WO2014032619A1 - Web address access method and system - Google Patents

Description

 Website access method and system

 The present invention relates to the field of network technologies, and in particular, to a method and system for accessing a website. Background technique

 More than 70% of all Trojan horses and malware transmissions come from web browsing. The main methods include webpage hanging, phishing, malicious downloading, etc. Various malicious websites have seriously threatened users. Personal information security, national information security and the healthy development of the Internet, so real-time interception of malicious websites is an essential function of information security vendors.

 The prior art malicious URL library exists in the local client, and the malicious website on the Internet is constantly updated and changed, and the generation of the malicious URL library needs to be continuously updated. The existing technology needs to rely on the local client to continuously upgrade the new local malicious website. The library can guarantee the interception effect of malicious URLs. However, the upgrade time period of local malicious URLs is too long, and there is often a lag. It is impossible to update all kinds of malicious websites on the Internet in an timely manner, which makes it impossible to intercept malicious websites quickly and effectively. Summary of the invention

 In view of the above problems, the present invention has been made in order to provide a web site access method and corresponding web site access system that overcomes the above problems or at least partially solves the above problems.

 According to an aspect of the present invention, a method for accessing a web address is provided, including:

 The client obtains the URL information corresponding to the URL requested to be accessed;

 The client extracts a website ciphertext according to the website information;

 The client submits the website ciphertext to the server;

 The server matches the website ciphertext with the ciphertext stored in the database;

 If the ciphertext of the webpage matches the ciphertext of the database marked as a malicious webpage, the malicious webpage query result is returned to the client; the client blocks the access behavior of the webpage according to the malicious webpage query result;

 If the ciphertext of the web address is not matched with the ciphertext of the database that is marked as a malicious web address, the normal web address query result is returned to the client; and the client continues to access the web address according to the normal web address query result. .

 Optionally, the website information is specifically at least one first URL.

 Optionally, the ciphertext marked as a malicious website in the database includes one or more of the following information: a feature value of the malicious URL, a feature value of the host name of the malicious URL, and a feature value of the sub-domain name of the malicious URL.

Optionally, the at least one first URL includes: a URL of the webpage corresponding to the webpage requested to be accessed, or a URL of the webpage content corresponding to the webpage requested to be accessed, or a URL of the downloaded file or any of the above information. combination. Optionally, the obtaining, by the client, the URL information corresponding to the web address requested to be accessed, by: specifying a response event interface, obtaining a URL of the webpage corresponding to the webpage requested by the client. Optionally, the website information that is obtained by the client to obtain the requested URL includes:

 Get the page object inside the client's browser;

 The URL of the link in the webpage content corresponding to the webpage requested by the client is obtained by calling the method of the page object.

 Optionally, the website information that is obtained by the client to obtain the requested URL includes:

 Monitoring a function related to downloading within the browser of the client;

 When the browser generates a download behavior, the URL of the downloaded file is obtained.

 Optionally, before the client extracts the website ciphertext according to the website information, the method further includes: the client performing normalization processing on the at least one first URL.

 Optionally, the normalizing, by the client, the at least one first URL includes: unifying a letter case in the first URL;

 Excluding redundant path characters and parameters in the first URL.

 Optionally, the client extracts the website ciphertext according to the website information, including:

 Obtaining a host name of the first URL and a first domain name segment of the first URL;

 Calculating, respectively, a feature value of the first URL, a feature value of a host name of the first URL, and a feature value of a first domain name segment of the first URL;

 The feature value of the first URL, the feature value of the host name of the first URL, and the feature value of the first domain name segment of the first URL are the website ciphertext.

 Optionally, if the first-level root domain name of the first URL from the right-to-left is an international top-level domain name, the first domain name segment of the first URL is the host name of the first URL. a first-level sub-domain; if the first-level root domain name of the first URL from the right-to-left is a country-level top-level domain, and the first-level sub-domain includes an international top-level domain, the first domain of the first URL The segment is a second-level sub-domain name of the host name of the first URL; if the host name of the first URL uses a dynamic domain name, the first domain name segment of the first URL is the host name of the first URL The dynamic domain name begins, and the next-level subdomain is extracted to the right.

 Optionally, if the ciphertext of the website matches the ciphertext of the database marked as a malicious url, the result of returning the malicious url to the client is: if any of the first URLs in the at least one first URL a feature value, a feature value of a host name of any one of the at least one first URL, and a feature value of a first domain name segment of any one of the at least one first URL and If the ciphertext matching in the database is marked as a malicious URL, the malicious URL query result is returned to the client.

 Optionally, the matching, by the server, the ciphertext of the website with the ciphertext stored in the database includes: performing, by using a feature value of any one of the at least one first URL and a ciphertext of the database marked as a malicious URL Matching; if the feature value of any one of the at least one first URL matches the ciphertext marked as a malicious URL in the database, returning the malicious URL query result to the client;

If the feature value of any of the at least one first URL does not match the ciphertext marked as a malicious URL in the database, the feature of the host name of any of the at least one first URL Value and number Matching according to the ciphertext marked as a malicious URL in the library; if the feature value of the host name of any of the at least one first URL matches the ciphertext marked as a malicious URL in the database, then the client is End the return of the malicious URL query result;

 If the feature value of the host name of any one of the at least one first URL does not match the ciphertext of the database marked as a malicious URL, then the first URL of the at least one first URL is The feature value of a domain name segment is matched with the ciphertext marked as a malicious website in the database; if the feature value of the first domain name segment of any one of the at least one first URL is the same as the password marked as a malicious URL in the database If the text matches, the malicious web address query result is returned to the client; if the feature value of the first domain name segment of any of the first URLs in the at least one first URL does not match the ciphertext marked as a malicious web address in the database, Returning the normal URL query result to the client.

