CN102946391B - The method of prompting malice network address and a kind of browser in a kind of browser - Google Patents

Abstract

The invention discloses a method for prompting a malicious website in a browser and a browser, and relates to the technical field of the Internet. The method includes: setting a malicious website determination module in the browser, obtaining user input information in the browser address bar, obtaining a recommended website corresponding to the input information according to the input information, and determining the malicious website on the browser side The module initiates a request to judge whether the recommended website is a malicious website, and displays the judgment result of the malicious website judgment module on the recommended website on the browser side. The technical solution of the present invention can pre-judge and prompt malicious URLs when the user inputs information in the browser address bar, which speeds up the efficiency of malicious URL judgments, thereby solving the problem of the prior art when the user confirms that a certain URL is clicked. Malicious URLs are confirmed only when a URL initiates a request for the URL, so that the user does not know whether it is a malicious URL until the user clicks on the URL, and the experience is not good.

Description

A method for prompting malicious web addresses in a browser and a browser

technical field

The invention relates to the technical field of the Internet, in particular to a method for prompting malicious URLs in a browser and a browser.

Background technique

Malicious websites refer to maliciously planting Trojan horses, viruses and other malicious programs in the website, and induce users to visit the website through the disguised "website service content". Once entering these websites, the Trojan horses, viruses and other programs planted in the website will be triggered, resulting in The visitor's computer is infected, facing the danger of losing account or leaking private information. A web page linked to a horse refers to a web page embedded with a link to a Trojan horse website. Visiting these webpages will trigger an access request to the Trojan horse website. Once this access is successful, the visitor's computer will be infected, facing the danger of losing the account and leaking private information.

The existing "malicious website blocking" technology can prevent the user's computer from connecting to malicious websites, and prevent users from being harmed by webpages linked to horses, phishing websites, and malicious websites carrying viruses. Users can block malicious URLs through the "malicious URL blocking" function. Parent users can also block websites that are not suitable for teenagers to browse through this function, creating a green and healthy online environment for children. Because the website filtering function includes website blacklist and website whitelist, users can set suspicious or unsuitable network addresses to the website blacklist, and set trusted network addresses to the website whitelist. In addition, the malicious URL blocking function can also monitor specific port numbers, proxies, and suspicious programs.

The existing "malicious website blocking" technology is all performed when the user confirms clicking on a certain website and initiates a request for the website. After confirming that the website is malicious, the user will be prompted whether to continue loading. However, in this solution, the user only knows whether it is a malicious website after clicking on the website, which is not good for the user experience.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a method for prompting malicious URLs in a browser and a browser that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for prompting malicious URLs in a browser is provided, wherein a malicious URL determination module is set in the browser, and the method includes:

Obtain the user's input information in the browser address bar;

Acquiring a recommended website corresponding to the input information according to the input information;

Initiate a request to the malicious website determination module on the browser side to determine whether the recommended website is a malicious website;

Prompting and displaying the judgment result of the recommended website by the malicious website judgment module on the browser side.

Optionally, after initiating a request to the browser-side malicious URL judging module to judge whether the recommended URL is a malicious URL, the method further includes: for each URL in the recommended URL, the malicious URL judging module Judging whether the URL belongs to the white list, if the URL belongs to the white list, the malicious URL judging module judges the URL as credible.

Optionally, the method further includes: if the URL does not belong to the whitelist, the malicious URL judging module judges whether the URL belongs to the blacklist, if the URL belongs to the blacklist, query the server for the security information of the URL, and return the URL returned by the server The security information of the URL is used as the judgment result of the URL.

Optionally, the method further includes: if the URL does not belong to the whitelist or the blacklist, the malicious URL determination module initiates a cloud query request for the URL to the server, and uses the cloud query result of the URL returned by the server as the URL. URL verdict.

Optionally, the method further includes: caching the cloud query result returned by the server locally in the browser for use in subsequent determination of malicious URLs.

Optionally, the whitelist and/or blacklist are downloaded to the local browser after being updated on the server side.

