Phishing security verification method, system and device and storage medium

Abstract

The invention discloses a phishing security verification method, system and device and a storage medium, and relates to the field of network security. In the method, a domain name of a webpage link to be verified is collected, risk assessment is performed on the domain name to identify a target domain name, the risk assessment comprises blacklist comparison, domain name feature analysis and historical record query, and the target domain name refers to the domain name with the risk higher than a first threshold value; performing phishing risk verification on the target domain name to determine a risk level of the target domain name, wherein the phishing risk verification comprises assessment of domain name registration information, historical behaviors and similarity; determining the priority of the target domain name according to a sorting parameter, wherein the sorting parameter comprises a risk level, a user access history and a domain name reputation; and sorting the target domain names according to the priorities from high to low, and displaying the domain names with different priorities by adopting different colors and icons. By implementing the technical scheme provided by the invention, the accuracy and effectiveness of phishing protection are improved.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a phishing security verification method, system, device and storage medium. Background Art

[0002] With the rapid development of Internet technology, phishing attacks have become increasingly rampant, posing huge security risks to individuals and businesses. Phishing websites usually disguise themselves as regular websites to lure users into providing personal information, resulting in privacy leaks and property losses.

[0003] At present, anti-phishing tools on the market mainly rely on blacklist filtering and static feature detection. Although these methods can identify known phishing websites to a certain extent, they are powerless against newly emerged and deformed phishing websites. In addition, the existing technology lacks a comprehensive assessment of the risk level of phishing websites, as well as a security reminder function tailored to the personalized needs of users.

[0004] Therefore, how to provide a phishing security verification method and its execution system that can comprehensively and dynamically assess phishing risks and provide intuitive safety prompts has become a problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a phishing security verification method, system, device and storage medium, which integrates risk assessment and phishing risk verification, can more comprehensively and dynamically identify phishing websites and determine their risk levels, thereby improving the accuracy and effectiveness of phishing protection.

[0006] In a first aspect of the present application, a phishing security verification method is provided, which is applied to a network security verification platform. The security verification method includes: Collecting domain names of web page links to be verified, and performing risk assessment on the domain names to identify target domain names, wherein the risk assessment includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; Performing phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; Determining the priority of the target domain name according to sorting parameters, wherein the sorting parameters include risk level, user access history, and domain name reputation; The target domain names are sorted from high to low according to the priority, and domain names of different priorities are displayed using different colors and icons.

[0007] By adopting the above technical solutions, and using a variety of risk assessment methods such as blacklist comparison, domain name feature analysis, and historical record query, it is possible to more comprehensively identify potential high-risk domain names (i.e., target domain names). This method is more accurate and effective than a single risk assessment method, and can significantly improve the recognition rate of phishing websites. Further phishing risk verification of the target domain name, including evaluation of domain name registration information, historical behavior, and similarity, can more accurately determine the risk level of each target domain name. This detailed assessment helps users or security teams have a clearer understanding of the risks, so that more targeted preventive measures can be taken. According to sorting parameters such as risk level, user access history, and domain name reputation, the target domain names are prioritized and displayed in different colors and icons. This intuitive display method allows users or security personnel to quickly identify the domain names with the highest risk, so that these high-risk domain names can be handled first, improving the efficiency and effectiveness of security response.

[0008] Optionally, performing risk assessment on the domain name to identify the target domain name includes: Compare the domain name to be verified with a known malicious domain name blacklist, and determine the first score of the domain name based on the comparison result; Determine the second score of the domain name based on the length, character combination, and whether there are spelling errors in the domain name; The third score of the domain name is determined based on the domain name's historical registration record and the frequency of IP address changes; A first total score of the domain name is determined according to the first score, the second score, and the third score, and a domain name whose first total score exceeds a first total score threshold is determined as a target domain name.

[0009] By adopting the above technical solution, by comparing the domain name to be verified with the known malicious domain name blacklist, the domain name that has been clearly marked as malicious can be quickly identified, thereby effectively reducing false positives and false negatives. At the same time, by combining the characteristics of the domain name length, character combination, and spelling errors for analysis, domain names that may deceive users through disguise or misleading means can be further screened out, thereby improving the accuracy of identification. Risk assessment not only relies on the single dimension of blacklist comparison, but also combines multiple aspects such as the historical registration record of the domain name and the frequency of IP address changes. Historical registration records can reveal the changes in the ownership of the domain name. Frequent changes may mean that the domain name is used for illegal activities. The frequency of IP address changes can reflect the stability of the domain name. Frequent IP changes may mean that the domain name is used to quickly switch attack targets or hide the true identity. This multi-dimensional assessment method makes the risk assessment more comprehensive and in-depth. By assigning scores to the evaluation results of different dimensions (i.e., the first score, the second score, and the third score), and combining these scores to form the first total score of the domain name, the risk level of the domain name can be quantified. This quantification method makes the risk level more intuitive and comparable, which helps users or security teams take corresponding preventive measures according to the risk level. By setting the first total score threshold, domain names with higher risks can be efficiently screened out as target domain names for further processing. This screening method not only reduces processing time, but also improves processing efficiency, allowing limited resources to be focused on the most critical areas.

[0010] Optionally, performing phishing risk verification on the target domain name to determine the risk level of the target domain name includes: determining a fourth score of the domain name based on the authenticity of the domain name registration information, the domain name registration information including name, address, contact number and email address; Using a web crawler or a search engine to find a DNS resolution record of the domain name, and determining a fifth score of the domain name according to the DNS resolution record; comparing the domain name to a known brand name, trademark, or domain name for similarity using a string processing function or a regular expression, and determining a sixth score for the domain name based on the similarity; A second total score of the domain name is determined according to the fourth score, the fifth score, and the sixth score, and a risk level of the domain name is determined according to the second total score.

[0011] By adopting the above technical solutions, through detailed verification of multiple dimensions, including the authenticity of domain name registration information, the legitimacy of DNS resolution records, and the similarity of domain names to known brand names, trademarks or domain names, this method can dig deeper into potential phishing risks. Verification of each dimension provides unique information, which can significantly improve the accuracy and reliability of risk assessment in combination. The authenticity of domain name registration information is an important factor in assessing the credibility of domain names. By verifying the authenticity of information such as name, address, contact number and email address, domain names registered with false information can be identified, which are often associated with malicious activities. Emphasizing the authenticity of registration information can help reduce the risk of phishing attacks. DNS resolution records are an important part of the domain name system, which records the mapping relationship between domain names and IP addresses. By analyzing DNS resolution records, some abnormal DNS behaviors can be found, such as frequent IP address changes, resolution pointing to malicious servers, etc. These abnormal behaviors are often precursors to phishing attacks. By timely discovering and handling these behaviors, phishing attacks can be effectively prevented. By comparing the similarity of domain names with known brand names, trademarks or domain names, domain names that attempt to deceive users by confusing them can be discovered in a timely manner. This method helps protect the legitimate rights and interests of brands and trademarks and prevents them from being maliciously exploited for phishing attacks. At the same time, for consumers, this verification method also provides additional security, allowing them to more easily identify genuine brand websites. By combining the fourth score, the fifth score, and the sixth score to determine the second total score of the domain name, and determining the risk level of the domain name based on the total score, this method makes the risk level clearer and quantifiable. This helps users or security teams set priorities based on risk levels and give priority to those domain names with higher risks, so as to more effectively deal with phishing attacks. At the same time, this quantitative method also makes the risk assessment results more intuitive and easy to understand, improving the overall security management level.

