A multi-level phishing website detection method and detection system based on supervised learning

Abstract

The invention relates to a multi-level phishing website detection method and detection system based on supervised learning. The first detection layer uses a blacklist database or a whitelist database to judge phishing websites, and the matching is directly output. Otherwise, the second detection layer extracts the phishing website to be detected. The characteristics of the website URL and build a classifier model based on the URL characteristics of known phishing websites for detection. If it is detected as a suspicious website, the third detection layer downloads the page of the website to be detected, obtains the page content characteristics, and constructs it based on the content characteristics of known phishing websites. The classifier model detects, and the output terminal outputs whether the website to be detected is a phishing website or a normal website, and the data is added to the blacklist database and the whitelist database. The first-level black-and-white list of the present invention judges known websites, reduces the detection cost, the second-level URL detection distinguishes clear phishing websites or normal websites, and the third-level page content detection identifies suspicious websites detected by the second level, and the judgment results are accurate; the identification results Accurate and short detection time.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, and in particular to a multi-level phishing website detection method and detection system based on supervised learning with high detection accuracy and short running time. Background technique [0002] Internet phishing fraud, referred to as phishing, means that attackers trick users into clicking and visiting fake and counterfeit phishing websites by sending deceptive spam emails, instant messaging messages, etc. or credit card and other detailed information, the attacked user may lose personal private information, or suffer serious economic losses, causing extremely bad effects. This type of attack has become one of the biggest security threats to the current Internet. The main characteristics of current phishing websites are that the relevant pages are hidden more and more deeply, the URL structure is more and more compl...

AI Technical Summary

Problems solved by technology

[0007] The technical problem solved by the present invention is that the phishing website detection in the prior art has the defects that the detection of the page content characteristics is not comprehensive enough, the detection accuracy is low, the black and white list detection has hysteresis, and the new phishing website cannot be detected, and the running time is long. , and then provides an optimized multi-level phishing website detection method and detection system based on supervised learning