Optionally, the input information is Chinese characters or English; the obtaining the recommended website corresponding to the input information according to the input information includes: matching the input information with the websites in the website collection to obtain more than one recommended website; Wherein, the URL collection includes at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server.

Optionally, prompting and displaying the judgment result of the recommended website by the malicious website judgment module on the browser side includes: displaying each recommended website in a drop-down prompt box in the address bar of the browser, and displaying the recommended website on the left side of the drop-down prompt box The corresponding judgment result of each recommended website is displayed on the side; or, the judgment result of the recommended website is displayed in the form of a pop-up window.

Optionally, when the browser initiates a request for the malicious website after receiving an instruction from the user to visit the recommended website that is determined to be a malicious website, the method further includes: intercepting the malicious website and/or prompting user.

Optionally, the method further includes: synchronously saving the whitelist, blacklist and cached cloud query results as personal data of the browser user.

According to another aspect of the present invention, a browser is provided, wherein the browser includes: a prompt module and a malicious URL determination module, wherein,

The prompt module is adapted to obtain user input information in the browser address bar, obtain the recommended website corresponding to the input information according to the input information, and initiate a judgment to the malicious website determination module whether the recommended website is a malicious website request, and display the judgment result of the recommended website by the malicious website judgment module on the browser side;

The malicious website judgment module is adapted to judge whether the recommended website is a malicious website according to the request of the prompt module, and return the judgment result to the prompt module.

Optionally, the malicious URL judging module includes: a storage submodule and a judging submodule, wherein,

The storage submodule is suitable for storing a white list;

The judging submodule is suitable for judging whether the URL belongs to the whitelist for each URL in the recommended URL, and if the URL belongs to the whitelist, then judge the URL as credible, and return the judgment result to the The above prompt module.

Optionally, the storage submodule is further adapted to save the blacklist;

The judging submodule is further suitable for judging whether the website belongs to the blacklist when the website does not belong to the whitelist, and if the website belongs to the blacklist, query the server for the security information of the website, and return the security information of the website returned by the server. The information is returned to the prompt module as the judgment result of the URL.

Optionally, the judging submodule is further adapted to initiate a cloud query request for the URL to the server when the URL does not belong to the whitelist or blacklist, and use the cloud query result of the URL returned by the server as the URL verdict.

Optionally, the malicious URL judging module further includes: a caching submodule;

The judging submodule is further adapted to save the cloud query result of the website returned by the server into the cache submodule;

The caching sub-module is adapted to save the cloud query result sent by the judging sub-module for subsequent use in judging malicious URLs.

Optionally, the malicious URL judging module further includes: an update download submodule;

The update downloading submodule is adapted to download the updated whitelist and/or blacklist from the server side and save them in the storage submodule.

Optionally, the prompt module is adapted to obtain user input information in Chinese characters or English in the address bar of the browser, and the input information is matched with the URLs in the URL collection to obtain more than one recommended URL; wherein, the The URL collection includes at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server.

Optionally, the prompt module is adapted to display each recommended website in a drop-down prompt box in the browser address bar, and display the corresponding judgment results of each recommended website on the left side of the drop-down prompt box; or, the prompt module, It is suitable for displaying the judgment result of the recommended website in the form of a pop-up window.

Optionally, the browser further includes: a malicious website blocking module, adapted to block the The URL is intercepted and/or the user is prompted through the prompt module.

Optionally, the browser further includes: a synchronous preservation module adapted to synchronously preserve the whitelist and blacklist in the storage submodule and the cloud query results in the cache submodule as personal data of the browser user .