[0012] Optionally, the using a web crawler or a search engine to search for a DNS resolution record of the domain name, and determining the fifth score of the domain name according to the DNS resolution record includes: Regularly query the domain name DNS resolution record to determine the number of DNS changes in the past preset time period; When the number of changes is less than a first number threshold, determining the fifth score as a first benchmark score; When the number of changes is greater than or equal to a first number threshold and less than a second number threshold, determining that the fifth score is a second benchmark score, and the second benchmark score is greater than the first benchmark score; When the number of changes is greater than or equal to a second number threshold, the fifth score is determined to be a third benchmark score, and the third benchmark score is greater than the second benchmark score.

[0013] By adopting the above technical solution, by regularly querying the DNS resolution record of the domain name and paying attention to the number of changes, the DNS stability of the domain name can be dynamically monitored. Frequent changes in DNS may mean that the domain name is used for illegal activities, such as phishing attacks, rapid switching of attack targets, etc. Therefore, this method helps to timely discover and respond to potential security risks. The number of DNS changes is compared with the preset threshold, and different benchmark scores are determined according to the comparison results. This method realizes the quantitative assessment of the risk of DNS changes. Different benchmark scores reflect different risk levels, allowing users or security teams to more intuitively understand the DNS risk status of the domain name. By setting the first number threshold and the second number threshold, the sensitivity of the number of DNS changes can be flexibly adjusted according to actual needs and security policies. This flexibility enables the present application to be applicable to different network environments and security scenarios, improving its applicability and practicality. When the number of DNS changes of a domain name reaches or exceeds the threshold, the corresponding security response measures can be quickly triggered according to the set benchmark score. This timely response helps to prevent the further spread of malicious behaviors such as phishing attacks and protect user information and property safety. Taking the number of changes in DNS resolution records as an important indicator for assessing domain name risks and incorporating it into the overall security assessment system will help improve the overall level of network security. By continuously monitoring and evaluating the DNS risks of domain names, potential security vulnerabilities can be discovered and fixed in a timely manner, enhancing the network's security defense capabilities.

[0014] Optionally, using a string processing function or a regular expression to compare the similarity between the domain name and a known brand name, trademark, or domain name, and determining a sixth score of the domain name according to the similarity includes: Calculate the edit distance between the domain name and a known brand name or a known brand domain name using a string processing function, and construct a regular expression based on the domain name to perform fuzzy matching with the known brand name or the known brand domain name; A first sub-score is determined according to the edit distance, a second sub-score is determined according to the fuzzy match, and a sixth score is obtained by weighted summing the first sub-score and the second sub-score.

[0015] By adopting the above technical solution, by calculating the edit distance between the domain name and the known brand name or domain name, and using regular expressions for fuzzy matching, domain names that attempt to mislead users through minor changes or similar spellings can be accurately identified. This method effectively protects the legitimate rights and interests of the brand and prevents the brand from being maliciously used for phishing attacks or counterfeiting. The combination of the two methods of edit distance calculation and fuzzy matching can more comprehensively evaluate the similarity between the domain name and the brand name or domain name. The edit distance takes into account operations such as character insertion, deletion, and replacement, while fuzzy matching can handle more complex similarities, such as differences in letter case, spelling errors, etc. The combination of these two methods makes the similarity assessment more accurate and reliable. The first sub-score determined by the edit distance and the second sub-score determined by the fuzzy matching are weighted and summed to obtain the final sixth score. This method allows users or security teams to flexibly adjust the weights of the two sub-scores according to actual needs and security policies. For example, in some scenarios, the weight of the edit distance may be higher because a slight character change is enough to mislead users; while in other scenarios, the weight of fuzzy matching may be more important because more complex similarities need to be handled. By quantifying the similarity evaluation results, the sixth score, we can quickly determine the similarity between the domain name and the brand name or domain name, thus providing a basis for decision-making for users or security teams. For domain names with high similarity, we can immediately take corresponding security measures, such as adding to blacklists, sending warning notifications, etc., to prevent potential security risks.

[0016] Optionally, determining the priority of the target domain name according to the sorting parameter includes: Each ranking parameter is evaluated individually to determine its weight when evaluating priority. The comprehensive score of the domain name is calculated based on the weight and specific value of each ranking parameter, and the priority of the domain name is determined based on the comprehensive score.

[0017] By adopting the above technical solution, by considering multiple ranking parameters (such as the authenticity of domain name registration information, the stability of DNS resolution records, similarity with known brand names or domain names, etc.), the target domain name can be comprehensively evaluated from multiple angles. This multi-dimensional evaluation method can more accurately reflect the actual situation of the domain name and reduce the deviation that may be caused by single-dimensional evaluation. Each ranking parameter is evaluated separately, and the weight in the evaluation priority is determined according to its importance. This weight allocation mechanism makes the evaluation result more in line with the actual situation and can more accurately reflect the degree of influence of different parameters on the priority of the domain name. By calculating the comprehensive score of the domain name and determining the priority of the domain name according to the score, the relative importance of different domain names can be clearly understood. This helps enterprises or organizations to give priority to those domain names with higher risks or higher priorities under limited resources, so as to achieve the optimal allocation of resources. After clarifying the priority of the domain name, enterprises or organizations can formulate processing strategies more targetedly and quickly respond to and process those high-priority domain names. This can not only improve processing efficiency, but also reduce potential risks caused by untimely processing. The entire evaluation process is based on objective data and algorithms, reducing the interference of human factors. This makes the decision-making process more scientific, objective and quantifiable, helping to improve the accuracy and reliability of decision-making. Since the evaluation process involves multiple ranking parameters and weight allocation, it can be flexibly adjusted according to actual conditions and needs. This helps ensure that the evaluation results are always consistent with the actual situation and adapt to the ever-changing network environment and security needs.

[0018] Optionally, the security verification method further includes: In response to a user clicking on a domain name with a priority higher than a second threshold, a defense operation is triggered, wherein the defense operation includes blocking access and pop-up window warning.