 Optionally, the method further includes the step of constructing the database;

 The steps of constructing the database include:

 Obtaining at least one second URL known as a malicious web address and having the same first domain name segment;

 Obtaining a third URL that includes the highest number of sub-domains in the at least one second URL, and traces the sub-domains included in the third URL from right to left, and extracts at least one sub-domain name;

 If the first domain name segment of the second URL belongs to the preset trusted list, the feature value of each second URL and the feature value of the host name of each second URL are marked as the ciphertext of the malicious website. Stored in the database; if the first domain name segment of the second URL belongs to the preset untrusted list, obtain at least one second URL that includes the lowest number of sub-domain name levels, and each of the second URLs The feature value, the feature value of the host name of each second URL, and the feature value of the sub-domain name of the at least one sub-domain name that is extracted in addition to the host name of each second URL is higher than the sub-domain name of the fourth URL. The ciphertext of the URL, stored in the database.

 Optionally, the number of levels of the at least one primary domain name extracted by the traceback is a set threshold.

 According to another aspect of the present invention, a URL access system is provided, including: a client and a server; the client includes:

 a monitoring module, configured to obtain URL information corresponding to the website requested to access;

 An extraction module, configured to extract a website ciphertext according to the website information;

 a communication module, configured to submit the website ciphertext to a server;

 a protection module, configured to block access to the web address according to a malicious web address query result returned by the server;

 The access module is configured to continue the access behavior to the web address according to the normal web address query result returned by the server.

 The server includes:

 a database for storing ciphertext;

a query module, configured to match the ciphertext of the website with the ciphertext stored in the database; if the ciphertext of the website matches the ciphertext marked as a malicious web address in the database, return a malicious web query result to the client; If the text does not match the ciphertext marked as a malicious URL in the database, the normal URL query result is returned to the client. Optionally, the monitoring module is specifically configured to obtain at least one first URL corresponding to the website that is requested to be accessed, where the at least one first URL includes: a URL of the webpage corresponding to the website that requests the access, or the requested access The URL of the link in the webpage content corresponding to the web address or the URL of the downloaded file or any combination of the above information; the ciphertext marked as a malicious web address in the database includes one or more of the following information: characteristic value of the malicious URL, malicious The feature value of the host name of the URL and the feature value of the subdomain of the malicious URL.

 Optionally, the monitoring module includes:

 The first monitoring unit is configured to obtain, by specifying a response event interface, a URL of a webpage corresponding to the web address requested by the client.

 Optionally, the monitoring module includes:

 The second monitoring unit is configured to obtain a page object inside the browser of the client; and obtain a URL linked in the webpage content corresponding to the webpage requested by the client by calling the method of the page object.

 Optionally, the monitoring module includes:

 a third monitoring unit, configured to monitor a function related to downloading in the browser of the client; and when the browser performs a downloading behavior, obtain a URL of the downloaded file.

 Optionally, the client further includes: a processing module, configured to perform normalization processing on the at least one first URL.

 Optionally, the processing module includes:

 a unit for unifying the uppercase and lowercase of the letters in the first URL;

 And a removing unit, configured to remove redundant path identifiers and parameters in the first URL.

 Optionally, the extracting module includes:

 An acquiring unit, configured to acquire a host name of the first URL and a first domain name segment of the first URL, and a calculating unit, configured to separately calculate a feature value of the first URL, and a host name of the first URL a feature value and a feature value of the first domain name segment of the first URL;

 The feature value of the first URL, the feature value of the host name of the first URL, and the feature value of the first domain name segment of the first URL are the website ciphertext.

 Optionally, if the first-level root domain name of the host name of the first URL is an international top-level domain name, the acquiring unit is specifically configured to acquire the first level of the host name of the first URL. The domain name is the first domain name segment of the first URL; if the first-level root domain name of the first URL from the right-to-left domain name is a country-level top-level domain name, and the first-level sub-domain name includes an international top-level domain name, The obtaining unit is specifically configured to obtain the second-level sub-domain name of the host name of the first URL as the first domain name segment of the first URL; if the first URL uses a dynamic domain name, the acquiring unit is specific For obtaining the starting from the dynamic domain name, the next-level sub-domain extracted to the right is the first domain name segment of the first URL.

Optionally, the querying module is specifically configured to match the ciphertext of the website with the ciphertext stored in the database; if the feature value of any of the at least one first URL, the at least one first URL Any one of a feature value of a host name of any one of the first URLs and a feature value of a first domain name segment of any one of the at least one first URLs matches a ciphertext of the database marked as a malicious URL, Returning the malicious URL query result to the client. Optionally, the query module is specifically configured to:

 Matching a feature value of any one of the at least one first URL with a ciphertext marked as a malicious URL in the database; if the feature value of any of the at least one first URL is in a database If the ciphertext matching is marked as a malicious URL, the malicious URL query result is returned to the client;

 If the feature value of any of the at least one first URL does not match the ciphertext marked as a malicious URL in the database, the feature of the host name of any of the at least one first URL The value is matched with the ciphertext marked as a malicious URL in the database; if the feature value of the host name of any of the at least one first URL matches the ciphertext marked as a malicious URL in the database, then The client returns the malicious URL query result;

 If the feature value of the host name of any one of the at least one first URL does not match the ciphertext of the database marked as a malicious URL, then the first URL of the at least one first URL is The feature value of a domain name segment is matched with the ciphertext marked as a malicious website in the database; if the feature value of the first domain name segment of any one of the at least one first URL is the same as the password marked as a malicious URL in the database If the text matches, the malicious web address query result is returned to the client; if the feature value of the first domain name segment of any of the first URLs in the at least one first URL does not match the ciphertext marked as a malicious web address in the database, Returning the normal URL query result to the client.

 Optionally, the server further includes: a building module, configured to build the database;

 The building module includes:

 a first obtaining unit, configured to acquire at least one second URL that is known to be a malicious web address and has the same first domain name segment;

 a second obtaining unit, configured to obtain a third URL that includes the highest number of sub-domains in the at least one second URL, and traces the sub-domains included in the third URL from right to left, and extracts at least one sub-domain name;

 a first marking unit, configured to: if the first domain name segment of the second URL belongs to a preset trusted list, mark the feature value of each second URL and the feature value of the host name of each second URL The ciphertext for the malicious URL is stored in the database;

 a second marking unit, configured to: if the first domain name segment of the second URL belongs to a preset untrusted list, obtain at least one second URL that includes the lowest number of sub-domain name levels, and each of the The feature value of the second URL, the feature value of the host name of each second URL, and the feature value tag of the sub-domain name of the sub-domain name of the at least one sub-domain name extracted by the tracing other than the host name of each second URL is higher than the sub-domain name of the fourth URL The ciphertext for the malicious URL is stored in the database.

