Phishing website detection method based on uniform resource locator (URL) classification

Abstract

The invention discloses a phishing website detection method based on uniform resource locator (URL) classification. Firstly, a modeling is performed for URL characteristics, a method specific to a domain name imitation phenomenon of the characteristics is provided for calculating the similarity between a suspicious domain name and a protected domain name by a dynamic programming thought, in order to collect phishing URL high frequency suspicious character features, a suspicious character extraction algorithm based on a generalized suffix tree is provided, then on the basis of characteristic modeling, a support vector machine (SVM) algorithm is utilized to perform classified training for experimental training set, a SVM classification model is obtained after the training, the SVM classification model is used for classifying the URL to be detected, and a server for detecting a phishing website updates the current SVM classification model according to a specific online incremental learning strategy.

Description

technical field [0001] The invention relates to the field of network security, relates to an anti-phishing method, in particular to a method for detecting phishing websites based on URL classification. Background technique [0002] Phishing attacks have become a major threat to the current online transaction security, which has greatly hindered the development of e-commerce, so the research on phishing prevention has become a hot issue in the field of network security. The scale of phishing websites has doubled year by year. From the perspective of machine learning and pattern recognition, a large number of phishing websites have shown a traceable pattern, which brings certain applications to the learning and classification of pattern recognition methods. space. [0003] The existing methods for identifying phishing websites based on pattern recognition mainly include: [0004] 1. Phishing email detection method based on email features. The main method is to find out a se...

AI Technical Summary

Problems solved by technology

[0007] The current phishing detection methods have certain deficiencies. Whether it is based on email features or webpage features, the overall analysis of the email or webpage content must be carried out, which may cause the following problems. Certain detection features may be missing; second, the overall analysis of emails or webpages takes a long time, which may exceed the network delay that users can tolerate from an application point of view; third, when legitimate emails or webpages of the protected organization are updated, The testing agency does not have a corresponding linkage mechanism

Images