[0019] By adopting the above technical solution, by blocking users from accessing high-priority risk domain names, potential security threats can be cut off at the first time, preventing users from becoming victims of cybercrime activities such as phishing attacks and malware propagation. This instant blocking mechanism can significantly reduce the risk of users being harmed. The pop-up warning not only blocks access, but also clearly points out the potential risks to users, thereby increasing users' vigilance. By receiving the warning information, users can realize that the domain name they are currently trying to access is risky, thereby avoiding further operations or accidental clicks. This educational warning helps to enhance users' network security awareness. Since the defense operation is triggered based on the precise evaluation of the domain name priority, it can reduce false positives and false negatives to a certain extent. Domain names with a priority higher than the second threshold are usually strictly screened and evaluated, and have a higher risk, so it is more reasonable and accurate to trigger the defense operation. Although the defense operation may temporarily hinder some of the user's operations, it actually improves the user experience in the long run. By preventing users from mistakenly entering high-risk websites, potential serious consequences such as data leakage and property loss are avoided, thereby safeguarding the overall interests of users. This mechanism is an important part of the security verification method, which enhances the security of the entire system. By promptly identifying and blocking high-risk domain names, the system can more effectively resist cyber attacks and malicious behavior and protect the security of user information and assets.

[0020] In a second aspect of the present application, a phishing security verification system is provided, including an evaluation module, a verification module, a sorting module, and a display module, wherein: An evaluation module configured to collect domain names of web page links to be verified, and perform risk evaluation on the domain names to identify target domain names, wherein the risk evaluation includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; A verification module configured to perform phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; A sorting module configured to determine the priority of the target domain name according to sorting parameters, wherein the sorting parameters include risk level, user access history, and domain name reputation; The display module is configured to sort the target domain names from high to low according to priority, and to display domain names of different priorities using different colors and icons.

[0021] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes any one of the methods described above.

[0022] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and when the instructions are executed, any of the methods described above is executed.

[0023] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. By combining multiple risk assessment methods such as blacklist comparison, domain name feature analysis and historical record query, it is possible to more comprehensively identify potential high-risk domain names, thereby effectively improving the network security verification platform's ability to identify phishing attacks; 2. Phishing risk verification of target domain names not only considers the authenticity of domain name registration information, but also deeply analyzes the historical behavior of domain names and similarities with known brand names, trademarks or domain names. This multi-dimensional risk assessment method can more accurately assess the risk level of target domain names and provide a more reliable basis for subsequent treatment measures; 3. By introducing sorting parameters (such as risk level, user access history, and domain name reputation) to determine the priority of target domain names, and sorting them accordingly, it can help security teams or users allocate resources more reasonably and give priority to those domain names with higher risks and more urgent situations, thereby improving the efficiency and effectiveness of security response; 4. Use different colors and icons to display domain names of different priorities. This intuitive visualization method allows users to more easily identify potential risky domain names, improve users' vigilance and awareness of prevention, and at the same time, reduce the possibility of users accidentally clicking on high-risk links, thus protecting users' personal information and property security; 5. The application of this security verification method can not only provide real-time risk warnings and protection on the user side, but also build a strong line of defense at the network security verification platform level, effectively resist network security threats such as phishing attacks, and improve the security and stability of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of the security verification method of phishing disclosed in the embodiment of the present application; Figure 2 It is a module schematic diagram of the phishing security verification system disclosed in the embodiment of the present application; Figure 3It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application.

[0025] Explanation of the reference numerals: 201, evaluation module; 202, verification module; 203, sorting module; 204, display module; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0026] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0027] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0028] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0029] This embodiment discloses a phishing security verification method, which is applied to a network security verification platform. Figure 1 is a flowchart of a phishing security verification method disclosed in an embodiment of the present application, such as Figure 1 As shown, the security verification method includes the following steps: S110, collecting domain names of web page links to be verified, and performing risk assessment on the domain names to identify target domain names, wherein the risk assessment includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; Extract the domain name part from the web link to be verified, which is achieved by parsing the URL. Risk assessment is a key step in identifying the target domain name, including blacklist comparison, domain name feature analysis and history query. Utilize the existing domain name blacklist database (these databases may contain domain names that have been blacklisted due to malware distribution, spam sending or phishing activities). If the domain name exists in the blacklist, it is directly marked as a high-risk domain name. Analyze the length of the domain name, whether it contains special characters, spelling error rate, etc. Generally, domain names that are too long, contain multiple special characters or are misspelled may have a higher risk. Obtain information such as the registrant, registration time, and expiration time of the domain name through WHOIS query. If the registration information is vague or there are abnormalities (such as frequent changes in registration information), the risk level of the domain name may increase. Use WHOIS history query tools (such as 147SEO domain name history query tool) to query the historical use of the domain name, including past owners, registrars, IP addresses and other information. This historical information helps to understand the use of the domain name and identify potential malicious behavior. Check whether the domain name has SEO optimization records, historical backlinks, etc., which can reflect the network influence and potential value of the domain name. Based on the results of blacklist comparison, domain name feature analysis, and historical record query, a risk assessment model is constructed. The model should take into account multiple factors and assign a risk score to each domain name. The risk score can be based on a certain algorithm or weight distribution system to quantify and comprehensively calculate different risk factors. A risk threshold (first threshold) is set to distinguish high-risk domain names (target domain names) from low-risk domain names. Domain names with risk scores higher than this threshold are identified as target domain names and require further attention or corresponding measures. The results of the risk assessment are output, including the risk score of each domain name and the identification of whether it is a target domain name. For the target domain name, its specific risk points can be further analyzed and corresponding processing strategies can be formulated.

[0030] Optionally, performing risk assessment on the domain name to identify the target domain name includes: Compare the domain name to be verified with a known malicious domain name blacklist, and determine the first score of the domain name based on the comparison result; Determine the second score of the domain name based on the length, character combination, and whether there are spelling errors in the domain name; The third score of the domain name is determined based on the domain name's historical registration record and the frequency of IP address changes; A first total score of the domain name is determined according to the first score, the second score, and the third score, and a domain name whose first total score exceeds a first total score threshold is determined as a target domain name.

[0031] By comparing the domain name to be verified with a known malicious domain name blacklist, known malicious domain names are quickly identified. Specifically, an existing malicious domain name blacklist database is used, which is usually maintained by network security organizations, browser manufacturers or third-party security service providers. The domain name to be verified is compared with the domain names in the blacklist one by one. If a match is found, that is, the domain name to be verified exists in the blacklist, a higher first score is assigned to the domain name according to the severity or credibility of the blacklist.

