Three-layer phishing website detection system based on hybrid method

Abstract

The invention discloses a three-layer phishing website detection system based on a hybrid method. The detection system is composed of three layers: a first layer of black and white list, a form filtering layer, a second layer of favicon detection layer and a third layer of machine learning detection layer; Layers of black and white lists and form filtering layers can detect known phishing websites in time and reduce the cost of detection. The second layer of favicon detection layer can identify the real identity of the website through faviocn to detect phishing websites, which is faster and does not need to consume too many resources. The third layer of machine learning detection layer can accurately identify the websites judged as suspicious by the second layer, and obtain more accurate judgment results. The three levels of detection not only ensure the accuracy of recognition results, but also reduce the detection time as much as possible.

Description

technical field [0001] The invention relates to a website detection system, in particular to a three-layer phishing website detection system based on a hybrid method. Background technique [0002] Phishing is a fraudulent practice used to deceive users over the Internet, and attackers who initiate phishing attacks are often referred to as phishers. The International Anti-Phishing Working Group (APWG, Anti-Phishing Working Group) defines phishing as: Phishing is a form of network attack that uses social engineering and technical means to steal consumers' personal identity data and financial accounts certificate. Phishing attacks using social engineering methods usually send deceptive emails, text messages, etc. to users to lure them into disclosing credential information (such as usernames and passwords) or downloading malicious software. The attack by technical means is to directly transplant malicious software on the PC (such as MitB, man-in-the-browser attack), and use c...

AI Technical Summary

Problems solved by technology

The method flow is as follows figure 1 As shown, the disadvantage of this patent: this method needs to maintain the database, frequent updates to ensure timeliness

The detection process is as figure 2 As shown: the disadvantages of this patent: 1. Divide the webpage to be inspected into blocks, select the block location and other features, these features will become invalid after the phisher fine-tunes the structure of the webpage

2. Select features such as the DOM tree, which will be invalid when fishermen use pictures instead of text

Images