Fraud website identification early warning method, device and equipment and storage medium thereof

Abstract

The invention relates to a fraud website identification early warning method, device and equipment and a storage medium thereof. The method comprises the following steps: firstly, acquiring network address information, then extracting feature data from dimensions such as structure, semantics, behavior and vision, accelerating similarity detection by applying a graphics processor parallel computing technology, and generating a composite feature vector containing a domain name similarity score and a registration feature; constructing fraud features in combination with the composite feature vector, mining a data association relationship through a graph neural network, and forming multi-dimensional risk feature data; and finally, processing the risk feature data by using a deep learning model, generating a risk probability, and when the risk probability exceeds a preset threshold, determining that the network address is a high-risk network address and generating an early warning report. By adopting the method, the comprehensiveness and accuracy of fraud website identification can be improved, complex fraud means such as domain name variation and semantic camouflage can be effectively dealt with, the real-time early warning capability for potential risks is enhanced, and efficient technical support is provided for network security protection.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a fraudulent website identification and early warning method, device, equipment and storage medium thereof. Background Art

[0002] With the widespread use of the internet, online fraud has become a serious social problem. Fraudulent websites, as key vectors of online fraud, steal user information and commit economic fraud by impersonating legitimate websites and implanting malicious programs, posing a serious threat to network security and public property safety. Traditional URL detection methods, such as those based on rule matching, rely on pre-defined feature libraries and are unable to cope with the diversity and dynamic changes of fraudulent URLs. They are prone to underreporting new fraudulent URLs or URLs that have undergone code obfuscation or domain name mutations. Methods based on single feature analysis, whether based solely on text keywords or considering only one aspect such as web page layout, are unable to comprehensively and accurately identify fraudulent URLs, resulting in low recognition accuracy. Furthermore, existing technologies are insufficient in distinguishing similar domain names when dealing with domain name mutations; in scenarios involving semantic camouflage, it is difficult to discern the fraudulent intent behind URLs; and in monitoring abnormal user behavior, they lack real-time and accuracy, failing to promptly detect abnormal behavior that leads users to fraudulent URLs. Matching technologies based on black sample feature values, such as those mentioned in patent CN115795207A, can identify fraudulent websites with known features, but are helpless against new fraudulent websites with code mutations. Summary of the Invention

[0003] Based on this, it is necessary to provide a fraudulent website identification and warning method, device, equipment and storage medium thereof that can improve the comprehensiveness and accuracy of fraudulent website identification in response to the above technical problems.

[0004] In a first aspect, the present application provides a method for identifying and warning fraudulent websites, comprising:

[0005] Get network address information.

[0006] Multi-dimensional feature data is extracted from network address information, and similarity detection is performed using graphics processor parallel computing technology to obtain a composite feature vector.

[0007] Fraud features are constructed by combining composite feature vector analysis, and data associations are mined through graph neural networks to obtain multi-dimensional risk feature data.

[0008] Use deep learning models to process risk feature data to generate risk probability. If the risk probability exceeds the preset threshold, it is determined to be a high-risk network address and an early warning report is generated.

[0009] In one embodiment, multi-dimensional feature data is extracted from network address information, and similarity detection is performed using parallel computing technology of a graphics processor to obtain a composite feature vector, including:

[0010] Structural features, semantic features, behavioral features and visual features are extracted based on network address information to construct a standardized feature vector.

[0011] The edit distance matrix is ​​generated using a dynamic programming algorithm based on the standardized eigenvectors.

[0012] Graphics processor parallel computing technology is used to accelerate the string comparison process of the edit distance matrix, calculate the minimum edit distance value between domain names, and generate a domain name similarity score.

[0013] Send a query request to the WHOIS server through the network protocol library, and parse the returned registration characteristics including domain name registrant information, registration period and IP geographic location.

[0014] The domain name similarity score is associated with the registration features to generate a composite feature vector.

[0015] In one embodiment, structural features, semantic features, behavioral features, and visual features are extracted based on network address information to construct a standardized feature vector, including:

[0016] The structural feature vector is extracted based on the hierarchical depth, special symbol ratio and number of path segments of the URL.

[0017] Natural language processing technology is used to identify keyword frequencies, sentiment tendencies, and fraud-related phrases in network address information to obtain semantic feature vectors.

[0018] Based on the time series data of network address information including access traffic fluctuations, user stay time and page jump frequency, a recurrent neural network is used to extract behavioral feature vectors.