[0032] The domain name is analyzed for certain characteristics, such as length, character combination, and spelling errors, to assess its potential risk. Specifically, domain names that are too long may be harder to remember and more likely to be used to confuse users. Therefore, longer domain names may be assigned a higher secondary score. Check whether the domain name contains special characters, a mixture of numbers and letters, etc. Certain character combination patterns may be associated with malicious domain names, thereby increasing their risk scores. Spelling errors in a domain name may indicate that the domain name is intentionally designed to mimic another well-known domain name. Domain names with spelling errors will be assigned a higher secondary score.

[0033] By analyzing the historical registration records of the domain name and the frequency of IP address changes, we can assess whether it may be used for malicious activities. Specifically, use the WHOIS query tool to obtain the historical registration information of the domain name, including the registrant, registration time, expiration time, etc. Domain names that frequently change registration information may indicate that the owner behind it is trying to hide his identity or behavior, thereby increasing its risk score. If a domain name frequently changes its resolved IP address over a period of time in the past, this may indicate that the domain name is used to host different content or services, or is being used to bypass security detection. Therefore, domain names with a higher frequency of IP address changes will be given a higher third score.

[0034] The scores obtained in the above three steps are weighted and summed to obtain the first total score of the domain name, and the target domain name is determined based on the total score. A weight is assigned to each score according to the importance and credibility of different risk factors. For example, the comparison result with the malicious domain blacklist may have the highest weight because it is a direct indicator of maliciousness. The first score, the second score, and the third score are weighted and summed according to their respective weights to obtain the first total score of the domain name. A first total score threshold is set, which is determined based on actual needs and the strictness of risk assessment. Domain names whose first total scores exceed the threshold are identified as target domain names. These domain names will be regarded as high-risk domain names and require further attention or corresponding measures.

[0035] By comparing the domain name to be verified with the known malicious domain name blacklist, known malicious domain names can be quickly identified, which greatly improves the accuracy and efficiency of identification. Blacklists usually contain domain names that have been confirmed to be malicious, so direct comparison is a direct and effective means of identification. In addition to directly comparing the blacklist, the present application also determines the second score of the domain name by analyzing the length, character combination and spelling errors of the domain name, which helps to identify domain names that are not on the blacklist but have potential malicious characteristics. This multi-dimensional analysis enhances the system's comprehensive identification ability for malicious domain names. The third score of the domain name is determined by querying the historical registration records of the domain name and the frequency of IP address changes. This step makes full use of historical information to assess the risk of the domain name. Frequent changes in historical registration records and high-frequency changes in IP addresses are often signs that the domain name is used for malicious activities, so this step helps to improve the reliability and accuracy of risk assessment. The process can be automated to support batch processing of a large number of domain names to be verified. This greatly improves processing speed and efficiency, allowing network security teams to respond to potential malicious domain name threats more quickly. By setting the first total score threshold to determine the target domain name, the system can be flexibly adjusted according to actual needs and the strictness of risk assessment. This flexibility allows this application to be adapted to different application scenarios and security requirements. By conducting risk assessments on domain names and identifying target domain names, the network security team can prioritize and handle these high-risk domain names, thereby more effectively preventing network security threats such as phishing and malware propagation. This helps to improve the security and stability of the entire network environment.

[0036] S120, performing phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; By checking the registration information of the domain name, you can understand key information such as the owner, registration time, and expiration time of the domain name to assess its possible risks. Check whether the domain name registrant registered with a real identity or used a hidden service to cover up the real information. Domain names registered with false or hidden identities may have a higher risk of phishing. Analyze the registration time and expiration time of the domain name to understand the holding period of the domain name. Newly registered domain names or domain names that are about to expire may be more likely to be used for phishing activities because they may be more easily discarded or used for short-term fraud. Check whether the registration information of the domain name has changed frequently. Domain names that frequently change registration information may indicate that the owner behind it is trying to evade supervision or hide his or her true identity, thereby increasing its phishing risk. By analyzing the historical behavior of the domain name, you can understand whether the domain name has been used for malicious activities or has abnormal behavior. Check whether the domain name has appeared in various malicious domain name blacklists. These blacklists are usually maintained by network security organizations, browser manufacturers, or third-party security service providers and contain information about known malicious domain names. Analyze the network traffic of the website or service pointed to by the domain name to understand whether there are abnormal traffic patterns. Abnormal traffic patterns may indicate that the domain name is being used for malicious activities such as phishing and malware propagation. Collect and analyze user feedback and complaint information about the domain name. User feedback and complaints can reveal possible problems and risks with domain names, especially those involving personal information leakage, financial loss, etc. Evaluate whether the target domain name may be part of a phishing attack by comparing its similarity to known regular domain names. Check whether the spelling and format of the target domain name are similar to known regular domain names. Phishing attackers often create domain names that are similar to regular domain names by making minor spelling mistakes, extra characters or numbers, etc. to confuse users. If the target domain name points to a website, it is necessary to further analyze whether the content and layout of the website are similar to regular websites. Phishing websites often imitate the appearance and layout of regular websites to trick users into entering personal information or performing other sensitive operations. Find out whether the domain name has been used for purposes similar to regular websites by querying the historical use of the domain name (such as historical snapshots, historical DNS records, etc.). If the domain name has been used for legitimate or trusted purposes in the past, its current use may be more legitimate; conversely, if the domain name has been used for malicious activities or has abnormal behavior in the past, its current use may have a higher risk of phishing.

[0037] Optionally, performing phishing risk verification on the target domain name to determine the risk level of the target domain name includes: determining a fourth score of the domain name based on the authenticity of the domain name registration information, the domain name registration information including name, address, contact number and email address; Using a web crawler or a search engine to find a DNS resolution record of the domain name, and determining a fifth score of the domain name according to the DNS resolution record; comparing the domain name to a known brand name, trademark, or domain name for similarity using a string processing function or a regular expression, and determining a sixth score for the domain name based on the similarity; A second total score of the domain name is determined according to the fourth score, the fifth score, and the sixth score, and a risk level of the domain name is determined according to the second total score.

[0038] Verify the authenticity of the domain name registration information to determine whether the domain name is owned by a real and traceable entity. Inauthentic registration information may indicate that the domain name is used for fraudulent purposes. Specifically, check the integrity and rationality of the name, address, contact number, and email address provided when registering the domain name. Use third-party tools or services to verify the authenticity of this information, such as querying the location of the phone number and verifying the MX record of the email address. Based on the verification results, assign a fourth score to the domain name, and the higher the authenticity, the lower the score.

[0039] By analyzing the DNS resolution records of the domain name, we can understand the history and current status of the server and IP address pointed by the domain name to assess whether it may be used for malicious activities. Specifically, we use web crawlers or search engines to find the DNS resolution records of the domain name, including A records, MX records, NS records, etc. We analyze the change history of these records, especially the frequency of IP address changes and whether the server pointed to is located in a high-risk area or a known bad IP address list. Based on the analysis results, we assign a fifth score to the domain name. The more stable the DNS resolution record and the more reliable the server pointed to, the lower the score.

