Pre-fetching-based fishing web page detection method

Abstract

The invention discloses a pre-fetching-based phishing web page detection method, and relates to the acquisition of website information and the extraction and classification of topological characteristics and mainly aims to solve problems on phishing web page detection capacity. In the method, a user interface module 1 serves as an interface, a master control module 2 serves as a center, and a classifier module 3, a characteristic extraction module 4 and a web page extraction module 5 are scheduled, wherein the classifier module needs training in a training set and adopts an incremental updating mode to ensure that a classifier keeps capacity in the detection of new phishing web pages; the characteristic extraction module mainly extracts the pre-fetched characteristics of topological website structures, saves the characteristics into a training set database and simultaneously transmits the characteristics to the classifier module; and the web page extraction module captures a certain number of web pages of a given website according to an instruction of the master control module and saves the web pages into a web page database. Through the pre-fetching-based phishing web page detection method provided by the invention, both accuracy and recall rate are greatly improved.

Description

technical field [0001] The invention relates to a method for detecting phishing websites, which mainly analyzes and identifies phishing webpages from the perspective of website topology through prefetching technology, and belongs to the intersecting field of information security and information acquisition. Background technique [0002] "Phishing website" is an online fraud that has become extremely rampant with the popularity of the Internet and the increase in online transactions. "Phishing websites" are fraudulent websites made by criminals. "Phishing websites" are usually almost identical to bank websites or other well-known websites, thereby attracting website users to submit sensitive information (such as user names) on "phishing websites" , password, account ID, ATM PIN or credit card details, etc.). The most typical phishing attack process is as follows: first, lure users to a carefully designed phishing website that is very similar to the target organization's webs...

AI Technical Summary

Problems solved by technology

[0008] After research using crawlers as a tool, it was found that the topology of large-scale websites is very complex, with thousands of pages and tens of thousands of links inside the website; the topology of small and medium-sized websites is also relatively complicated, with hundreds of pages inside the website; but phishing The topology of the website is surprisingly simple (such as figure 1 ), most of the official websites imitated by phishing websites are bank websites, with many users and large amount of data. The website structure is formed by a multi-person team after a long period of development and maintenance.

Although a few pages of phishing websites realistically imitate regular websites, it is difficult to make the topology complexity of the website comparable to that of regular websites because they are developed and deployed by a small number of criminals in a short period of time.

Images