According to the URL access method and system provided by the embodiment, when the client requests to access the web address, the web site ciphertext is extracted from the web address information, and the web address ciphertext is submitted to the server, and the server matches the web address ciphertext with the ciphertext stored in the database. To complete the security query and verification of the URL, the client decides whether to continue the access behavior to the URL according to the verification result of the server. This method does not rely on the client's local database, and the security query and verification of the URL is done on the server side. Since the database on the server side can update various malicious websites on the Internet in time, its upgrade period is much shorter than the local database of the client, and the information of the malicious website in the database on the server side is large, and the coverage is wide. This enables fast and effective interception of malicious websites. The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below. DRAWINGS

 Various other advantages and benefits will become apparent to those skilled in the art in the <RTIgt; The drawings are only for the purpose of illustrating the preferred embodiments and are not intended to limit the invention. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

 1 shows a flow chart of a method of accessing a web address according to an embodiment of the present invention;

 2 shows a flow chart of a method of accessing a web address according to an embodiment of the present invention;

 FIG. 3 is a flowchart showing a process of matching a ciphertext of a website in the embodiment of the present invention;

 FIG. 4 shows a schematic structural diagram of a web address access system according to an embodiment of the present invention.

 Figure 5 is a schematic illustration of a web site access system in accordance with the present invention;

 Fig. 6 schematically shows a storage unit for holding or carrying program code implementing the method according to the invention. detailed description

 Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the invention has been described with respect to the embodiments of the present invention, it should be understood that Rather, the embodiments are provided so that this disclosure will be more fully understood, and the scope of the disclosure may be fully conveyed by those skilled in the art.

 FIG. 1 shows a flow chart of a method of accessing a web address according to an embodiment of the present invention. In this embodiment, the URL accessed by the client is a Uniform Resource Locator (hereinafter referred to as URL). As shown in FIG. 1, the method includes the following steps:

 Step 101: The client obtains the URL information corresponding to the website requested to access.

 Monitors the web access behavior of various types of browsers on the client. The requested URL information is called the first URL. The first URL may include the following:

 i. The URL of the web page corresponding to the web address requested to be accessed;

 For example, the client requests access to the "Sina" home page, and the URL of the page is: http: //www.sina.com.cn/.

 Ii. The URL of the link in the webpage content corresponding to the webpage requesting access;

 There may be some link URLs in the content of the webpage requested by the client, and the URLs of these link URLs also belong to the scope of monitoring.

 Iii. URL of the downloaded file.

 The client requests to download the file, and the URL of the downloaded file also belongs to the scope of monitoring.

A web page access behavior of the client may involve one or more of the above three URLs, namely, the first The URL includes any one of the above three URLs or a combination of any of the several.

 Step 102: The client extracts the ciphertext of the website according to the website information.

 The client extracts the ciphertext of the first URL according to the information contained in the first URL.

 Step 103: The client submits the website ciphertext to the server.

 Step 104: The server matches the ciphertext of the website with the ciphertext stored in the database, and the ciphertext stored in the database includes the ciphertext marked as the malicious website; if the ciphertext of the website matches the ciphertext marked as the malicious website in the database, Go to step 105; otherwise, go to step 107.

 In this embodiment, a database is pre-built on the server side, and at least the ciphertext marked as a malicious web address is stored in the database. These ciphertexts are based on a large number of URLs known as malicious URLs.

 Step 105: The server returns a malicious web address query result to the client, and step 106 is performed.

 The ciphertext submitted by the client matches the ciphertext marked as a malicious URL in the database, indicating that the first URL to be accessed by the client is a malicious web address. In this case, the server returns a malicious web query result to the client.

 Step 106: The client intercepts the access behavior of the web address according to the result of the malicious web address query, and ends. Step 107: The server returns a normal web address query result to the client, and step 108 is performed.

 The URL ciphertext submitted by the client does not match the ciphertext marked as a malicious URL in the database, indicating that the first URL to be accessed by the client is a normal URL. In this case, the server returns the normal URL query result to the client.

 Step 108: The client continues the access behavior to the web address according to the normal web address query result, and ends. According to the URL access method provided by the embodiment, when the client requests to access the website address, the website ciphertext is extracted from the website address information, and the website cipher text is submitted to the server, and the server matches the website ciphertext with the ciphertext stored in the database, and completes The security query and verification of the URL, the client decides whether to continue the access behavior to the URL according to the verification result of the server. This method does not rely on the client's local database, and the security query and verification of the URL is done on the server side. Since the database on the server side can update various malicious websites on the Internet in time, its upgrade period is much shorter than the local database of the client, and the information of the malicious website in the database on the server side is large, and the coverage is wide. This enables fast and effective interception of malicious websites.

 2 shows a flow chart of a method of accessing a web address in accordance with one embodiment of the present invention. This embodiment provides a cloud security-based URL access method, which does not depend on the client's local URL database, and performs security query and verification of the URL on the server side. As shown in FIG. 2, the method includes the following steps:

 Step 201: The client acquires at least one first URL that is requested to be accessed.

 The at least one first URL of this embodiment may include any one of the three types of URLs described in the above embodiments or a combination of any of the several.

 The methods for obtaining the above three URLs are described as follows:

The URL of the web page corresponding to the web address requested by the client is obtained by specifying a response event interface, for example, by implementing a specified response event interface of the standard plug-in mechanism. For example, in the IE (Internet Explorer) browser, using the Browser Helper Object (BH0) plugin mechanism, you can get the URL currently loaded by IE by responding to the "BeforeNavigate2" event. Use the specified response event interface provided by the Firefox extension mechanism in the Firefox browser to get the URL currently loaded by Firefox. Use the Netscape plug-in application programming interface (Netscape Plugin) in the chrome browser Appl ication Programming Interface (abbreviation: NPAPI) plugin mechanism, get the URL currently loaded by Google Chrome.

