A multi-stage phishing website detection method and system

Abstract

The present invention discloses a multi-stage phishing website detection method and system, and combines means of both fast filtering and accurate filtering. Multiple stages of fast filtering are used to control the number of potential phishing websites to be in a relatively small range; furthermore, an accurate determination model is trained by analyzing statistical features of positive and negative samples in a small range. The method comprises the following steps: selecting a to-be-detected range of websites to perform fast filtering and excluding obvious non-phishing websites therefrom; and performing accurate determination on the remaining range of the websites after the fast filtering to determine whether said websites are phishing websites. The system comprises: a fast filtering module, configured to select a range of to-be-detected websites to perform fast filtering and exclude obvious non-phishing websites therefrom; and an accurate determination module, configured to perform accurate determination on the remaining range of the to-be-detected websites after the fast filtering.

Description

technical field [0001] The invention relates to the field of information technology, in particular to the field of network security technology, in particular to a multi-stage phishing website detection method and system. Background technique [0002] Today, the Internet has become an important part of people's social life, but with the continuous popularization of the Internet and the continuous improvement of application levels, in addition to traditional information security threats such as Trojan horses, viruses, and botnets, Internet phishing fraud has gradually become a One of the top attack vectors for cybercriminals. [0003] Internet phishing (phishing) is a new word commonly used in the world. The first two letters ph of phreak (the person who steals the phone line) are replaced with the f of fishing (fishing). It is a combination of social engineering (that is, deception) and network communication technology. Cybercrime means. The purpose of Internet phishing is ...

AI Technical Summary

Problems solved by technology

If the model learned based on the above machine learning algorithm is to achieve good results in the actual Internet, a necessary condition is that the training samples need to cover various Internet pages. However, most of the existing anti-phishing technology research is based on relatively small sample sets to verify the algorithm Effectiveness, some sample sets even contain only dozens of samples, and its generalizability is doubtful

In addition, even if the sample set is really large enough to cover all kinds of samples, and all kinds of samples conform to the proportion of the actual Internet, considering that phishing detection is an extremely unbalanced problem (that is, there are only hundreds of thousands of websites in the world's billion-level websites every year. Phishing websites), it is difficult to achieve good detection results by directly using existing pattern classification algorithms

Images