[0019] The convolutional neural network is used to analyze the page layout similarity, color pattern and inductive button distribution in the network address information to obtain the visual feature vector.

[0020] The structural, semantic, behavioral and visual feature vectors are standardized and fused according to the weights to generate a unified standardized feature vector.

[0021] In one embodiment, the domain name similarity score is calculated using the following formula:

[0022] SimilarityScore=α·EditSim(d1,d2)+β·SemanticSim(d1,d2)+γ·StructSim(d1,d2)

[0023]

[0024] SemanticSim(d1,d2)=CosineSimilarity(Embedding(d1),Embedding(d2))

[0025]

[0026] Among them, SimilarityScore represents the domain similarity score, EditSim(d1,d2) represents the edit similarity, SemanticSim(d1,d2) represents the semantic similarity, StructSim(d1,d2) represents the structural similarity, α, β, γ represent the weight parameters, d1 and d2 represent the two domain names to be compared, Levenshtein(d1,d2) represents the minimum edit distance (Levenshtein distance) between domain names d1 and d2, λ represents the scaling parameter, Embedding(d i ) represents the domain name d i The semantic vector representation of domain names d1 and d2 is shown in Table 2. CosineSimilarity(·) represents the cosine similarity function, CommonSubstrings(d1,d2) represents the number of common substrings of domain names d1 and d2, and Segments(d i ) represents the domain name d i The number of path segments, SpecialChars(d i ) represents the domain name d i The number of special symbols in , μ represents the penalty coefficient for the difference of special symbols.

[0027] In one embodiment, fraud features are constructed by combining composite feature vector analysis, and data associations are mined through graph neural networks to obtain multi-dimensional risk feature data, including:

[0028] The initial fraud feature set is constructed by fusing multi-source data based on the standardized composite feature vector.

[0029] A fraud feature association model is constructed based on the initial fraud feature set, with domain names as nodes and the association relationships between features as edges.

[0030] The fraud feature association model is trained using a graph neural network, and the potential association between domain names and features is mined through the message passing mechanism between nodes to obtain the node embedding vector.

[0031] The node embedding vector and the composite feature vector are fused, and the feature co-occurrence pattern is extracted through the gradient boosting tree to obtain multi-dimensional risk feature data.

[0032] In one embodiment, a deep learning model is used to process risk feature data to generate a risk probability. If the risk probability exceeds a preset threshold, the network address is determined to be high-risk and an early warning report is generated, including:

[0033] Based on the risk characteristic data, a normalization algorithm is used to perform mapping to obtain the risk characteristic value.

[0034] A risk prediction model is constructed by integrating risk feature values ​​using a hybrid architecture of convolutional neural networks and recurrent neural networks.

[0035] The risk prediction model is trained using a dataset of labeled fraudulent URLs and a dataset of normal URLs. The model parameters are optimized through the back-propagation algorithm to output the risk probability value.

[0036] A risk threshold is preset based on historical data statistical results, and the risk probability value is compared with the risk threshold. If the threshold is exceeded, a high risk judgment is generated.

[0037] Based on the network addresses identified as high-risk, early warning reports containing risk levels and feature basis are generated in real time.

[0038] In a second aspect, the present application also provides a fraudulent website identification and warning device, comprising:

[0039] The URL feature extraction module is used to obtain network address information; it is also used to extract multi-dimensional feature data from the network address information, use graphics processor parallel computing technology to perform similarity detection, and obtain a composite feature vector.

[0040] The fraud feature analysis module is used to construct fraud features by combining composite feature vector analysis, and mine data associations through graph neural networks to obtain multi-dimensional risk feature data.

[0041] The risk assessment and early warning module is used to use deep learning models to process risk feature data to generate risk probabilities. If the risk probability exceeds a preset threshold, it is judged as a high-risk network address and an early warning report is generated.

[0042] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above method when executing the computer program.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the above method when executed by a processor.

