Malicious SP subscription verification method

The present invention discloses a malicious SP subscription verification method. The method includes the following steps that: S1, a malicious program feature library is established, malicious mastercontrol features are extracted, data packets are captured at a network side, the data packets are parsed, so that a suspected malicious SP subscription user is searched; S2, the access domain name orIP of the suspected malicious SP subscription user is collected, malicious SP subscription analysis is performed, whether the suspected malicious SP subscription user is a malicious SP subscription user is judged, if the suspected malicious SP subscription user is a malicious SP subscription user, a step S3 is executed; and S3, the behavioral log data, malicious subscription data and SP short message sending records of the malicious subscription user are verified, evidences of malicious SP subscription are collected. According to the malicious SP subscription verification method of the invention adopted, packet capture