 The URL of the link in the web content accessed by the browser from the browser environment, including but not limited to the hyperlink address within the page. The specific method is to obtain a page object inside the browser, and then obtain a link URL in the webpage content by calling a method of the page object. Among them, the page object inside the browser can be obtained through the standard plug-in mechanism provided by the browser.

 Get the URL of the file the browser is downloading from the browser environment. The specific method is to monitor the function related to the download inside the browser, and when the download behavior of the browser is found, the URL of the downloaded file can be analyzed. Among them, you can use the hook (H00K) mechanism to monitor the browser-related functions related to downloading.

 Step 202: The client normalizes the at least one first URL.

 The normalization process may include: unifying the uppercase and lowercase letters in the first URL, including information such as a protocol, a host name, a path name, a file name, and a parameter; and removing redundant path identifiers and parameters in the first URL.

 For example, the first URL is: HTTp: 〃 www. A. com〃aBc/abc. Php?A=l.

Unify the uppercase and lowercase letters to lowercase: http : //www. a. com//abc/abc. php?a=l _; remove the redundant path characters: http:〃 www. a. com/abc/ Abc. php?a=l.

 Step 203: The client extracts the website ciphertext according to the first URL.

 For the first URL, the first URL itself (url), the host name of the first URL (host), and the first domain name of the first URL (domain) are three pieces of key information. After obtaining the first URL, the host name of the first URL and the first domain name segment of the first URL are obtained. The host name of the first URL is a host part after the information such as the path identifier, the protocol header, and the port number in the first URL is removed; the first domain name segment of the first URL is from the right to the host name according to the first URL. Traced back to the left. Preferably, when the first domain name segment of the first URL is obtained, the highest level is traced from right to left.

 If the first-level root domain name of the first URL from the right to the left is an international top-level domain name, the first domain name segment of the first URL is the first-level sub-domain name of the host name of the first URL. Among them, international top-level domains refer to common top-level domains such as "com", "net", "org", "edu", and "gov". For example, if the host name of the first URL is wa com, and the first-level root domain name from right to left is "com", then the first-level sub-domain name "a. com" is extracted as the first URL. Domain name segment.

 If the first-level root domain name of the first URL from the right-to-left domain is the country-level top-level domain name, and the first-level sub-domain name includes the international top-level domain name, the first domain name segment of the first URL is the host name of the first URL. Second level subdomain. The top-level domain names in the country refer to special top-level domains such as "cn" and "hk". For example, the host name of the first URL is www.a.com.cn, its first-level root domain name from right to left is "cn", and the first-level subdomain is "com.cn", then extract its first The second-level subdomain "a. com. cn" is the first domain name segment of the first URL.

If the host name of the first URL uses a dynamic domain name, the first domain name segment of the first URL is a host name of the first URL starting from the dynamic domain name, and the next-level sub-domain name extracted to the right. Dynamic domain names refer to some second- or third-level dynamic domain names, such as "3322. org", "s. 3322. org", and "s. 3322. net". For example, the first URL has the host name www.a.3322.org, which uses the dynamic domain name "3322. org". From the dynamic domain name, the next subdomain is extracted to the right "a. 3322. org" The first domain name segment of the first URL. In this embodiment, the feature values of the three pieces of key information are respectively calculated as the website ciphertext. The eigenvalue may be a hash value, or the eigenvalue may be a hash value calculated according to a message digest algorithm (Message Digest Algori, md5), or a SHA1 code, or A CRC (Cyclic Redundancy Check) code can uniquely identify the signature of the original program. In the following example, the eigenvalue is a 32-bit md5 hash value.

For example, the first URL is: http : //www. a. com/abc/abc. php?a=l _; According to the above method, the host name of the first URL is obtained: wa com; A domain name segment is: a. com.

 Calculate the 32-bit md5 hash value of the first URL itself:

 Md5 (http: //www. a. com/abc/abc. php?a=l, 32) =e2a6b69ff l5c6a8e276f 089250a b3f7d

 The 32-bit md5 hash value of the host name of the first URL is calculated as:

 Md5 (www. a. com, 32) = 30f4a7bbef e70d75616707c80921a7e8

 Calculate the 32-bit md5 hash value of the first domain name segment of the first URL:

 Md5 (a. com, 32) = b3655bd7aad56513fcdacbd4254ed6b7

 For the case of having a first URL, the 32-bit md5 hash value of the first URL obtained by the above calculation, the 32-bit md5 hash value of the host name of the first URL, and the 32-bit md5 of the first domain name segment of the first URL. The hash value is the URL ciphertext of the first URL. For the case of multiple first URLs, the 32-bit md5 hash values of the above three pieces of key information of each first URL are respectively calculated, and the 32-bit md5 hash value of the above three pieces of key information of each first URL is formed. A set of ciphertexts that include, but are not limited to, a set of 32-bit md5 hashes.

 In the above example where the first URL is: http:〃 www. a. com/abc/abc. php?a=l, a set of URL ciphertexts of the first URL obtained is as follows:

 Domain | host | url

 a. com I www. a. com http : //www. a. com/abc/abc. php?a=l

B3655bd7aad56513fcdacbd4254ed6b7 | 30f4a7bbef e70d75616707c80921a7e8 _e 2a6b69ff l 5c6a8e276f089250ab3f7d

 Step 204: The client submits the website ciphertext to the server.

 Step 205: The server matches the ciphertext of the website with the ciphertext stored in the database, and the ciphertext stored in the database includes at least the ciphertext marked as the malicious website; if the ciphertext of the website matches the ciphertext marked as the malicious website in the database Go to Step 206; otherwise, go to Step 208.