According to the malicious website determination module set in the browser of the present invention, the input information of the user in the browser address bar is obtained, and the recommended website corresponding to the input information is obtained according to the input information, and the malicious website on the browser side is sent The website judgment module initiates a request to judge whether the recommended website is a malicious website, and prompts and displays the technical solution of the judgment result of the recommended website by the malicious website judgment module on the browser side, which can be displayed by the user in the browser address bar When inputting information, the malicious website is judged and prompted before the browser initiates an actual visit, which speeds up the efficiency of malicious website judgment, thereby solving the problem of the existing technology when the user confirms that a certain website is clicked to initiate a request for the website The confirmation of malicious URLs is carried out, so that users can only know whether it is a malicious URL after clicking the URL, and the problem of bad experience has obtained the prompt whether the user is a malicious URL during the process of inputting in the browser address bar, which improves beneficial effect on user experience.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same parts. In the attached picture:

FIG. 1 shows a flow chart of a method for prompting malicious URLs in a browser according to an embodiment of the present invention;

FIG. 2 shows a flow chart of a method for judging a malicious website in a malicious website judging module provided in a browser according to an embodiment of the present invention;

FIG. 3 shows a schematic diagram of prompting malicious URLs in a drop-down prompt box of a browser according to an embodiment of the present invention;

Fig. 4 shows a schematic structural diagram of a browser according to an embodiment of the present invention;

Fig. 5 shows a schematic structural diagram of a browser according to another embodiment of the present invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Fig. 1 shows a flowchart of a method for prompting malicious URLs in a browser according to an embodiment of the present invention. Wherein, a malicious website determination module is set in the browser, as shown in Fig. 1, the method includes:

Step S110, acquiring user input information in the address bar of the browser.

In an embodiment of the present invention, the obtained information input by the user in the address bar of the browser may be Chinese characters, English, or any other language.

Step S120, according to the input information, obtain the recommended website corresponding to the input information.

In an embodiment of the present invention, the input information may be matched with the URLs in the URL collection to obtain more than one recommended URL. The URL collection described here may include at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server. That is, in one embodiment of the present invention, the input information can be matched with the browser's local browsing history, local favorites, and URLs in the cloud URL provided by the server. The matched URL is the recommended URL, and the matched URL is the recommended URL. There may be one or more recommended URLs.

Step S130, sending a request to the malicious website determination module on the browser side to determine whether the recommended website is a malicious website.

Step S140, prompting and displaying the judgment result of the recommended website by the malicious website judgment module on the browser side.

In an embodiment of the present invention, each recommended website may be displayed in a drop-down prompt box in the address bar of the browser, and the corresponding determination results of each recommended website may be displayed on the left side of the drop-down prompt box. Or, in another embodiment of the present invention, the determination result of the recommended website is displayed in the form of a pop-up window.

Through the method shown in FIG. 1 , when the user inputs information in the browser address bar, that is, before the browser initiates an actual visit, the malicious website can be judged and prompted, which speeds up the efficiency of malicious website judgment. Compared with the prior art, the malicious URL is confirmed only when the user clicks on a certain URL to initiate a request for the URL, so that the user does not know whether it is a malicious URL until the user clicks the URL, which greatly improves the user experience.

In one embodiment of the present invention, the malicious website judgment module on the browser side can judge whether each website in the recommended website is a malicious website in the following manner: for each website in the recommended website, the malicious website judgment module judges the Whether the URL belongs to the white list, if the URL belongs to the white list, the malicious URL determination module determines the URL as credible. In this way, trusted URLs among recommended URLs can be confirmed.

In one embodiment of the present invention, after the malicious website judgment module on the browser side judges according to the white list, it can also make the following judgment: if a certain website does not belong to the white list, the malicious website judgment module judges whether the website belongs to Blacklist, if the URL belongs to the blacklist, query the security information of the URL from the server, and use the security information of the URL returned by the server as the judgment result of the URL. In this way, untrustworthy URLs in the recommended URLs can be further confirmed.

In one embodiment of the present invention, after the malicious website judgment module on the browser side judges according to the whitelist and blacklist, it can also make the following judgment: if a certain website does not belong to the whitelist or blacklist, then The malicious website determination module initiates a cloud query request of the website to the server, and uses the cloud query result of the website returned by the server as the determination result of the website. In this way, information on whether a batch of URLs in the recommended URLs are malicious URLs can be further supplemented.

