Method for detecting phishing webpage based on nearest neighbour and similarity measurement

Abstract

The invention relates to a method for detecting a phishing webpage based on nearest neighbour and similarity measurement, which comprises the following steps: a picture of a whole image of a webpage is taken as a start point, and the characteristic of unchanged dimension conversion is extracted; similar characteristics at phishing webpage detection stage are quickly queried, and are then submitted to a machine leaning and matching module to carry out identification; the machine leaning and matching module extracts characteristic data transmitted during a system training stage to carry out training, so that a parameter of webpage similarity threshold can be optimized; during the phishing webpage detection stage, the characteristic data transmitted by the characteristic extracting module is received, the similarity between webpages is calculated, and finally, the phishing webpage is judged according to the webpage similarity threshold; in addition, a sorting method-Bayesian addable regression tree is added to predict suspicious webpages; and the characteristics during the phishing webpage detection process are extracted to be used as an evidence of the phishing webpage detection, so that the high accuracy can be ensured, and simultaneously, the webpage detection time can be remarkably reduced.

Description

Technical field [0001] The invention relates to a method for detecting phishing webpages, which mainly extracts feature values ​​from the overall visual characteristics of the webpage and performs corresponding feature value distance calculations to match and identify the phishing webpages, belonging to the field of information security. Background technique [0002] Phishing websites are online frauds that have become extremely rampant with the popularity of the Internet and the increase in online transactions. Phishing websites are scam websites made by criminals. Phishing websites are usually almost identical to bank websites or other well-known websites, thus enticing website users to submit sensitive information (such as usernames, passwords, bank accounts or credit cards) on phishing websites. Details, etc.) [Zhang2007]. [0003] figure 1 It is the architecture of the phishing website. The most typical phishing attack process is as follows: First, lure users to a phishing w...

AI Technical Summary

Problems solved by technology

According to Gesta's visual principle, relative position plays a major role in human vision, especially the relative positional relationship between multiple shapes. Changes in relative positional relationship will inevitably lead to visual differences, and the algorithm does not consider relative positional factors. May lead to failure of similarity detection, so this method can only detect web pages that are visually similar to real web pages

Images