[0040] By comparing the target domain name with known brand names, trademarks or domain names, assess whether it may be part of a phishing attack. Specifically, use tools such as string processing functions or regular expressions to compare the target domain name with a list of known brand names, trademarks or domain names. Analyze factors such as spelling differences, character arrangement, and suffix changes between domain names to calculate a similarity score. Pay special attention to phishing domain names that mimic regular domain names through minor modifications (such as adding, deleting or replacing characters). Based on the results of the similarity comparison, assign a sixth score to the domain name, and the higher the similarity, the higher the score.

[0041] The overall risk level of the domain name is determined by combining the scores of the above three dimensions (the fourth score, the fifth score, and the sixth score). The fourth score, the fifth score, and the sixth score are weighted and summed according to certain weights to obtain the second total score of the domain name. The distribution of weights can be adjusted according to actual needs and the focus of risk assessment. According to the level of the second total score, the domain name is divided into different risk levels, such as low risk, medium risk, high risk, etc. The determination of risk levels helps to formulate subsequent security measures and response strategies, such as stricter monitoring and interception of high-risk domain names.

[0042] Through multi-dimensional evaluation (authenticity of domain name registration information, stability of DNS resolution records, similarity with known brand names), potential phishing domain names can be identified more comprehensively. This method is more reliable than single-dimensional detection and can reduce false positives and false negatives. Phishing risk verification of domain names is an important part of network security protection. By timely identifying and blocking high-risk phishing domain names, users can be protected from threats such as fraud, malware infection and data leakage, thereby improving the security of the entire network environment. During the verification process, if it is found that users frequently visit high-risk domain names, users can be guided to be vigilant through security tips or educational information to avoid becoming victims of phishing attacks. This method helps to enhance users' network security awareness and form safer network usage habits. The various evaluation dimensions in this application (such as domain name registration information, DNS resolution records, and similarity comparison) can be adjusted and expanded according to actual needs. For example, more data sources (such as blacklists, whitelists, user feedback, etc.) can be introduced or more advanced algorithms (such as machine learning, deep learning, etc.) can be used to optimize the effect of risk verification. By assigning risk levels to domain names, strong data support can be provided for subsequent security measures and response strategies. For example, for high-risk domain names, stricter monitoring and interception measures can be taken; for medium- and low-risk domain names, more flexible management strategies can be adopted. This risk-based decision-making approach helps to achieve optimal allocation and efficient use of resources.

[0043] Optionally, the using a web crawler or a search engine to search for a DNS resolution record of the domain name, and determining the fifth score of the domain name according to the DNS resolution record includes: Regularly query the domain name DNS resolution record to determine the number of DNS changes in the past preset time period; When the number of changes is less than a first number threshold, determining the fifth score as a first benchmark score; When the number of changes is greater than or equal to a first number threshold and less than a second number threshold, determining that the fifth score is a second benchmark score, and the second benchmark score is greater than the first benchmark score; When the number of changes is greater than or equal to a second number threshold, the fifth score is determined to be a third benchmark score, and the third benchmark score is greater than the second benchmark score.

[0044] Obtain historical data of DNS resolution records of domain names through regular queries in order to analyze changes in DNS records. Use the API (application programming interface) of a web crawler or search engine to query the DNS resolution records of a specified domain name regularly (such as daily, weekly or monthly), including A records, MX records, NS records, etc. Evaluate the stability of DNS records of a domain name by counting the number of changes in DNS records within a preset time period (such as the last month, three months or one year). Arrange the queried DNS resolution records in chronological order and count the number of changes in various DNS records within the preset time period, including changes in IP addresses, changes in NS servers, etc. First number threshold: Set a lower number of changes threshold to distinguish domain names with relatively stable DNS records. Second number threshold: Set a higher number of changes threshold to further distinguish domain names with more frequent DNS record changes. When the number of changes is less than the first number threshold, it is considered that the DNS record of the domain name is very stable and the risk is low, so the fifth score is set as the first benchmark score (usually a lower score). When the number of changes is greater than or equal to the first number threshold and less than the second number threshold, it is considered that the DNS record of the domain name has some changes, but is still within an acceptable range, so the fifth score is set as the second benchmark score (higher than the first benchmark score). When the number of changes is greater than or equal to the second threshold, it is considered that the DNS record of the domain name is frequently changed, and there may be malicious behavior, so the fifth score is set as the third benchmark score (higher than the second benchmark score).

[0045] By regularly querying DNS resolution records and counting the number of changes, the instability of domain name DNS records can be discovered in time. Frequent changes in DNS records are often a precursor to domain names being used for malicious activities (such as phishing attacks and online fraud), so this detection method can significantly improve the sensitivity to potential risks. The quantitative assessment method based on the number of DNS changes reduces the impact of subjective judgment on risk assessment results. By setting a clear threshold for the number of changes and the corresponding benchmark score, the consistency and repeatability of the risk assessment process can be ensured, thereby improving the objectivity of the assessment results. When it is detected that the DNS record of a domain name has changed multiple times in a short period of time, the system can respond quickly and mark the domain name as high risk or conduct further investigation. This rapid response mechanism helps to curb the spread of malicious activities in a timely manner and protect users from losses. By classifying domain names according to the number of DNS changes and allocating different security resources and measures based on the classification results, efficient use of resources can be achieved. For domain names with stable DNS records, the frequency of monitoring and inspection can be reduced; while for domain names with frequent DNS record changes, monitoring and inspection efforts need to be strengthened to ensure timely detection and response to potential security threats. By reducing false positives and false negatives and improving the accuracy of risk assessment, users can be provided with a more secure and reliable network environment. When a user accesses a high-risk domain name, the system can issue a warning or block access in a timely manner, thereby protecting the user's personal information and property security.

[0046] Optionally, using a string processing function or a regular expression to compare the similarity between the domain name and a known brand name, trademark, or domain name, and determining a sixth score of the domain name according to the similarity includes: Calculate the edit distance between the domain name and a known brand name or a known brand domain name using a string processing function, and construct a regular expression based on the domain name to perform fuzzy matching with the known brand name or the known brand domain name; A first sub-score is determined according to the edit distance, a second sub-score is determined according to the fuzzy match, and a sixth score is obtained by weighted summing the first sub-score and the second sub-score.