In an embodiment of the present invention, the cloud query result returned by the server can also be cached locally in the browser for use in subsequent malicious website judgments. In this way, the efficiency of judging malicious URLs can be improved.

Here, both the blacklist and the whitelist are collections of URLs, wherein the URLs included in the blacklist are untrusted URLs, and the URLs included in the whitelist are trusted URLs. The blacklist and whitelist can be manually set by the user.

In one embodiment of the present invention, the whitelist, the blacklist, or both the whitelist and the blacklist are downloaded locally to the browser after being updated on the server side, so as to speed up the efficiency of the above-mentioned cloud query, otherwise the browser side may There are a lot of cloud query requests. Due to the confirmed blacklist and whitelist updated in time, the number of inquiries can be saved. In the case that the blacklist and whitelist are not updated in time, malicious URLs can be judged through the cloud query results cached locally in the browser, so that the blacklist and whitelist can be updated efficiently and accurately. judgment of malicious URLs.

Specifically, in one embodiment of the present invention, when a user enters keywords (Chinese characters, or English) in the address bar of the browser, the browser will perform local browsing history records, local favorites, and server The URL in the provided cloud URL is matched, and the matched URL is prompted in the drop-down prompt box in the address bar. Whether each URL in the drop-down prompt box is a malicious website is judged by the malicious website judgment module set in the browser, as shown in FIG. 2 .

Fig. 2 shows a flow chart of a method for judging a malicious website by a module for judging a malicious website in a browser according to an embodiment of the present invention. As shown in Figure 2, for each website (URL) that needs to be determined, the malicious website determination module performs the following steps:

Step S210, judging whether the URL belongs to the white list, if yes, execute step S220, otherwise execute step SS230.

In step S220, normal kernel rendering and loading is directly performed on the URL to display that it is a trusted URL. End this process.

Step S230, judging whether the URL belongs to the blacklist, if yes, execute step S240, otherwise execute step SS250.

Step S240, making a request to the NetShield server to check the security information of the URL, and the NetShield server returns the query result of the URL's security information, and the browser side displays the URL's security information. End this process.

Step S250, if there is no match in the blacklist and the whitelist, perform a cloud URL security query of the URL to the network shield server side, and return the cloud query to the browser side after any security information is detected by the network shield server query result.

Step S260, on the browser side, correspondingly display the cloud query result of the URL in the address prompt column, and cache the cloud query result locally in the browser. End this process.

It can be seen from the above-mentioned process shown in Fig. 2 that in this embodiment, for the URL to be judged, the malicious website judgment module first performs the judgment of the first round of black and white lists, if the URL neither belongs to the white list nor belongs to the black list list, the malicious URL judgment module performs the second round of cloud URL security query process. In this way, after passing the first and second rounds of judgment, it is possible to complete the judgment of whether the URL is a malicious website. For each URL that matches the key input by the user, the judgment shown in FIG. 2 is performed one by one to realize the judgment of all the matched URLs, and the judgment result is displayed in the drop-down prompt box of the browser address bar.

Fig. 3 shows a schematic diagram of prompting malicious URLs in a drop-down prompt box of a browser according to an embodiment of the present invention. As shown in FIG. 3 , in this embodiment, the matched recommended URLs are displayed on the left side of the browser's drop-down prompt box, and the judgment results of each recommended URL are correspondingly displayed on the right side of the drop-down prompt box.

In other embodiments of the present invention, the URL that is a malicious URL may also be prompted in the form of a bullet box.

According to the above-mentioned technical solution of the present invention, it is possible to realize the prejudgment of whether the matched URL is a malicious URL without opening the webpage, which satisfies the needs of users in terms of network security.

In one embodiment of the present invention, if the user still visits the recommended website that is determined to be a malicious website, the malicious website is further intercepted in the present invention. That is, after receiving an instruction from a user to access a URL that is determined to be a malicious website, when the browser initiates a request for the malicious website, it will block the malicious website or prompt the user, or block the malicious website and prompt the user .