 In this embodiment, a web site database is pre-built on the server side, and at least the ciphertext marked as a malicious web address is stored in the web address database. Specifically, the data key value in the URL database is stored according to the characteristic values of the three key information: the URL url, the URL host, and the URL domain. The key values of the three key information can be marked according to the normal URL and the malicious URL respectively. Specifically, the ciphertext marked as a malicious web address includes one or more of the following: a feature value of the malicious URL, a feature value of the host name of the malicious URL, and a feature value of the sub-domain name of the malicious URL.

 The ciphertext in the URL database is based on a large number of URLs known as malicious URLs.

 In this embodiment, constructing the website database may include the following steps:

(a) Obtaining at least one second URL known as a malicious web address and having the same first domain name segment. After obtaining a large number of URLs known as malicious URLs, the host name and the first domain name segment of the URLs of the malicious URLs are obtained according to the method of extracting the host name and the first domain name segment by the client. In the URLs of these malicious URLs, the same URL with the same first domain name segment often appears. For example, for the URL of the following malicious URL:

 Http: //a. b. c. d. e. f . g. com/abc/abc l. php?a=l

 Http: / /b. c. d. e. f . g. com/ abc/ abc. php?a=l

 Http : //d. e. f . g. com/ abc/ abc. php?a=l

 Its first domain name is g. com. Here, the above three URLs are called the second URL.

 (b) obtaining at least one third URL having the highest number of sub-domains in the second URL, and tracing the sub-domains included in the third URL from right to left, and extracting at least one sub-domain;

 In the above example, the third URL with the highest number of subdomains in the three second URLs is: http : //a. b. c. d. e. f. g. com/abc/abc l. php?a=l , which contains a total of 7 subdomains. The subdomains included in the third URL are traced from right to left, and are extracted to the following 7 subdomains:

 First level subdomain: g. com

 Second level subdomain: f. g. com

 Third-level subdomain: e. f. g. com

 Fourth-level subdomain: d. e. f. g. com

 Level 5 subdomain: c. d. e. f. g. com

 Level 6 subdomain: b. c. d. e. f. g. com

 The seventh level subdomain: a. b. c. d. e. f. g. com

 Preferably, the number of levels of at least one level of subdomains extracted in this step is set to a threshold N. Since there are both malicious URLs and normal URLs in multiple subdomains in a domain name, this is generally the case below level 6, so preferably N is greater than or equal to 6.

 (c) if the first domain name segment of the second URL belongs to a preset trusted list, for example, a whitelist, marking the feature value of each second URL and the feature value of the host name of each second URL as malicious The ciphertext of the URL, stored in the database.

 For some normal websites with large traffic, such as: sina.com.cn, sohu.com, etc., they can be written to the default trusted list. If the first domain name segment of the second URL belongs to such a trusted list, the feature value of each second URL and the feature value of the host name of each second URL are marked as the ciphertext of the malicious website, and are stored in the database. .

 In the above example, if g. com belongs to the default trusted list, the ciphertext marked as a malicious URL includes the feature values of the following information:

 Each second URL:

 Http: //a. b. c. d. e. f . g. com/ abc/ abc l. php?a=l

 Http : // b. c. d. e. f . g. com/ abc/ abc. php?a=l

 Http : // d. e. f. g. com/abc/abc. php?a=l

 Host name of each second URL:

 a. b. c. d. e. f . g. com

Bcde f . g. com De f . g. com

 The feature value of the above information is stored in the cloud URL database and is marked as a ciphertext of the malicious URL. However, the feature values of other subdomains that do not have a malicious URL can be marked as normal URLs and also stored in the cloud URL database, including:

 g. com

 f. g. com

 e. f. g. com

 c. d. e. f. g. com

 (d) if the first domain name segment of the second URL belongs to a preset untrusted list, for example, a blacklist, obtain at least one second URL that includes the lowest number of subdomains in the second URL, and each second URL The feature value, the feature value of the host name of each second URL, and the feature value of the sub-domain name of the at least one-level sub-domain name that is higher than the fourth URL except the host name of each second URL is marked as malicious. The ciphertext of the URL, stored in the database.

 For some sites with very small traffic, they can be written to an untrusted list. If the first domain name segment of the second URL belongs to such an untrusted list, obtaining at least one second URL having the lowest number of sub-domain names in the second URL, and the feature value of each second URL, each second URL The eigenvalue of the host name and the ciphertext of the at least one level of the sub-domain name other than the host name of each second URL are higher than the privilege value of the sub-domain name of the fourth URL, which is marked as a malicious website, and is stored in the database. .

 In the above example, if g. com belongs to the default untrusted list, obtain the fourth URL with the lowest number of subdomains in it: http:〃 www. defg com/abc/abc. php?a=l, it A total of 4 subdomains are included, then the ciphertext marked as a malicious URL includes the eigenvalues of the following information:

 Each second URL:

 Http: //a. b. c. d. e. f . g. com/ abc/ abc l. php?a=l

 Http : // b. c. d. e. f . g. com/ abc/ abc. php?a=l

 Http : // d. e. f. g. com/abc/abc. php?a=l

 Host name of each second URL:

 a. b. c. d. e. f . g. com

 b. c. d. e. f . g. com

 d. e. f. g. com

 The sub-domain name of the at least one-level sub-domain name that is traced and extracted higher than the fourth URL includes: abcde f . g. com, bcde f . g. com, cde f . g. com, where abcde f . g. com And bcdefg com is the host name of the second URL, then the sub-domain name of the at least one sub-domain name that is extracted in addition to the host name of each second URL is higher than the sub-domain name of the fourth URL is:

 c d. e. f . g. com

 The feature value of the above information is stored in the cloud URL database and is marked as a ciphertext of the malicious URL. However, the feature values of other subdomains that do not have a malicious URL can be marked as normal URLs and also stored in the cloud URL database, including:

g. com f. g. com

 e. f. g. com

 The feature values mentioned in this step should be of the same type as the feature values submitted by the client. The feature value may be specifically a hash value. Preferably, the feature value may be a hash value calculated according to the md5 algorithm.

