Method and apparatus for identifying malicious website

An apparatus for identifying a malicious website, comprising:

• a sample acquisition unit, configured to acquire uniform resource locators (URLs) of websites determined as malicious websites and URLs of websites determined as safe websites;
• a feature extraction unit, configured to perform feature extraction on the URLs, acquired by the sample acquisition unit, of the malicious websites to obtain a first feature character set and perform feature character extraction on the URLs of the safe websites to obtain a second feature character set;
• and
• a feature judgment unit, configured to determine whether a frequency of a first feature character obtained by feature extraction in the first feature character set is higher than a frequency in the second feature character set, and if the frequency of the first feature character in the first feature character set is higher than the frequency in the second feature character set, add the first feature character into a malicious feature library, feature characters in the malicious feature library being used for identifying a malicious website.

A non-instantaneous computer readable storage medium, storing computer executable instructions thereon, and when these executable instructions are run in a computer, executing the following steps:

• acquiring uniform resource locators (URLs) of websites determined as malicious websites and URLs of websites determined as safe websites;
• performing feature extraction on the URLs of the malicious websites to obtain a first feature character set, and performing feature character extraction on the URLs of the safe websites to obtain a second feature character set;
• and
• determining whether a frequency of a first feature character obtained by feature extraction in the first feature character set is higher than a frequency in the second feature character set, and if the frequency of the first feature character in the first feature character set is higher than the frequency in the second feature character set, adding the first feature character into a malicious feature library, feature characters in the malicious feature library being used for identifying a malicious website.