[0044] The above-mentioned fraudulent website identification and early warning method, device, computer equipment and storage medium first obtain network address information, then extract feature data from structural, semantic, behavioral and visual dimensions, and use graphics processor parallel computing technology to accelerate similarity detection, generating a composite feature vector containing domain name similarity scores and registration features; then, the composite feature vector is combined to construct fraud features, and data associations are mined through graph neural networks to form multi-dimensional risk feature data; finally, a deep learning model is used to process the risk feature data to generate a risk probability. When the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and an early warning report is generated. By combining multi-dimensional feature fusion with intelligent algorithms, the comprehensiveness and accuracy of fraudulent website identification are improved, and it can effectively deal with complex fraud methods such as domain name mutations and semantic disguises; with the help of graphics processor parallel computing and graph neural network technology, the detection time is shortened, the real-time early warning capability of potential risks is enhanced, and efficient technical support is provided for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 A flowchart of a fraudulent website identification and early warning method provided by an embodiment of the present invention;

[0047] Figure 2 This is a structural block diagram of a fraudulent website identification and early warning device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] First, as Figure 1 As shown, this application provides a fraudulent website identification and warning method, which can include the following steps:

[0050] Step S101: Acquire network address information.

[0051] Specifically, the original data of network addresses are obtained through multiple channels such as web crawlers, DNS resolution, and user reports, including the complete URL structure, domain name registration information (such as the registrant, registration time, and IP location in the WHOIS record), web page text content, and access traffic logs.

[0052] Step S102 : extracting multi-dimensional feature data from the network address information, performing similarity detection using a graphics processor parallel computing technology, and obtaining a composite feature vector.

[0053] Furthermore, an index system containing hundreds of features is constructed from dimensions such as the structural features of network address information (such as domain name length, proportion of special characters, path depth), semantic features (keyword matching, text sentiment tendency, counterfeit logo detection), behavioral features (access frequency, abnormal traffic fluctuations, jump chain complexity), and time features (registration duration, update frequency, and survival cycle). Natural language processing (NLP) technology is used to parse web page text, and computer vision (CV) technology is used to extract visual features of web page screenshots (such as layout similarity and proportion of inductive elements) to form a multimodal feature data set. Based on string similarity algorithms such as Levenshtein distance and edit distance, GPU parallel computing technology (such as CUDA architecture) is used to perform batch comparisons on massive domain names. A composite feature vector is generated for suspected counterfeit domain names (such as those with an edit distance less than a threshold from the regular domain name), which contains information such as character difference positions, replacement patterns, and top-level domain name variation types.

[0054] Step S103: Combine composite feature vector analysis to construct fraud features, mine data associations through graph neural networks, and obtain multi-dimensional risk feature data.

[0055] Composite feature vectors are integrated with multi-source data (such as IP risk blacklists and historical fraud case features) to construct a heterogeneous graph model containing nodes such as domain names, IP addresses, and keywords. Through Graph Attention Network (GAT) training, a message passing mechanism between nodes is used to explore potential associations. For example, the edge weights between nodes with short registration durations and nodes with high similarity to domain names are dynamically updated, outputting a node embedding vector containing the probability of risk propagation. Furthermore, feature co-occurrence patterns (such as "similarity > 0.8 + registration duration < 7 days + abnormal traffic") are extracted through a gradient boosting tree (XGBoost) to form a multi-dimensional risk feature dataset.

[0056] Step S104: Use a deep learning model to process the risk feature data to generate a risk probability. If the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and an early warning report is generated.

[0057] Specifically, composite feature vectors are fused with multi-dimensional feature data to construct a fraud feature matrix encompassing metrics such as domain name similarity, content credibility, and behavioral anomalies. A graph neural network (GNN) model is introduced, using entities such as domain names, IP addresses, and user behaviors as nodes, and access relationships and data interactions as edges, to construct a network fraud graph. Graph convolutional networks (GCNs) and graph attention networks (GATs) are used to mine implicit associations between entities (such as cross-domain collaborative fraud patterns), generating multi-dimensional risk feature data encompassing hierarchical correlation risks and cluster propagation potential. A CNN-RNN hybrid architecture (such as the BiGRU-CNN model) is used to process risk feature data, extracting spatial features (such as webpage visual patterns) through convolutional layers and capturing temporal features (such as access behavior timing) through recurrent layers. The model outputs a risk probability value, which is compared with a preset threshold. If the threshold is exceeded, the network address is identified as high-risk, and an early warning report is automatically generated, including the risk level, feature evidence chain, and associated fraud cases. This report is then synchronized to the network security monitoring platform and user terminals, triggering a dynamic blocking or pop-up notification mechanism.