In an embodiment of the present invention, the whitelist, blacklist and cached cloud query results can also be stored synchronously as personal data of the browser user. That is, when different users use different accounts to use the browser, the browser can provide different personalized services for users of different accounts. Users can set black and white lists according to their preferences under their own accounts. In this way, different network security services can be provided for different users according to their preferences.

Fig. 4 shows a schematic structural diagram of a browser according to an embodiment of the present invention. The browser 400 is capable of prompting malicious URLs. Referring to FIG. 4 , the browser 400 includes: a prompting module 410 and a malicious URL judging module 420 .

The prompting module 410 is adapted to obtain the user's input information in the browser address bar, obtain the recommended website corresponding to the input information according to the input information, and initiate a request to the malicious website determination module 420 to determine whether the recommended website is a malicious website, And display the judgment result of the recommended website by the malicious website judgment module 420 on the browser side;

The malicious website determining module 420 is adapted to determine whether the recommended website is a malicious website according to the request of the prompting module 410 , and return the determination result to the prompting module 410 .

The browser shown in FIG. 4 can judge and prompt malicious URLs when the user inputs information in the address bar of the browser, that is, before the browser initiates an actual visit, which speeds up the efficiency of judging malicious URLs. Compared with the prior art, the malicious URL is confirmed only when the user clicks on a certain URL to initiate a request for the URL, so that the user does not know whether it is a malicious URL until the user clicks the URL, which greatly improves the user experience.

Fig. 5 shows a schematic structural diagram of a browser according to another embodiment of the present invention. The browser 500 can prompt malicious URLs. Referring to FIG. 5 , the browser 500 includes: a prompting module 510 , a malicious URL judging module 520 and a malicious URL blocking module 530 .

The prompting module 510 is adapted to obtain the user's input information in the browser address bar, obtain the recommended website corresponding to the input information according to the input information, and initiate a request to the malicious website determination module 520 to determine whether the recommended website is a malicious website, And the browser prompts and displays the judgment result of the malicious website judgment module 520 on the recommended website.

Specifically, the prompting module 510 obtains the user's input information in Chinese characters or English in the address bar of the browser, matches the input information with the URLs in the URL collection, and obtains one or more recommended URLs. Wherein, the URL collection includes at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server.

The prompting module 510 may display each recommended website in a drop-down prompt box in the address bar of the browser, and display the corresponding determination results of each recommended website on the left side of the drop-down prompt box. Alternatively, the prompt module 510 may also display the determination results of each recommended website in the form of a pop-up window.

The malicious website determining module 520 is adapted to determine whether the recommended website is a malicious website according to the request of the prompting module 510 , and return the determination result to the prompting module 510 .

The malicious website interception module 530 is adapted to intercept the malicious website and/or pass the The prompt module prompts the user to further strengthen network security.

Here, the malicious website blocking module 530 is an optional module. In one embodiment of the present invention, if it is only necessary to pre-prompt the user which URLs are malicious URLs, and does not need to intercept or provide related prompts when the user actually visits the malicious URLs, the malicious URL blocking module 530 can be omitted.

The specific determination of whether the recommended website is a malicious website by the malicious website determining module 520 will be described in detail below. Specifically, in this embodiment, the malicious website determination module 520 includes: a storage submodule 521 , a determination submodule 522 , a cache submodule 523 , an update download submodule 524 and a synchronization storage submodule 525 .

Wherein, the storage submodule 521 is suitable for saving the white list. The judging sub-module 522 is adapted to judge whether each website in the recommended website belongs to the whitelist, if the website belongs to the whitelist, judge the website as credible, and return the judgment result to the prompt module 510 . In this way, trusted URLs among recommended URLs can be confirmed.

The storage submodule 521 can further save the blacklist. The judging submodule 522 can further judge whether the website belongs to the blacklist when the website does not belong to the whitelist, if the website belongs to the blacklist, query the server for the security information of the website, and use the security information of the website returned by the server as the The determination result of the URL is returned to the prompting module 510 . In this way, untrustworthy URLs in the recommended URLs can be further confirmed.