 The server matches the ciphertext submitted by the client with the ciphertext marked as a malicious URL in the cloud URL database. The specific matching process is as follows:

 And a feature value of any of the first URLs in the at least one first URL, a feature value of the host name of any one of the at least one first URL, and a first domain name segment of any of the first URLs in the at least one first URL If any one of the feature values matches the ciphertext marked as a malicious URL in the cloud URL database, step 206 is performed; otherwise, step 208 is performed.

 FIG. 3 is a flow chart showing a process of matching a ciphertext of a website in the embodiment of the present invention. The matching process shown in Fig. 3 is a preferred embodiment of the embodiment of the present invention, but the present invention is not limited thereto. As shown in FIG. 3, the process of matching the ciphertext submitted by the client with the ciphertext stored in the database may further include the following steps:

 Step 301: Match the feature value of any one of the at least one first URL with the ciphertext marked as a malicious URL in the database; if yes, perform step 206; otherwise, perform step 302;

 Step 302: Match the feature value of the host name of any one of the first URLs to the ciphertext marked as the malicious URL in the database; if yes, go to step 206; otherwise, go to step 303; Step 303; Matching the feature value of the first domain name segment of any one of the at least one first URL with the ciphertext marked as a malicious website in the database; if yes, performing step 206; otherwise, performing step 208.

 In summary, the above matching process includes the following three cases:

 (1) any one of the feature values of the three pieces of key information of the at least one first URL is matched with the ciphertext marked as a malicious website in the cloud url database, and step 206 is performed;

 (2) the eigenvalues of the three pieces of key information of the at least one first URL are not matched with the ciphertexts marked as malicious URLs in the cloud website database, and step 208 is performed;

 (3) at least one of the three pieces of key information of the first URL matches the ciphertext marked as the normal URL in the cloud website database, and the other feature values are not related to the ciphertext marked as the malicious website in the cloud website database. If yes, go to step 208.

 Step 206: The server returns a malicious web address query result to the client, and step 207 is performed.

 The ciphertext submitted by the client matches the ciphertext marked as a malicious URL in the database, indicating that the first URL to be accessed by the client is a malicious web address. In this case, the server returns a malicious web query result to the client.

 Step 207: The client blocks the access behavior of the website according to the result of the malicious website query, and ends. The client intercepts the access behavior of the web address according to the result of the malicious web address query, and prompts the user.

 Step 208: The server returns a normal web address query result to the client, and step 209 is performed.

 The URL ciphertext submitted by the client does not match the ciphertext marked as a malicious URL in the database, indicating that the first URL to be accessed by the client is a normal URL. In this case, the server returns the normal URL query result to the client.

Step 209: The client continues the access behavior to the web address according to the normal web address query result, and ends. According to the URL access method provided by the embodiment, when the client requests to access the website address, the website ciphertext is extracted from the website address information, and the website cipher text is submitted to the server, and the server matches the website ciphertext with the ciphertext stored in the database, and completes The security query and verification of the URL, the client decides whether to continue the access behavior to the URL according to the verification result of the server. This method does not rely on the client's local database, and the security query and verification of the URL is done on the server side. Since the database on the server side can update various malicious websites on the Internet in time, its upgrade period is much shorter than the local database of the client, and the information of the malicious website in the database on the server side is large, and the coverage is wide. This enables fast and effective interception of malicious websites.

 FIG. 4 shows a schematic structural diagram of a web address access system according to an embodiment of the present invention. As shown in FIG. 4, the URL access system includes: Client 1 and Server 2.

 The client 1 includes: a monitoring module 10, an extraction module 11, a communication module 12, a protection module 13, and an access module 14. The monitoring module 10 is configured to obtain the web address information corresponding to the web address requested to be accessed; the extracting module 11 is configured to extract the web address ciphertext according to the web address information; the communication module 12 is configured to submit the web address ciphertext to the server 2; and the protection module 13 is configured to: According to the result of the malicious web address query returned by the server 2, the access behavior to the web address is blocked; the access module 14 is configured to continue the access behavior to the web address according to the normal web address query result returned by the server 2.

 The server 2 includes: a database 20 and a query module 21. The database 20 is configured to store the ciphertext; the query module 21 is configured to match the ciphertext of the web address with the ciphertext stored in the database 20; if the ciphertext of the web address matches the ciphertext marked as a malicious web address in the database 20, the client The end 1 returns the malicious web address query result; if the web address ciphertext does not match the ciphertext marked as the malicious web address in the database 20, the normal web address query result is returned to the client 1.

 Further, the monitoring module 10 is specifically configured to obtain at least one first URL corresponding to the website that is requested to be accessed, where the at least one first URL includes: a URL of a webpage corresponding to the webpage requesting access, or a webpage content corresponding to the webpage requesting access The URL of the link or the URL of the downloaded file or any combination of the above information. The ciphertext marked as a malicious web address in the database includes one or more of the following information: a feature value of the malicious URL, a feature value of the host name of the malicious URL, and a feature value of the subdomain of the malicious URL.

 The monitoring module 10 may include: a first monitoring unit 10a, configured to obtain a URL of a webpage corresponding to the webpage requested by the client 1 by specifying a response event interface.

 The monitoring module 10 may further include: a second monitoring unit 10b, configured to obtain a page object inside the browser of the client 1; and obtaining a URL linked in the webpage content corresponding to the webpage requested by the client 1 by calling the method of the page object .

 The monitoring module 10 may further include: a third monitoring unit 10c, configured to monitor a function related to the download inside the browser of the client 1; and obtain a URL of the downloaded file when the download behavior occurs in the browser.

 The client 1 may further include: a processing module 15 configured to perform normalization processing on the at least one first URL. Further, the processing module 15 may include: a unified unit 15a for unifying the uppercase and lowercase of letters in the first URL, and a removing unit 15b for removing redundant path identifiers and the first URL parameter.