[0058] The above-mentioned fraudulent website identification and early warning method first obtains network address information, then extracts feature data from structural, semantic, behavioral and visual dimensions, and uses graphics processor parallel computing technology to accelerate similarity detection, generating a composite feature vector containing domain name similarity scores and registration features; then, it combines the composite feature vector to construct fraud features, mines data associations through graph neural networks, and forms multi-dimensional risk feature data; finally, it uses a deep learning model to process the risk feature data and generate a risk probability. When the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and an early warning report is generated. By combining multi-dimensional feature fusion with intelligent algorithms, the comprehensiveness and accuracy of fraudulent website identification are improved, and it can effectively deal with complex fraud methods such as domain name mutations and semantic disguises; with the help of graphics processor parallel computing and graph neural network technology, the detection time is shortened, the real-time early warning capability of potential risks is enhanced, and efficient technical support is provided for network security protection.

[0059] In one embodiment, extracting multi-dimensional feature data from network address information, performing similarity detection using graphics processor parallel computing technology, and obtaining a composite feature vector may include the following steps:

[0060] Step S201 : extracting structural features, semantic features, behavioral features, and visual features based on network address information to construct a standardized feature vector.

[0061] Step S202 : Generate an edit distance matrix using a dynamic programming algorithm according to the normalized feature vector.

[0062] Step S203 : Using GPU parallel computing technology to accelerate the string comparison process of the edit distance matrix, calculate the minimum edit distance value between domain names, and generate a domain name similarity score.

[0063] Preferably, by introducing the parallel computing capabilities of the graphics processing unit (GPU), the traditional CPU-based serial dynamic programming calculation is optimized to a parallel processing mode. Specifically, for the domain name strings in the standardized feature vector, the row and column operations of the edit distance matrix are distributed to multiple computing cores of the GPU through parallel computing frameworks such as CUDA, so as to realize the parallel filling of matrix elements. For example, the matrix is ​​divided into multiple blocks (Block), and the threads (Thread) in each block are responsible for calculating the edit distance values ​​of the corresponding positions, and the correctness of the data dependency is ensured through a synchronization mechanism. Compared with traditional CPU calculations, this method can increase the calculation speed of the Levenshtein distance by more than 10 times, significantly reducing the time complexity of large-scale domain name matching. Finally, the minimum edit distance value between domain names is obtained through the element in the lower right corner of the matrix, and combined with the scaling factor, it is converted into a domain name similarity score in the interval [0,1].

[0064] Step S204: Send a query request to the WHOIS server through the network protocol library, and parse the returned registration characteristics including domain name registrant information, registration period, and IP geographic location.

[0065] Step S205 : performing an association calculation on the domain name similarity score and the registration features to generate a composite feature vector.

[0066] First, based on the network address information, structural features (such as URL hierarchical depth, proportion of special symbols), semantic features (such as keyword frequency, emotional tendency), behavioral features (such as access traffic fluctuations, user stay time) and visual features (such as page layout similarity, distribution of inducement buttons) are extracted respectively, and a unified standardized feature vector is constructed through normalization processing. Secondly, based on the standardized feature vector, a dynamic programming algorithm is used to generate an edit distance matrix, and the parallel computing technology of the graphics processor is used to accelerate the string comparison process in the matrix, calculate the minimum edit distance value between domain names, and generate a domain name similarity score. At the same time, a query request is sent to the WHOIS server through the network protocol library to parse the returned registration features such as registrant information, registration time period and IP geographic location. Finally, the domain name similarity score is associated with the registration features to generate a composite feature vector containing multi-dimensional information.

[0067] This embodiment achieves a refined characterization of network addresses through the systematic extraction and quantitative analysis of multi-dimensional features, avoiding the limitations of single-feature analysis. Leveraging GPU parallel computing technology, string comparison efficiency is significantly improved, reducing detection time. Deeply correlating domain name similarity with registration features enhances the ability to identify counterfeit domain names and anomalous registration behavior, providing comprehensive and reliable feature data support for subsequent risk assessments and effectively improving the accuracy and timeliness of fraudulent URL identification.

[0068] In one embodiment, extracting structural features, semantic features, behavioral features, and visual features based on network address information to construct a standardized feature vector may include the following steps:

[0069] Step S301 : extracting a structural feature vector based on the hierarchical depth, special symbol ratio, and path segment number characteristics of the network address information URL.

[0070] Step S302: Using natural language processing technology, identify the keyword frequency, sentiment tendency, and fraud-related phrases in the network address information to obtain a semantic feature vector.

