Phishing netsite identification system and method

Abstract

The invention provides a phishing website identification system which comprises a feature extraction module, a feature vector dimensionality reduction module, a classification training module and an identification module. The feature extraction module is used for extracting page information and ranking information of websites and obtaining feature vectors; the feature vector dimensionality reduction module is connected with the feature extraction module and used for performing dimensionality reduction on the feature vectors to obtain the feature vectors undergoing dimensionality reduction; the classification training module is connected with the feature vector dimensionality reduction module and used for performing classification training on feature vectors, undergoing dimensionality reduction, of a known website to obtain classification models; the identification module is respectively connected with the classification training module and the feature vector dimensionality reduction module and used for saving the classification models, the classification models are used for identifying feature vectors, undergoing dimensionality reduction, of an unknown website, and whether the unknown website is a phishing website or not is judged. The phishing website identification system and a phishing website identification method enable website ranking and website content to be used as the feature vectors of the websites at the same time, and the website identification accuracy can be improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a phishing website identification system and method. Background technique [0002] With the popularity of e-commerce and online transactions, phishing has become one of the most serious forms of cybercrime. The so-called "phishing website" refers to criminals using various means to counterfeit the address and page content of the real website, or using loopholes in the server program of the real website to insert dangerous HTML codes into some web pages of the site to Defraud users of personal information such as bank or credit card account numbers and passwords. Due to the concealment of deception methods and the diversity of deception methods, phishing websites are often difficult for netizens to identify, resulting in serious losses. According to the statistics of China Internet Network Information Center, the number of phishing websites increased by 873,000 in the p...

AI Technical Summary

Problems solved by technology

[0011] Content-based detection techniques require the use of software tools, mainly Internet worms, to download website content and extract features that can identify phishing from website content. These techniques generally use powerful search techniques to ensure comprehensive retrieval Website content, and then use different machine learning methods to identify the website, but the current content-based detection technology still has a high false positive rate, and it is still difficult to meet the needs of practical applications

[0012] To sum up, the current research methods and technologies for detecting phishing websites mainly have the following problems: 1) The recognition rate of phishing websites is low when the URL address, domain name registration information, website ranking and other information are used as website features to identify phishing websites; 2) Most of the relevant research on the technology of intelligent phishing website identification based on webpage content and other information has high complexity and high false positive rate, and it is difficult to meet the detection and defense needs of the rapidly growing number of phishing websites

Images