Method and device for detecting phishing webpage based on picture matching

Abstract

The invention discloses a method and a device for detecting a phishing webpage based on picture matching. The execution of the method is based on a pre-established picture rule base including a plurality of first pictures and second pictures. The method comprises the steps of screen-shooting a webpage opened by a browser to obtain a third picture; calculating similarity of the third picture and all first pictures in the picture rule base; sequencing all the first pictures in the picture rule base according to the similarity, selecting a plurality of first pictures according to the sorted sequence, wherein the quantity of the selected first pictures is less than the total quantity of the first pictures in the picture rule base; and matching the third picture with the second pictures corresponding to the selected first pictures, and if at least one of the second pictures corresponding to the selected first pictures is matched with the third picture, determining that the webpage is a suspicious phishing webpage. In the picture method, the matching quantity is simplified by calculating the similarity, and the result that the webpage is the suspicious phishing webpage can be rapidly and accurately judged based on the picture matching.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method and device for detecting phishing webpages based on picture matching. Background technique [0002] With the development of the Internet, WEB-based applications are becoming more and more popular. People can query bank accounts, online shopping, e-commerce, query information, acquire knowledge, and perform entertainment through browsers. WEB provides people with a convenient and fast way of interaction. However, when people are surfing the Internet and browsing the web, they often encounter attacks from malicious websites, causing computers to be infected by viruses, Trojan horses, and the like. [0003] Malicious websites, such as phishing websites, or fraudulent, counterfeit websites, etc., mainly fake the URL address or webpage content of the real website, pretend to be banking and e-commerce websites, or use loopholes in the real website server program , insert...

AI Technical Summary

Problems solved by technology

[0004] The existing main means to prevent malicious websites is that when a user visits a certain website, the client sends the URL of the website to the black and white list database on the server side for query. The detection rate of the website is not high and lagging

Or use a text-based method for identification, such as extracting keywords from the page, uploading the keywords to the server, and matching them in the blacklist database. This method is relatively inefficient and is easily affected by factors such as the order of words. High false positive rate

Images