[0071] Step S303 , based on the time series data of the network address information including access traffic fluctuations, user stay time and page jump frequency, a recurrent neural network is used to extract the behavior feature vector.

[0072] Furthermore, for the time series data generated by the interaction between users and network addresses (such as the number of visits in minutes, the duration of a single visit, and the sequence of page jump paths), the time series modeling capabilities of the recurrent neural network (RNN) are used to capture behavioral patterns. Specifically, the serialized behavioral data is processed layer by layer through the gated recurrent unit (GRU) or long short-term memory network (LSTM) structure: the input layer receives standardized time series features (such as normalized traffic values ​​and stay timestamps), the hidden layer selectively memorizes long-term dependency information (such as abnormally frequent access periods) through the gating mechanism, and the output layer generates a fixed-dimensional behavioral feature vector. For example, for the access traffic sequence of a certain website, the model can identify the abnormal pattern of "sudden traffic peaks in a short period of time + high-frequency page jumps", and convert it into a high-risk weight value in the behavioral feature vector.

[0073] Step S304: Analyze the page layout similarity, color pattern, and inductive button distribution in the network address information through a convolutional neural network to obtain a visual feature vector.

[0074] Step S305 , normalizing the structural, semantic, behavioral, and visual feature vectors, and fusing them according to weights to generate a unified normalized feature vector.

[0075] Specifically, the approach first extracts features from four dimensions of network address information: Structural feature vectors are extracted based on the URL's hierarchical depth, the proportion of special symbols, and the number of path segments. Natural language processing techniques are used to analyze keyword frequency, sentiment, and fraud-related phrases to generate semantic feature vectors. Recurrent neural networks are used to extract behavioral feature vectors based on time-series data such as traffic fluctuations, user dwell time, and page jump frequency. Finally, convolutional neural networks are used to analyze page layout similarity, color patterns, and the distribution of suggestive buttons to generate visual feature vectors. Subsequently, the structural, semantic, behavioral, and visual feature vectors are standardized and fused according to preset weights to generate a unified, standardized feature vector, achieving a multi-dimensional characterization of network addresses.

[0076] This method, through the fusion of multiple technologies and multi-dimensional feature extraction, comprehensively covers key elements of network addresses, including text content, structural characteristics, user behavior, and visual presentation, avoiding the one-sidedness of single-feature analysis. Standardization and weighted fusion mechanisms ensure the comparability and complementarity of different feature types, providing a structured, high-precision feature data foundation for subsequent similarity detection and risk modeling. This effectively improves the input quality and analytical efficiency of fraudulent URL identification models, enhancing their ability to identify complex fraudulent tactics.

[0077] In one embodiment, the domain name similarity score can be calculated using the following formula:

[0078] SimilarityScore=α·EditSim(d1,d2)+β·SemanticSim(d1,d2)+γ·StructSim(d1,d2)

[0079]

[0080] SemanticSim(d1,d2)=CosineSimilarity(Embedding(d1),Embedding(d2))

[0081]

[0082] Among them, SimilarityScore represents the domain similarity score, EditSim(d1,d2) represents the edit similarity, SemanticSim(d1,d2) represents the semantic similarity, StructSim(d1,d2) represents the structural similarity, α, β, γ represent the weight parameters, d1 and d2 represent the two domain names to be compared, Levenshtein(d1,d2) represents the minimum edit distance (Levenshtein distance) between domain names d1 and d2, λ represents the scaling parameter, Embedding(d i ) represents the domain name di The semantic vector representation of domain names d1 and d2 is shown in Table 2. CosineSimilarity(·) represents the cosine similarity function, CommonSubstrings(d1,d2) represents the number of common substrings of domain names d1 and d2, and Segments(d i ) represents the domain name d i The number of path segments, SpecialChars(d i ) represents the domain name d i The number of special symbols in , μ represents the penalty coefficient for the difference of special symbols.

[0083] This embodiment achieves a comprehensive quantitative analysis of domain name similarity through the integration of multi-dimensional indicators. Editing similarity captures subtle differences at the character level, effectively identifying spelling variation-type counterfeit domain names; semantic similarity mines the implicit semantic associations of domain names to identify semantically disguised fraudulent URLs; structural similarity, based on URL structural features, detects abnormal patterns such as path complexity and the misuse of special symbols. The introduction of multiple weight parameters enables the model to flexibly adjust the contribution of each dimension according to actual scenarios, improving its adaptability to diverse fraud methods and providing a scientific and reliable quantitative basis for the automated identification of fraudulent URLs.