The extraction module 1 1 may include: an acquisition unit 11a and a calculation unit 1 lb. The obtaining unit 11a is configured to obtain a host name of the first URL and a first domain name segment of the first URL, and a calculating unit l ib for separately calculating a feature value of a URL, a feature value of a host name of the first URL, and a feature value of the first domain name segment of the first URL; a feature value of the first URL, a feature value of the host name of the first URL, and a The feature value of the first domain name segment of the first URL is the website ciphertext.

 If the first-level root domain name of the host name of the first URL is the international top-level domain name, the obtaining unit 11a is specifically configured to obtain the first-level sub-domain name of the host name of the first URL as the first domain name of the first URL. Paragraph

 If the first-level root domain name of the first-level host name of the first URL is the country-level top-level domain name, and the first-level sub-domain name includes the international top-level domain name, the obtaining unit 11a is specifically configured to obtain the second host name of the first URL. The subdomain name is the first domain name segment of the first URL;

 If the first URL uses the dynamic domain name, the obtaining unit 11a is specifically configured to obtain the first domain name segment of the first URL that is extracted from the dynamic domain name and is extracted to the right.

 The query module 21 is specifically configured to match the ciphertext of the website with the ciphertext stored in the database 20; if the feature value of any of the first URLs in the at least one first URL, the host of any of the at least one first URL Returning a malicious URL query to the client 1 by matching any one of the feature value of the name and the feature value of the first domain name segment of any of the first URLs of the at least one first URL with the ciphertext marked as a malicious URL in the database 20. result.

 As a preferred implementation manner, the query module 21 can be specifically configured to:

 Matching a feature value of any one of the at least one first URL with a ciphertext marked as a malicious URL in the database; if the feature value of any of the at least one first URL is in a database If the ciphertext matching is marked as a malicious URL, the malicious URL query result is returned to the client;

 If the feature value of any of the at least one first URL does not match the ciphertext marked as a malicious URL in the database, the feature of the host name of any of the at least one first URL The value is matched with the ciphertext marked as a malicious URL in the database; if the feature value of the host name of any of the at least one first URL matches the ciphertext marked as a malicious URL in the database, then The client returns the malicious URL query result;

 If the feature value of the host name of any one of the at least one first URL does not match the ciphertext of the database marked as a malicious URL, then the first URL of the at least one first URL is The feature value of a domain name segment is matched with the ciphertext marked as a malicious website in the database; if the feature value of the first domain name segment of any one of the at least one first URL is the same as the password marked as a malicious URL in the database If the text matches, the malicious web address query result is returned to the client; if the feature value of the first domain name segment of any of the first URLs in the at least one first URL does not match the ciphertext marked as a malicious web address in the database, Returning the normal URL query result to the client.

The server 2 also includes a building block 22, which may include: a first obtaining unit 22a, a second obtaining unit 22b, a first marking unit 22c and a second marking unit 22d. The first obtaining unit 22a is configured to acquire at least one second URL that is known to be a malicious web address and the first domain name segment is the same. The second obtaining unit 22b is configured to obtain the at least one second URL that includes the highest number of sub-domain names. The third URL, the sub-domain name included in the third URL is traced from right to left, and at least one sub-domain name is extracted. The first marking unit 22c is configured to: if the first domain name segment of the second URL belongs to the preset trusted list, The ciphertext of the feature value of each second URL and the host name of each second URL is marked as a ciphertext of the malicious URL, and is stored in the database 20; the second marking unit 22d is configured to be the first of the second URL The domain name segment belongs to a preset untrusted list, and obtains at least one second URL included a fourth URL having the lowest sub-domain level, a feature value of each second URL, a feature value of a host name of each second URL, and at least one sub-domain name extracted in addition to the host name of each second URL The ciphertext of the subdomain name whose upper number is higher than the fourth URL is marked as the ciphertext of the malicious web address, and is stored in the database 20.

 According to the URL accessing system provided by the embodiment, when the client requests to access the website address, the website ciphertext is extracted from the website address information, and the website cipher text is submitted to the server, and the server matches the website ciphertext with the ciphertext stored in the database, and completes The security query and verification of the URL, the client decides whether to continue the access behavior to the URL according to the verification result of the server. This method does not rely on the client's local database, and the security query and verification of the URL is done on the server side. Since the database on the server side can update various malicious websites on the Internet in time, its upgrade period is much shorter than the local database of the client, and the information of the malicious website in the database on the server side is large, and the coverage is wide. This enables fast and effective interception of malicious websites.

 Figure 5 illustrates a web site access system in accordance with the present invention. The web site access system includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520. The memory 520 can be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPR0M, a hard disk, or a ROM. Memory 520 has a memory space 530 for program code 1331 for performing any of the method steps described above. For example, storage space 1330 for program code may include various program code 531 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to Figure 6. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 520 in the server of Fig. 5. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 53 Γ , i.e., code readable by a processor, such as 510, that when executed by the server causes the server to perform various steps in the methods described above.

 The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. According to the above description, the structure required to construct such a system is obvious. Moreover, the invention is not directed to any particular programming language. It is to be understood that the present invention may be embodied in a variety of programming language, and the description of the specific language is described above for the purpose of illustrating the preferred embodiments of the invention.

 Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the description.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the invention. Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent, or similar purpose, unless otherwise stated.

 In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are not included in other embodiments, and other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

 The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the web access system in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

 It is to be noted that the above-described embodiments are illustrative of the present invention and are not intended to limit the scope of the invention, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

 In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed as limiting or limiting. Therefore, many modifications and changes will be apparent to those skilled in the art without departing from the scope of the invention. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

