Method, system, client and server for detecting phishing fraud webpage based on feature library

Abstract

The invention discloses a method, a system, a client and a server for detecting a phishing fraud webpage based on a feature library. The method includes the steps: acquiring a feature ID (identification) corresponding to each content fragment according to a plurality of content fragments of an extracted page, matching the feature ID corresponding to the content fragments with the feature ID in the feature library, preliminarily identifying the page, considering the page as a possible malicious page if the feature ID corresponding to the content fragments is matched with a feature ID in the feature library, and calculating an assessment score of the page according to information of the page; processing page access behaviors according to comparative results of the assessment score of the page and a set threshold value. According to the scheme, a plurality of content fragments in the page and multi-term page information are combined when the page is identified, and the scheme efficiently identifies malicious/fraud/phishing pages by the aid of the feature library and comprehensive scores of the page information without relying on a black and white list database of the server.

Description

Technical field [0001] The present invention relates to the technical field of the Internet, in particular to a method, a system, a client and a server for detecting phishing fraudulent web pages based on a feature database. Background technique [0002] With the development of the Internet, WEB-based applications have become more and more popular. People can query bank accounts, online shopping, e-commerce, query information, obtain knowledge, entertain, etc. through the browser. WEB provides people with a convenient and fast way of interaction. However, people often encounter attacks from malicious websites while surfing the Internet, causing their computers to be infected by viruses and Trojan horses. [0003] Malicious websites, such as phishing websites, or fraudulent or counterfeit websites, are mainly used to fake the URL address or page content of the real website, disguise it as a bank or e-commerce website, or use loopholes in the server program of the real website , Ins...

AI Technical Summary

Problems solved by technology

[0004] The existing main means to prevent malicious websites is that when a user visits a certain website, the client sends the URL of the website to the black and white list database on the server side for query. The detection rate of the website is not high and lagging

Or use a text-based method for identification, such as extracting keywords from the page, uploading the keywords to the server, and matching them in the blacklist database. This method is relatively inefficient and is easily affected by factors such as the order of words. High false positive rate

Images