摘要：

车载第三方服务访问恶意网站的数量迅速增加, 已成为车联网(IoV)安全的重大威胁。目前, 车联网恶意网站检测面临三大瓶颈: 传统工具处理大规模网站数据时存在较长的检测时延, 恶意网站统一资源定位符(URL)混淆问题影响识别准确性, 且恶意网站数据集的获取困难, 这些因素均严重制约了检测的效率和准确性。针对这些问题, 本文提出一种基于逻辑回归的多阶段恶意网站快速检测方法。使用搜索引擎对合法网站进行初步过滤, 减少计算资源的浪费。通过对恶意混淆技术的分析归纳, 设计匹配规则, 并提出一种基于启发式规则的恶意网站过滤方法, 实现混淆网站URL的有效过滤, 克服了传统工具无法有效检测带有恶意混淆URL的问题。为进一步提升检测准确性, 构建全面且轻量的恶意网站检测特征集合, 并使用逻辑回归分类方法对特征进行提取分析。实验结果表明, 该方法在恶意网站检测的准确性和效率方面显著优于传统方法, 在公开数据集上达到98.1%的准确率, 检测时间减少了75%左右。

关键词: 车联网, 恶意网站, 过滤与检测, 启发式规则, 机器学习

Abstract:

The number of malicious websites accessed by in-vehicle third-party services has been rapidly increasing, posing a significant threat to the security of the Internet of Vehicles (IoV). Currently, three major challenges exist for IoV malicious website detection: traditional tools exhibit high detection latency when processing large-scale website data, the presence of obfuscated malicious Uniform Resource Locators (URLs) reduces detection accuracy, and the difficulty in obtaining malicious website datasets further hinders effective detection. Collectively, these factors limit the efficiency and accuracy of detection. To address these issues, this study proposes a fast multi-stage malicious website detection method based on logistic regression. This method uses search engines for the preliminary filtering of legitimate websites to reduce computational resource wastage. It designs matching rules through the analysis and summarization of malicious obfuscation techniques and introduces a heuristic rule-based malicious website filtering method to effectively filter obfuscated website URLs, overcoming the limitations of traditional tools in detecting URLs with malicious obfuscation. To further enhance the detection accuracy, it constructs a comprehensive and lightweight set of malicious website detection features and employs logistic regression classification for feature extraction and analysis. Experimental results demonstrate that the proposed method significantly outperforms traditional methods in terms of accuracy and efficiency in malicious website detection, achieving an accuracy of 98.1% on public datasets and reducing the detection time by approximately 75%.

Key words: Internet of Vehicles (IoV), malicious website, filtering and detection, heuristic rules, machine learning