[0047] Edit distance is a measure of the difference between two strings, usually defined as the minimum number of single-character edits (insertion, deletion, or substitution) required to convert one string into another. In this application, it is used to calculate the similarity between a domain name and a known brand name or brand domain name. Determine a database or list containing known brand names and brand domain names. For the domain name to be evaluated, use a string processing function to calculate its edit distance with each known brand name or brand domain name in the database. The smaller the edit distance, the more similar the two strings are, so it can be considered that the domain name is more similar to the brand name or domain name. Fuzzy matching is a matching method that allows a string to be recognized even if it changes within a certain range. By constructing regular expressions, fuzzy matching between domain names and known brand names or brand domain names can be achieved. According to the characteristics of known brand names or brand domain names (such as keywords, character patterns, etc.), corresponding regular expressions are constructed. Use a regular expression engine to match the domain name to be evaluated with these regular expressions. If the domain name successfully matches a regular expression, it is considered that the domain name has a certain degree of similarity with the brand name or domain name corresponding to the regular expression.

[0048] First sub-score (based on edit distance): A first sub-score is determined based on the edit distance between the domain name and a known brand name or brand domain name. The smaller the edit distance, the higher the first sub-score. Second sub-score (based on fuzzy matching): If the domain name successfully matches a regular expression, a second sub-score is determined based on the degree of match (such as complete match, partial match, etc.). The higher the degree of match, the higher the second sub-score. The first sub-score and the second sub-score are weighted and summed according to the predetermined weights to obtain the final sixth score. The choice of weights can be adjusted according to actual conditions to balance the importance of edit distance and fuzzy matching in evaluating similarity.

[0049] By calculating the edit distance, the degree of difference between a domain name and a known brand name or domain name can be quantified, thereby accurately measuring the similarity between them. Regular expression fuzzy matching can handle multiple variants of brand names or domain names, including spelling errors, abbreviations, different language versions, etc., further improving the accuracy of similarity assessment. The use of regular expressions makes the detection process more flexible and can adapt to the complexity and diversity of different brand names or domain names. By constructing a suitable regular expression, the key features of the brand name or domain name can be captured, thereby achieving a more accurate match. Combining edit distance calculation and fuzzy matching can effectively reduce false positives caused by small differences between domain names and brand names or domain names, and can also reduce missed reports caused by numerous brand name or domain name variants. This application can be automated through programming to support fast and efficient similarity assessment of a large number of domain names. This is particularly important for large enterprises, network security agencies or regulators, which need to process large amounts of domain name data and respond quickly to potential phishing threats. The introduction of the sixth score provides a quantitative indicator for the risk assessment process. According to the sixth score, domain names can be prioritized, and high-risk domain names can be processed first, thereby optimizing the risk assessment process and improving the efficiency of security response. By more accurately identifying and blocking malicious domain names that are similar to known brand names or domain names, it can reduce the losses suffered by users due to mistakenly visiting malicious websites and enhance users' sense of security and trust on the Internet.

[0050] S130, determining the priority of the target domain name according to sorting parameters, where the sorting parameters include risk level, user access history, and domain name reputation; Risk level is a key indicator for assessing the potential threat level of a domain name. Usually, this level is determined based on a series of security factors, such as whether the domain name has been used for malicious activities (such as phishing attacks, spreading malware, spreading spam, etc.), whether the domain name is associated with a known blacklist or malicious domain name list, whether the domain name's DNS records are frequently changed, etc. The higher the risk level, the more dangerous the domain name is considered, and therefore it should have a higher priority when it is handled. User access history reflects the user's interest and interaction with a domain name. If a domain name is frequently visited by a large number of users, especially those known security-sensitive users (such as corporate users, government agency users, etc.), then the domain name may have a higher importance. In addition, user feedback (such as complaints, reports, etc.) can also be used as a factor in assessing the priority of a domain name. If a domain name frequently receives negative feedback, then it may need to be reviewed or handled with priority. Domain reputation is an important indicator for assessing the reliability and security of a domain name. It is usually based on a comprehensive assessment of multiple factors, including the domain name's registration history, owner information, the stability of domain name resolution, whether it is associated with a known trusted entity, etc. The higher the domain name reputation, the more reliable and secure the domain name is, but in some cases, high-reputation domain names may also become targets of attacks (such as brand hijacking). However, in most cases, high-reputation domains may be treated as lower priority unless they are associated with a specific security incident. By considering these sorting parameters, a reasonable prioritization algorithm can be developed. This algorithm can be adjusted and optimized according to different application scenarios and needs. For example, in the field of network security, risk level may be used as the main sorting basis; while in the field of content filtering or brand protection, user access history and domain reputation may be considered more.

[0051] Optionally, determining the priority of the target domain name according to the sorting parameter includes: Each ranking parameter is evaluated individually to determine its weight when evaluating priority. The comprehensive score of the domain name is calculated based on the weight and specific value of each ranking parameter, and the priority of the domain name is determined based on the comprehensive score.

[0052] Each selected ranking parameter (such as risk level, user access history, domain reputation, etc.) is evaluated and quantified independently. This usually involves collecting relevant data, such as security scan reports, user access logs, domain registration and resolution records of the domain name, and scoring or rating each parameter based on this data. Since different ranking parameters may have different importance in evaluating domain priority, a weight needs to be assigned to each parameter. The determination of weights is usually based on experience, business needs, or expert opinions. For example, in a network security scenario, the risk level may be considered the most important parameter and therefore be given a higher weight; while in a brand protection scenario, user access history and domain reputation may be more important. After determining the weight and specific value of each parameter, a weighted sum or similar method can be used to calculate the domain name's comprehensive score. The comprehensive score is a quantitative indicator for evaluating domain priority, which comprehensively considers the impact of all selected parameters. By calculating the comprehensive score, the complex relationship between different parameters can be simplified into a number that is easy to understand and compare. Finally, based on the calculated comprehensive score, the target domains can be ranked to determine their priority. Generally, domains with higher comprehensive scores are considered more important or more potential threats, and therefore should have higher priority when being processed. By prioritizing these domains, potential security risks can be addressed more effectively or brand value can be protected.

[0053] By evaluating each ranking parameter individually and determining the weight based on these evaluation results, the decision-making process can be ensured to be more scientific and accurate. This approach avoids the bias that may be caused by determining priorities based on subjective judgment or a single indicator, thereby improving the reliability of decision-making. Determining the priority of domain names based on comprehensive scores can make limited resources more reasonably allocated. Prioritizing domain names with high comprehensive scores and high potential threats can more effectively respond to security risks, protect brand value or enhance user experience. This targeted treatment method helps to optimize resource utilization efficiency and reduce unnecessary waste. The systematic prioritization process can speed up processing, allowing the system to identify and respond to high-priority domain names more quickly. This helps to respond to potential threats in a timely manner in areas such as network security and brand protection, reducing losses and negative impacts. Because the process allows the weights and specific values ​​of ranking parameters to be adjusted according to actual needs, it is highly adaptable and flexible. As the business environment and security threats continue to change, the evaluation model and parameter settings can be flexibly adjusted to adapt to new situations and challenges. The process emphasizes the collection, analysis and utilization of data, and promotes data-driven decision-making. By collecting and analyzing various data related to domain names, we can have a more comprehensive understanding of the characteristics and risks of domain names, providing more powerful support for decision-making.