[0084] In one embodiment, combining composite feature vector analysis to construct fraud features, mining data associations through graph neural networks, and obtaining multi-dimensional risk feature data may include the following steps:

[0085] Step S401 : constructing an initial fraud feature set based on the standardized composite feature vector and fusing multi-source data.

[0086] Step S402 : constructing a fraud feature association model based on the initial fraud feature set, with domain names as nodes and associations between features as edges.

[0087] In step S403, the fraud feature association model is trained using a graph neural network, and the potential association between domain names and features is mined through a message passing mechanism between nodes to obtain a node embedding vector.

[0088] Step S404: fuse the node embedding vector and the composite feature vector, extract feature co-occurrence patterns through the gradient boosting tree, and obtain multi-dimensional risk feature data.

[0089] First, the standardized composite feature vector is fused with multi-source data (such as historical fraud feature libraries and IP risk data) to construct an initial fraud feature set containing multiple dimensions such as structure, semantics, and registration information. Subsequently, a fraud feature association model is constructed with domain names as nodes and the correlation between features (such as the mapping of domain names to high-risk IPs, and the co-occurrence of keywords and fraud patterns) as edges, converting discrete features into structured graph data. Next, the model is trained using graph neural networks (such as GCN / GAT), and through the message passing mechanism between nodes, the high-order potential correlation between domain names and features is mined to generate node embedding vectors containing deep semantics. Finally, the node embedding vector is fused with the original composite feature vector, and the feature co-occurrence pattern (such as "short registration time + high similarity domain name + abnormal traffic") is extracted through the gradient boosting tree algorithm to form multi-dimensional risk feature data.

[0090] This implementation effectively captures implicit correlations between features that are difficult to detect with traditional methods, enhancing the ability to analyze complex fraud networks. Multi-source data fusion and feature co-occurrence mining enhance the richness and discriminative power of risk features. The introduction of gradient boosting trees further optimizes the nonlinear representation of feature combinations, providing a more explanatory and predictive feature system for subsequent risk probability prediction, significantly improving the accuracy and generalization of fraudulent URL identification.

[0091] In one embodiment, a deep learning model is used to process risk feature data to generate a risk probability. If the risk probability exceeds a preset threshold, the network address is determined to be a high-risk network address and a warning report is generated. The following steps may be included:

[0092] Step S501 : Mapping is performed based on the risk characteristic data using a normalization algorithm to obtain a risk characteristic value.

[0093] Step S502: A risk prediction model is constructed by fusing risk feature values ​​using a hybrid architecture of a convolutional neural network and a recurrent neural network.

[0094] Preferably, a convolutional neural network (CNN) and a recurrent neural network (RNN) are combined to perform multimodal feature fusion on the normalized risk feature values. CNN extracts local correlation patterns in risk features through convolutional layers and pooling layers, such as identifying the spatial distribution patterns of similar character combinations from domain name structure features; RNN processes time-related features through LSTM or GRU units, such as the time series dependencies of user access behaviors. The two types of feature vectors are fused through a fully connected layer to form a comprehensive representation that includes spatial and temporal features. For example, the model can simultaneously capture the spatial features of "high domain name similarity" and the temporal features of "nighttime surge in visits", thereby improving the ability to identify complex fraud patterns. This hybrid architecture achieves multi-level abstraction of risk features through an end-to-end training mechanism.

[0095] Step S503: Use the labeled fraudulent website dataset and the normal website dataset to train the risk prediction model, optimize the model parameters through the back propagation algorithm, and output the risk probability value.

[0096] Step S504: preset a risk threshold value based on historical data statistics, compare the risk probability value with the risk threshold value, and generate a high risk judgment if the risk exceeds the threshold value.

[0097] Step S505: Generate an early warning report containing risk levels and feature basis in real time based on the network addresses determined to be high risk.