Rights request 1. A website access method, including: The client obtains the URL information corresponding to the URL requested; The client extracts the URL ciphertext based on the URL information; The client submits the ciphertext of the URL to the server; The server matches the URL ciphertext with the ciphertext stored in the database; If the URL ciphertext matches the ciphertext marked as a malicious URL in the database, the malicious URL query result is returned to the client; the client blocks access to the URL based on the malicious URL query result; If the ciphertext of the URL does not match the ciphertext marked as a malicious URL in the database, the normal URL query result is returned to the client; the client continues to access the URL based on the normal URL query result. . 2. The method according to claim 1, the website information is specifically at least one first URL. 3. The method according to claim 2, the ciphertext marked as a malicious URL in the database includes one or more of the following information: the characteristic value of the malicious URL, the characteristic value of the host name of the malicious URL, and the characteristic value of the malicious URL. Characteristic value of subdomain name. 4. The method according to claim 2, wherein the at least one first URL includes: the URL of the web page corresponding to the URL requested to be accessed or the URL of a link or downloaded file in the web page content corresponding to the URL requested to be accessed. URL or any combination of the above information. 5. The method according to claim 4, the client obtaining the URL information corresponding to the URL requested to access includes: By specifying a response event interface, obtain the URL of the web page corresponding to the URL requested by the client. 6. The method according to claim 4, the client obtaining the URL information corresponding to the URL requested to access includes: Obtain the page object inside the client's browser; By calling the method of the page object, the URL linked in the web page content corresponding to the URL requested by the client is obtained. 7. The method according to claim 4, the client obtaining the URL information corresponding to the URL requested to access includes: Monitor download-related functions within the client's browser; When a download occurs in the browser, the URL of the downloaded file is obtained. 8. The method according to any one of claims 2 to 7, before the client extracts the URL ciphertext according to the URL information, further comprising: the client normalizing the at least one first URL. . 9. The method according to claim 8, the client normalizing the at least one first URL includes: Unify the uppercase and lowercase letters in the first URL; Remove redundant path characters and parameters from the first URL. 10. The method according to any one of claims 2 to 7, the client extracting the URL ciphertext according to the URL information includes: Obtain the host name of the first URL and the first domain name segment of the first URL; Calculate the characteristic value of the first URL, the characteristic value of the host name of the first URL and the first URL respectively. Characteristic value of the first domain name segment of the URL; The characteristic value of the first URL, the characteristic value of the host name of the first URL, and the characteristic value of the first domain name segment of the first URL are the URL ciphertext. 11. The method according to claim 10, if the first-level root domain name from right to left of the host name of the first URL is an international top-level domain name, then the first domain name segment of the first URL is the third-level root domain name. The first-level subdomain name of a URL’s host name; If the first-level root domain name from right to left of the host name of the first URL is the country's top-level domain name, and the first-level subdomain name includes the international top-level domain name, then the first domain name segment of the first URL is the first-level domain name. The second-level subdomain name of a URL’s host name; If the host name of the first URL uses a dynamic domain name, the first domain name segment of the first URL is the next-level sub-domain name extracted from the dynamic domain name to the right of the host name of the first URL. 12. The method according to claim 10, if the URL ciphertext matches the ciphertext marked as a malicious URL in the database, then the malicious URL query result returned to the client is specifically: if the at least one first The characteristic value of any first URL in the URL, the characteristic value of the host name of any first URL in the at least one first URL, and the first domain name segment of any first URL in the at least one first URL. If any one of the characteristic values matches the ciphertext marked as a malicious URL in the database, the malicious URL query result is returned to the client. 13. The method according to claim 12, the server matching the URL ciphertext with the ciphertext stored in the database includes: Match the characteristic value of any first URL in the at least one first URL with the ciphertext marked as a malicious URL in the database; If the characteristic value of any first URL in the at least one first URL matches the ciphertext in the database If the ciphertext marked as a malicious URL matches, the malicious URL query result is returned to the client; If the characteristic value of any one of the at least one first URL does not match the ciphertext marked as a malicious URL in the database, then the characteristic value of the host name of any one of the at least one first URL is The value is matched with the ciphertext marked as a malicious URL in the database; if the characteristic value of the host name of any one of the at least one first URL matches the ciphertext marked as a malicious URL in the database, then the The client returns malicious URL query results; If the characteristic value of the host name of any first URL in the at least one first URL does not match the ciphertext marked as a malicious URL in the database, then the third URL of any first URL in the at least one first URL is The characteristic value of a domain name segment is matched with the ciphertext marked as a malicious URL in the database; If the text matches, the malicious URL query result is returned to the client; if the characteristic value of the first domain name segment of any of the at least one first URL does not match the ciphertext marked as a malicious URL in the database, then return to the client Normal URL query results. 14. The method according to claim 3, further comprising the step of constructing the database; The steps to build the database include: Obtain at least one second URL that is known to be a malicious URL and has the same first domain name; Obtain the third URL with the highest subdomain name level contained in the at least one second URL, trace the subdomain names contained in the third URL step by step from right to left, and extract at least one level of subdomain names; If the first domain name segment of the second URL belongs to the preset trusted list, mark the characteristic value of each second URL and the characteristic value of the host name of each second URL as the ciphertext of the malicious URL, Stored in the database; If the first domain name segment of the second URL belongs to the preset untrusted list, obtain at least one second URL that contains the fourth URL with the lowest subdomain name level, and add each second URL to The characteristic value of , the characteristic value of the host name of each second URL, and the characteristic value of the subdomain name of at least one level of retroactively extracted subdomains with a higher level than the fourth URL except the host name of each second URL are marked as malicious. The ciphertext of the URL is stored in the database. 15. A website access system, including: client and server; The clients include: Monitoring module, used to obtain the URL information corresponding to the URL requested to be accessed; An extraction module, used to extract the URL ciphertext based on the URL information; Communication module, used to submit the ciphertext of the website address to the server; The protection module is used to block access to the URL based on the malicious URL query results returned by the server; The access module is used to continue accessing the URL based on the normal URL query results returned by the server. The servers include: Database, used to store ciphertext; Query module, used to match the URL ciphertext with the ciphertext stored in the database; if the URL ciphertext matches the ciphertext marked as a malicious URL in the database, return the malicious URL query results to the client; if the URL ciphertext matches If the text does not match the ciphertext marked as a malicious URL in the database, the normal URL query result is returned to the client. 16. A computer program, comprising computer readable code, which when the computer readable code is run on a server, causes the server to execute the security of the Android application program according to any one of claims 1-14 Detection method. 17. A computer-readable medium in which the website access method as claimed in claim 16 is stored.