[0054] S140: Sort the target domain names according to priority from high to low, and display domain names of different priorities using different colors and icons.

[0055] After calculating and determining the comprehensive score of each target domain name based on the sorting parameters, the domain names need to be sorted according to these scores. Generally, domain names with higher comprehensive scores indicate higher priority and should be placed at the top or front of the sorting list. In this way, when the processing personnel view this list, they can immediately notice the domain names that need to be processed first. To further improve the visibility and readability of priority information, different colors and icons can be used to display domain names of different priorities. This method takes advantage of the human ability to quickly recognize colors and shapes, allowing users to quickly capture key information. Different colors can be assigned to domain names of different priorities. For example, high-priority domain names can be represented by eye-catching red or orange to attract users' attention; medium-priority domain names can use more neutral colors such as yellow or blue; and low-priority domain names can use softer colors such as green or gray. In addition to colors, specific icons can be designed for each priority domain name. These icons should be concise and clear, and can intuitively convey the priority information of the domain name. For example, high-priority domain names can be accompanied by icons with exclamation marks or warning symbols, medium-priority domain names can use ordinary information icons, and low-priority domain names can use more bland icons or no icons. The above visual distinction method not only makes domain names of different priorities more prominent and easier to distinguish in the list, but also improves the user experience. Users can quickly locate the domain names they need to pay attention to and take corresponding measures through the guidance of colors and icons. This intuitive and efficient display method helps reduce the user's cognitive burden and the possibility of erroneous operations.

[0056] Optionally, the security verification method further includes: In response to a user clicking on a domain name with a priority higher than a second threshold, a defense operation is triggered, wherein the defense operation includes blocking access and pop-up window warning.

[0057] In the security verification system, one or more priority thresholds are pre-set to distinguish domain names of different danger levels or importance. These thresholds are usually calculated based on a series of risk assessment indicators, such as the historical behavior of the domain name, the current traffic pattern, the matching situation in the known threat database, etc. In the embodiment of the present application, special attention is paid to the priority higher than the second threshold, which means that only those domain names that are considered to be of higher risk or importance will trigger subsequent defense operations. The system continuously monitors the user's operation behavior, especially the operation related to the domain name in the list. When the user selects or clicks a domain name with a priority higher than the second threshold by mouse click, touch or other interactive methods, the system can immediately recognize this behavior and prepare to trigger the corresponding response mechanism. When it is detected that the user clicks on a high-priority domain name, the system will immediately start the preset defense operation. These defense operations are intended to protect users from potential threats, or at least increase the user's vigilance. In the embodiment of the present application, the defense operation includes two main aspects: the system prevents the user from further accessing the domain name. This can be achieved in a variety of ways, such as blocking requests at the network level, displaying error pages at the browser level, etc. The purpose of blocking access is to prevent users from inadvertently visiting malicious websites or downloading malware. At the same time, the system will pop up a warning window on the user interface, clearly informing the user that the domain name has potential risks and advising the user not to continue accessing it. The pop-up warning usually contains a brief risk warning message, a description of possible consequences, and recommended alternative actions (such as contacting technical support, using other security tools, etc.). After the defense action is triggered, the system can also record the event, including the user's information, the blocked domain name, the operation time, etc. These records are very important for subsequent security analysis, event tracking, and user education. In addition, the system can also provide users with feedback channels so that users can report false positives or provide other relevant information. When implementing this defense operation, special attention should be paid to user experience and transparency issues. The system should provide clear and unambiguous explanations when blocking access and displaying warnings to avoid causing unnecessary confusion or panic to users.

[0058] By blocking users from accessing high-risk domain names, the system's security protection capabilities are significantly enhanced. This helps prevent users from accidentally visiting malicious websites, downloading malware, or leaking sensitive information, thereby protecting users' computer systems and personal data from damage. Pop-up warnings not only block access, but also clearly point out potential risks to users and provide security recommendations. This approach can effectively enhance users' security awareness, allowing users to be more aware of potential threats in the network environment, so that they can be more vigilant and cautious in daily use. Blocking access to high-risk domain names in a timely manner can reduce the potential impact of malicious behavior on users and systems. This includes preventing malware infection, blocking phishing attacks, and reducing spam and malicious advertising harassment. By reducing the occurrence of these malicious behaviors, the health and stability of the network environment can be maintained. Although the defense operation itself may cause some inconvenience to users (such as blocking access), by providing clear pop-up warnings and explanations, the relationship between security needs and user experience can be balanced. Users can make more informed decisions after understanding the risks, and the system can also minimize interference to users while ensuring security.

[0059] This embodiment also discloses a phishing security verification system. Figure 2 is a schematic diagram of a module of a phishing security verification system disclosed in an embodiment of the present application, such as Figure 2 As shown, the system includes an evaluation module 201, a verification module 202, a sorting module 203 and a display module 204, wherein: An evaluation module 201 is configured to collect domain names of web page links to be verified, and perform risk evaluation on the domain names to identify target domain names, wherein the risk evaluation includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; A verification module 202, configured to perform phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; A sorting module 203, configured to determine the priority of the target domain name according to sorting parameters, wherein the sorting parameters include risk level, user access history and domain name reputation; The display module 204 is configured to sort the target domain names from high to low according to priority, and use different colors and icons to display domain names of different priorities.

[0060] Optionally, the evaluation module 201 is configured to: Compare the domain name to be verified with a known malicious domain name blacklist, and determine the first score of the domain name based on the comparison result; Determine the second score of the domain name based on the length, character combination, and whether there are spelling errors in the domain name; The third score of the domain name is determined based on the domain name's historical registration record and the frequency of IP address changes; A first total score of the domain name is determined according to the first score, the second score, and the third score, and a domain name whose first total score exceeds a first total score threshold is determined as a target domain name.

[0061] Optionally, the verification module 202 is configured to: determining a fourth score of the domain name based on the authenticity of the domain name registration information, the domain name registration information including name, address, contact number and email address; Using a web crawler or a search engine to find a DNS resolution record of the domain name, and determining a fifth score of the domain name according to the DNS resolution record; comparing the domain name to a known brand name, trademark, or domain name for similarity using a string processing function or a regular expression, and determining a sixth score for the domain name based on the similarity; A second total score of the domain name is determined according to the fourth score, the fifth score, and the sixth score, and a risk level of the domain name is determined according to the second total score.

