System and method for distinguishing phishing websites

Abstract

The invention provides a system for distinguishing phishing websites. The system comprises a page crawling module, a feature extracting module, a webpage relationship modeling module, a decision tree classification module and a distinguishing module. The page crawling module crawls page source codes of the websites and extracts Chinese texts and internal / external link numbers of the websites. The feature extracting module extracts page feature words, the internal / external link numbers and ranking information of the websites. The webpage relationship modeling module acquires relationships between the websites and black / white lists according to the page feature words. The decision tree classification module utilizes decision trees for training and creating decision tree classification models. The distinguishing module stores the decision tree classification models and distinguishing whether unknown websites are phishing websites or not according to the decision tree classification models. By the system, accuracy of classification distinguishing can be effectively improved, and limitation that detecting techniques based on black lists can only identify phishing websites in the black lists can be overcome. The invention further provides a method for distinguishing the phishing websites.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a phishing website identification system and method. Background technique [0002] With the rapid development of the Internet and the deepening of the informatization process, people's work, study and lifestyle have become more and more closely integrated with the Internet. Instant messaging, e-mail, e-commerce, online games, online office, etc. are closely related to daily life. However, following the development of informatization, information security issues have become increasingly prominent, and cybercrimes emerge in endlessly. Phishing is one of the most serious forms of Internet crime, and it has become more frequent in recent years. The so-called "phishing website" refers to criminals using various means to counterfeit the address and page content of the real website, or using loopholes in the server program of the real website to insert dangerous HTML codes in...

AI Technical Summary

Problems solved by technology

[0011] However, there are still some problems in the current research methods and technologies for detecting phishing websites: 1) Manual reporting and identification requires personal experience, and the efficiency is relatively low; 2) Blacklist-based detection technology can only identify phishing websites in the blacklist phishing websites, but it is impossible to accurately identify new phishing websites that emerge in an endless stream; 3) The false positive rate of heuristic-based identification technology is high, because it is necessary to accurately extract features that can represent website information, and the existing methods are not perfect

Images