The judging sub-module 522 may further initiate a cloud query request of the URL to the server when the URL does not belong to the whitelist or blacklist, and use the cloud query result of the URL returned by the server as the judgment result of the URL. In this way, information on whether a batch of URLs in the recommended URLs are malicious URLs can be further supplemented.

The judging sub-module 522 may further save the cloud query result of the URL returned by the server in the caching sub-module 523 . The caching sub-module 523 saves the cloud query result sent by the judging sub-module 522 for subsequent use in judging malicious URLs. In this way, the efficiency and accuracy of judging malicious URLs can be improved.

The update download submodule 524 is adapted to download the updated whitelist and/or blacklist from the server side, and store them in the storage submodule 521 . This can speed up the efficiency of the cloud query of the judging sub-module 522, otherwise the judging sub-module 522 may have a large number of cloud query requests. Due to the confirmed blacklist and whitelist updated in time, the number of inquiries can be saved. In the case that the blacklist and the whitelist are not updated in time, the malicious website can be judged through the cloud query results stored in the cache submodule 523, so that the update of the blacklist and the whitelist can be performed efficiently and accurately. judgment of malicious URLs.

The synchronous saving module 525 is adapted to synchronously save the white list and black list in the storage sub-module 521 and the cloud query results in the cache sub-module 523 as personal data of the browser user. In this way, when different users use different accounts to use the browser, the browser can provide different personalized services for users of different accounts. Users can set black and white lists according to their preferences under their own accounts. In this way, different network security services can be provided for different users according to their preferences.

To sum up, in the present invention, the malicious website determination module is set in the browser to obtain the input information of the user in the address bar of the browser, obtain the recommended website corresponding to the input information according to the input information, and submit the browser to the browser. The malicious website judgment module on the server side initiates a request to judge whether the recommended website is a malicious website, and prompts and displays the technical solution of the judgment result of the recommended website by the malicious website judgment module on the browser side, which can be used when the user is browsing When inputting information in the browser address bar, the malicious website is judged and prompted before the browser initiates an actual visit, which speeds up the efficiency of malicious website judgment, thus solving the problem of the prior art when the user confirms clicking on a certain website to initiate the malicious website. Malicious URLs are confirmed only when the URL is requested, so that the user does not know whether it is a malicious URL until the user clicks on the URL. The problem of poor experience is that the user can obtain whether it is a malicious URL during the process of inputting in the browser address bar. The tips have beneficial effects that improve the user experience.

It should be noted:

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings), as well as any method or method so disclosed, may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the browser according to the embodiments of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (16)