[0062] Optionally, the verification module 202 is configured to: Regularly query the domain name DNS resolution record to determine the number of DNS changes in the past preset time period; When the number of changes is less than a first number threshold, determining the fifth score as a first benchmark score; When the number of changes is greater than or equal to a first number threshold and less than a second number threshold, determining that the fifth score is a second benchmark score, and the second benchmark score is greater than the first benchmark score; When the number of changes is greater than or equal to a second number threshold, the fifth score is determined to be a third benchmark score, and the third benchmark score is greater than the second benchmark score.

[0063] Optionally, the verification module 202 is configured to: Calculate the edit distance between the domain name and a known brand name or a known brand domain name using a string processing function, and construct a regular expression based on the domain name to perform fuzzy matching with the known brand name or the known brand domain name; A first sub-score is determined according to the edit distance, a second sub-score is determined according to the fuzzy match, and a sixth score is obtained by weighted summing the first sub-score and the second sub-score.

[0064] Optionally, the sorting module 203 is configured to: Each ranking parameter is evaluated individually to determine its weight when evaluating priority. The comprehensive score of the domain name is calculated based on the weight and specific value of each ranking parameter, and the priority of the domain name is determined based on the comprehensive score.

[0065] Optionally, the security verification system further includes a defense module, and the defense module is configured to: In response to a user clicking on a domain name with a priority higher than a second threshold, a defense operation is triggered, wherein the defense operation includes blocking access and pop-up window warning.

[0066] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0067] This embodiment also discloses an electronic device, referring to Figure 3 The electronic device may include: at least one processor 301 , at least one communication bus 302 , a user interface 303 , a network interface 304 , and at least one memory 305 .

[0068] The communication bus 302 is used to realize the connection and communication between these components.

[0069] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0070] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0071] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0072] Among them, the memory 305 may include a random access memory 305 (Random Access Memory, RAM), and may also include a read-only memory 305 (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may also be optionally at least one storage device located away from the aforementioned processor 301. As Figure 3 As shown, the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program of a phishing security verification method.

[0073] exist Figure 3In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 301 can be used to call the application program storing the phishing security verification method in the memory 305. When executed by one or more processors 301, the electronic device executes one or more methods in the above-mentioned embodiments.

[0074] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0075] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0076] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0077] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0078] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0079] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory 305 and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory 305 includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk.

[0080] The above is only an exemplary embodiment of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification, those skilled in the art will easily think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field that are not recorded in the present disclosure. The description and examples are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A phishing security verification method, characterized in that: Applied to a network security verification platform, the security verification method includes: Collecting domain names of web page links to be verified, and performing risk assessment on the domain names to identify target domain names, wherein the risk assessment includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; Performing phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; Determining the priority of the target domain name according to sorting parameters, wherein the sorting parameters include risk level, user access history, and domain name reputation; The target domain names are sorted from high to low according to the priority, and domain names of different priorities are displayed using different colors and icons.

2. The phishing security verification method according to claim 1, characterized in that: The performing risk assessment on the domain name to identify the target domain name includes: Compare the domain name to be verified with a known malicious domain name blacklist, and determine the first score of the domain name based on the comparison result; Determine the second score of the domain name based on the length, character combination, and whether there are spelling errors in the domain name; The third score of the domain name is determined based on the domain name's historical registration record and the frequency of IP address changes; A first total score of the domain name is determined according to the first score, the second score, and the third score, and a domain name whose first total score exceeds a first total score threshold is determined as a target domain name.

3. The phishing security verification method according to claim 1, characterized in that: The performing phishing risk verification on the target domain name to determine the risk level of the target domain name includes: determining a fourth score of the domain name based on the authenticity of the domain name registration information, the domain name registration information including name, address, contact number and email address; Using a web crawler or a search engine to find a DNS resolution record of the domain name, and determining a fifth score of the domain name according to the DNS resolution record; comparing the domain name to a known brand name, trademark, or domain name for similarity using a string processing function or a regular expression, and determining a sixth score for the domain name based on the similarity; A second total score of the domain name is determined according to the fourth score, the fifth score, and the sixth score, and a risk level of the domain name is determined according to the second total score.

4. The method for verifying the safety of phishing according to claim 3, characterized in that: The using a web crawler or a search engine to search for a DNS resolution record of the domain name, and determining a fifth score of the domain name according to the DNS resolution record comprises: Regularly query the domain name DNS resolution record to determine the number of DNS changes in the past preset time period; When the number of changes is less than a first number threshold, determining the fifth score as a first benchmark score; When the number of changes is greater than or equal to a first number threshold and less than a second number threshold, determining that the fifth score is a second benchmark score, and the second benchmark score is greater than the first benchmark score; When the number of changes is greater than or equal to a second number threshold, the fifth score is determined to be a third benchmark score, and the third benchmark score is greater than the second benchmark score.

5. The method for verifying the safety of phishing according to claim 3, characterized in that: The comparing the similarity between the domain name and a known brand name, trademark or domain name using a string processing function or a regular expression and determining a sixth score of the domain name according to the similarity comprises: Calculate the edit distance between the domain name and a known brand name or a known brand domain name using a string processing function, and construct a regular expression based on the domain name to perform fuzzy matching with the known brand name or the known brand domain name; A first sub-score is determined according to the edit distance, a second sub-score is determined according to the fuzzy match, and a sixth score is obtained by weighted summing the first sub-score and the second sub-score.

6. The phishing security verification method according to claim 1, characterized in that: Determining the priority of the target domain name according to the sorting parameter includes: Each ranking parameter is evaluated individually to determine its weight when evaluating priority. The comprehensive score of the domain name is calculated based on the weight and specific value of each ranking parameter, and the priority of the domain name is determined based on the comprehensive score.

7. The phishing security verification method according to claim 1, characterized in that: The security verification method further includes: In response to a user clicking on a domain name with a priority higher than a second threshold, a defense operation is triggered, wherein the defense operation includes blocking access and pop-up window warning.

8. A phishing security verification system, characterized in that: It includes an evaluation module, a verification module, a sorting module and a display module, among which: An evaluation module configured to collect domain names of web page links to be verified, and perform risk evaluation on the domain names to identify target domain names, wherein the risk evaluation includes blacklist comparison, domain name feature analysis, and historical record query, and the target domain name refers to a domain name with a risk higher than a first threshold; A verification module configured to perform phishing risk verification on the target domain name to determine the risk level of the target domain name, wherein the phishing risk verification includes evaluating domain name registration information, historical behavior, and similarity; A sorting module configured to determine the priority of the target domain name according to sorting parameters, wherein the sorting parameters include risk level, user access history, and domain name reputation; The display module is configured to sort the target domain names from high to low according to priority, and to display domain names of different priorities using different colors and icons.

9. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is executed.

Images