Detection Method of Malicious Mirroring Site in Mass Network Traffic

This paper proposes a method for detecting malicious mirrored websites under large-scale network traffic. This method passively extracts webpage source code from network traffic and actively obtains webpage snapshots through a combination of active and passive methods, extracts corresponding features for similarity comparison, and detects malicious Mirror web pages. The experiment used 1447 malicious webpages as benchmark webpages. In a large-scale network flow environment, 49 phishing webpages, 13 gambling webpages, 23 obscene and pornographic webpages, and 8 illegal webpages were detected. The accuracy rate of the algorithm is 93.94%, the recall rate is 92.08%, and the F value is 0.93, which verifies that the malicious mirror webpage detection algorithm proposed in this paper is practical and effective.