1. A method for prompting a malicious website in a browser, wherein a malicious website determination module is provided in the browser, and the method includes before the browser initiates an actual visit: Obtain the user's input information in the browser address bar; the input information is written in Chinese characters, English or any other language; Obtaining the recommended URL corresponding to the input information according to the input information includes: matching the input information with the URLs in the URL collection to obtain more than one recommended URL; Wherein, the set of URLs includes at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server; Initiate a request to determine whether the recommended website is a malicious website to the malicious website judgment module on the browser side; the malicious website judgment module judges whether the recommended website is a malicious website according to the local white list and/or blacklist; Prompting and displaying the judgment result of the recommended website by the malicious website judgment module on the browser side, including: Each recommended URL is displayed in the drop-down prompt box in the address bar of the browser, and the corresponding judgment result of each recommended URL is displayed on the left side of the drop-down prompt box; or, The result of judging the recommended URL is displayed in the form of a pop-up window. 2. The method according to claim 1, wherein, after initiating a request to determine whether the recommended website is a malicious website to the malicious website determination module on the browser side, the method further comprises: For each URL in the recommended URLs, the malicious URL judging module judges whether the URL belongs to the white list, and if the URL belongs to the white list, the malicious URL judging module judges the URL as credible. 3. The method of claim 2, wherein the method further comprises: If the URL does not belong to the whitelist, the malicious URL judging module judges whether the URL belongs to the blacklist, if the URL belongs to the blacklist, query the server for the security information of the URL, and use the security information of the URL returned by the server as the URL of the URL judgement result. 4. The method of claim 3, wherein the method further comprises: If the URL does not belong to the whitelist or the blacklist, the malicious URL determination module initiates a cloud query request of the URL to the server, and takes the cloud query result of the URL returned by the server as the determination result of the URL. 5. The method of claim 4, wherein the method further comprises: The cloud query result returned by the browser's local cache server is used for subsequent judgment of malicious URLs. 6. The method of claim 3, wherein, The white list and/or black list are downloaded to the local browser after being updated on the server side. 7. The method according to any one of claims 1 to 6, wherein, when the browser initiates a request for the malicious website after receiving an instruction from the user to visit the recommended website that is determined to be a malicious website, the The method further includes: Block the malicious URL and/or prompt the user. 8. The method of claim 5, wherein the method further comprises: Synchronously save the whitelist, blacklist and cached cloud query results as personal data of browser users. 9. A browser, wherein the browser includes: a prompt module and a malicious URL determination module, wherein, The prompt module is adapted to obtain user input information in the browser address bar before the browser initiates an actual visit, obtain the recommended website corresponding to the input information according to the input information, and initiate a judgment to the malicious website determination module whether The recommended website is a request for a malicious website, and the browser prompts to display the judgment result of the recommended website by the malicious website judgment module; wherein, the input information is written in Chinese characters, English or any other language ; The malicious website judgment module is adapted to judge whether the recommended website is a malicious website according to the request of the prompt module and according to the local white list and/or blacklist, and return the judgment result to the prompt module; The prompting module is adapted to obtain the user's input information in the browser address bar, and the input information is matched with the URLs in the URL collection to obtain more than one recommended URL; Wherein, the set of URLs includes at least one of the following: local browsing history records of the browser, local favorites, and cloud URLs provided by the server; The prompt module is also suitable for displaying each recommended website in the drop-down prompt box of the browser address bar, and displays the corresponding judgment results of each recommended website on the left side of the drop-down prompt box; or, the prompt module is suitable for using The result of judging the recommended URL is displayed in the form of a pop-up window. 10. The browser as claimed in claim 9, wherein the malicious URL judging module comprises: a storage submodule and a judging submodule, wherein, The storage submodule is suitable for storing a white list; The judging submodule is suitable for judging whether the URL belongs to the whitelist for each URL in the recommended URL, and if the URL belongs to the whitelist, then judge the URL as credible, and return the judgment result to the The above prompt module. 11. The browser of claim 10, wherein: The storage submodule is further adapted to save the blacklist; The judging submodule is further suitable for judging whether the website belongs to the blacklist when the website does not belong to the whitelist, and if the website belongs to the blacklist, query the server for the security information of the website, and return the security information of the website returned by the server. The information is returned to the prompt module as the judgment result of the URL. 12. The browser of claim 11, wherein: The judging submodule is further adapted to initiate a cloud query request of the URL to the server when the URL does not belong to the whitelist or blacklist, and use the cloud query result of the URL returned by the server as the judgment result of the URL . 13. The browser according to claim 12, wherein, the malicious URL judging module further comprises: a caching submodule; The judging submodule is further adapted to save the cloud query result of the website returned by the server into the cache submodule; The caching sub-module is adapted to save the cloud query result sent by the judging sub-module for subsequent use in judging malicious URLs. 14. The browser as claimed in claim 11, wherein the malicious URL determination module further comprises: an update download submodule; The update downloading submodule is adapted to download the updated whitelist and/or blacklist from the server side and save them in the storage submodule. 15. The browser according to any one of claims 9 to 14, wherein the browser further comprises: a malicious website blocking module; The malicious website interception module is suitable for intercepting the malicious website and/or passing The prompting module prompts the user. 16. The browser according to claim 13, wherein the browser further comprises: a synchronous storage module; The synchronous storage module is suitable for synchronously storing the white list and black list in the storage sub-module and the cloud query results in the cache sub-module as personal data of the browser user.