[0098] Specifically, a normalization algorithm is first applied to the risk signature data. Using linear or nonlinear transformations, the multi-dimensional feature values ​​are mapped to the [0, 1] range, eliminating dimensionality differences and obtaining standardized risk signature values. Subsequently, a hybrid architecture combining a convolutional neural network (CNN) and a recurrent neural network (RNN) is employed. The CNN extracts local spatial correlations among features (e.g., webpage layout features) while the RNN captures temporal dependencies among features (e.g., access behavior timing). These features are then integrated to construct a risk prediction model. The model is then trained using a dataset of labeled fraudulent and legitimate URLs. The network parameters are optimized using a backpropagation algorithm, ensuring that the model outputs a risk probability value within the [0, 1] range, with larger values ​​indicating a higher likelihood of fraud. A risk threshold (e.g., 0.85) is then preset based on historical data statistics. The risk probability output by the model is compared against the threshold. If the threshold is exceeded, the address is classified as high-risk. Finally, for high-risk determinations, a warning report is generated in real time, including the risk level and key feature criteria (e.g., "similarity score 0.92, registration duration < 3 days").

[0099] The hybrid neural network architecture in this embodiment achieves joint modeling of spatial and temporal features, enhancing the model's ability to capture complex patterns. Supervised learning and backpropagation optimization based on labeled data ensure the model's predictive accuracy. Dynamic threshold setting and real-time warning mechanisms enable rapid identification and response to high-risk URLs. This provides an efficient and reliable technical means for network security protection, effectively enhancing proactive defense against new types of online fraud.

[0100] In one embodiment, Figure 2 As shown, the present application also provides a fraudulent website identification and warning device, which may include:

[0101] The URL feature extraction module 601 is used to obtain network address information; it is also used to extract multi-dimensional feature data from the network address information, perform similarity detection using graphics processor parallel computing technology, and obtain a composite feature vector.

[0102] The fraud feature analysis module 602 is used to construct fraud features by combining composite feature vector analysis, and mine data associations through graph neural networks to obtain multi-dimensional risk feature data.

[0103] The risk assessment and warning module 603 is used to use a deep learning model to process risk feature data to generate risk probability. If the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and a warning report is generated.

[0104] In the aforementioned fraudulent website identification and early warning device, the website feature extraction module collects network address information and extracts multi-source feature data from structural, semantic, behavioral, and visual dimensions. It utilizes parallel computing technology on graphics processing units (GPUs) to accelerate domain name similarity detection and generates a composite feature vector containing domain name similarity scores and registration features using the Levenshtein distance algorithm. The fraud feature analysis module constructs a fraud feature set based on the composite feature vector, models the relationships between domain names and features using a graph neural network (GNN), and exploits node embedding and message passing mechanisms to uncover potential risk patterns, generating multi-dimensional risk feature data that integrates deep semantics and relationships. The risk assessment and early warning module utilizes a deep learning model to process risk feature data, outputting risk probability values ​​through training. These values ​​are then compared with preset thresholds to identify high-risk websites and generate real-time early warning reports containing risk levels and feature-based evidence. This modular design automates the entire process from data collection and feature analysis to risk early warning, ensuring comprehensive and efficient data processing. It overcomes the limitations of traditional methods for analyzing feature relationships and ensures accurate and timely risk assessment. This provides technical support for network security protection and effectively enhances proactive defense and rapid response capabilities against new types of online fraud.

[0105] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0106] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the aforementioned fraudulent website identification and warning method, apparatus, device, and storage medium thereof are implemented.

[0107] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0108] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the components described as separate parts may or may not be physically separated, and the parts displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0109] The above-described embodiments merely represent several implementation methods of the embodiments of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the concept of the embodiments of the present application, and these modifications and improvements fall within the scope of protection of the embodiments of the present application.

Claims

1. A fraudulent website identification and early warning method, characterized in that: The method comprises: Get network address information; Extracting multi-dimensional feature data from the network address information, performing similarity detection using graphics processor parallel computing technology, and obtaining a composite feature vector; Combining the composite feature vector analysis to construct fraud features, mining data associations through graph neural networks to obtain multi-dimensional risk feature data; The risk feature data is processed using a deep learning model to generate a risk probability. If the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and an early warning report is generated.

2. The method according to claim 1, characterized in that The method of extracting multi-dimensional feature data from the network address information and performing similarity detection using a graphics processor parallel computing technology to obtain a composite feature vector includes: Extracting structural features, semantic features, behavioral features, and visual features based on the network address information to construct a standardized feature vector; Generate an edit distance matrix using a dynamic programming algorithm according to the standardized feature vector; Utilizing graphics processor parallel computing technology to accelerate the string comparison process of the edit distance matrix, calculate the minimum edit distance value between domain names, and generate a domain name similarity score; Send a query request to the WHOIS server through the network protocol library, and parse the returned registration characteristics including domain name registrant information, registration period, and IP geographic location; The domain name similarity score is associated with the registration feature to generate a composite feature vector.

