor defense performance.Machine learning technology can greatly improve the detection efficien⁃cy,but there are also problems such as single features and limited detection range.In this paper,based on the threat intelligence platform,multi-classifier voting mechanism is combined to improve the detection accuracy,the relevant detection model is de⁃signed and improved.At the same time,it has also been realized the automatic update of the threat intelligence database.

关 键 词：威胁情报 结构特征 敏感词特征 分类器 混淆矩阵 投票机制 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]