3. The method according to claim 2, characterized in that The extracting structural features, semantic features, behavioral features, and visual features based on the network address information to construct a standardized feature vector includes: Extracting a structural feature vector based on the hierarchical depth, special symbol ratio, and number of path segments of the URL; Identify keyword frequencies, sentiment tendencies, and fraud-related phrases in the network address information using natural language processing technology to obtain semantic feature vectors; Based on the time series data of access traffic fluctuations, user stay time and page jump frequency contained in the network address information, a recurrent neural network is used to extract the behavioral feature vector; Analyzing page layout similarity, color pattern, and inductive button distribution in the network address information through a convolutional neural network to obtain a visual feature vector; The structural, semantic, behavioral and visual feature vectors are normalized and fused according to weights to generate a unified normalized feature vector.

4. The method according to claim 2, characterized in that The domain similarity score is calculated using the following formula: SimilarityScore=α·EditSim(d1,d2)+β·SemanticSim(d1,d2)+γ·StructSim(d1,d2) SemanticSim(d1,d2)=CosineSimilarity(Embedding(d1),Embedding(d2)) (-μ·|SpecialChars(d1)-SpecialChars(d2)|) Among them, SimliarityScore represents the domain similarity score, EditSim(d1,d2) represents the edit similarity, SemanticSim(d1,d2) represents the semantic similarity, StructSim(d1,d2) represents the structural similarity, α, β, γ represent the weight parameters, d1 and d2 represent the two domain names to be compared, Levenshtein(d1,d2) represents the minimum edit distance (Levenshtein distance) between domain names d1 and d2, λ represents the scaling parameter, Embedding(d i ) represents the domain name d i The semantic vector representation of domain names d1 and d2 is shown in Table 2. CosineSimilarity(·) represents the cosine similarity function, CommonSubstrings(d1,d2) represents the number of common substrings of domain names d1 and d2, and Segments(d i ) represents the domain name d i The number of path segments, SpecialChars(d i ) represents the domain name d i The number of special symbols in , μ represents the penalty coefficient for the difference of special symbols.

5. The method according to claim 1, wherein The fraud features are constructed by combining the composite feature vector analysis, and data association relationships are mined through graph neural networks to obtain multi-dimensional risk feature data, including: Constructing an initial fraud feature set based on the standardized composite feature vector and fusing multi-source data; Building a fraud feature association model based on the initial fraud feature set, using domain names as nodes and associations between features as edges; The fraud feature association model is trained using a graph neural network, and the potential association between domain names and features is mined through a message passing mechanism between nodes to obtain a node embedding vector. The node embedding vector and the composite feature vector are fused, and feature co-occurrence patterns are extracted through a gradient boosting tree to obtain multi-dimensional risk feature data.

6. The method according to claim 1, characterized in that The process of processing the risk feature data using a deep learning model to generate a risk probability, and determining the network address as a high-risk network address and generating a warning report if the risk probability exceeds a preset threshold, includes: Mapping the risk characteristic data using a normalization algorithm to obtain a risk characteristic value; A hybrid architecture of convolutional neural network and recurrent neural network is used to fuse the risk feature values ​​to construct a risk prediction model; The risk prediction model is trained using a dataset of labeled fraudulent URLs and a dataset of normal URLs, and the model parameters are optimized using a back-propagation algorithm to output a risk probability value. Preset a risk threshold based on historical data statistics, compare the risk probability value with the risk threshold, and generate a high risk judgment if it exceeds the threshold; An early warning report including risk level and feature basis is generated in real time based on the network address determined to be high risk.

7. A fraudulent website identification and warning device, characterized in that: The device comprises: A website feature extraction module is used to obtain network address information; it is also used to extract multi-dimensional feature data from the network address information, perform similarity detection using graphics processor parallel computing technology, and obtain a composite feature vector; A fraud feature analysis module is used to construct fraud features by combining the composite feature vector analysis, and to mine data associations through a graph neural network to obtain multi-dimensional risk feature data; The risk assessment and early warning module is used to use a deep learning model to process the risk feature data to generate a risk probability. If the risk probability exceeds a preset threshold, it is determined to be a high-risk network address and an early warning report is generated.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images