Phishing website detection method and system based on adaptive heterogeneous multi-classification model

A phishing website, multi-classification technology, applied in transmission systems, character and pattern recognition, instruments, etc., can solve the problems of poor timeliness of detection methods, incomplete feature coverage, and unsatisfactory detection technology robustness and generalization performance. , to achieve the effect of improving accuracy and stability, high availability and stability, and superior generalization performance

CN108965245AActive Publication Date: 2018-12-07NAT COMP NETWORK & INFORMATION SECURITY MANAGEMENT CENT +1
7 Cites 19 Cited by

Patent Information

Authority / Receiving Office
CN · China
Current Assignee / Owner
Publication Date
2018-12-07

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention provides a phishing website detection method and system based on an adaptive heterogeneous multi-classification model. The method is characterized by for a multiple-base classification algorithm, through linear addition, constructing the adaptive heterogeneous multi-classification model; training the multi-classification model, wherein a model input is the input of each base classification algorithm and an output is a sample label, and each base classification algorithm extracts a corresponding characteristic from a sample record and is taken as the input; and using a machine learning algorithm to solve a model parameter, adopting a test set to test and optimize, and finally acquiring the detection model of the type of a phishing website. The system comprises a domain name morpheme characteristic classifier, a subject index characteristic classifier, a content similarity characteristic classifier, a structural style characteristic classifier, a visual rule characteristicclassifier, a linear addition training module, an integrated classifier, a training data set management module, and a detection and alarm module. In the invention, the phishing website can be detectedin real time, and the accuracy and the stability of phishing website detection are increased.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to the field of computer network security, in particular to a method and system for detecting phishing websites based on an adaptive heterogeneous multi-classification model. Background technique

[0002] With the vigorous development of Internet technology, network security issues emerge in endlessly. Phishing is a typical online fraud. It uses the Internet as a carrier to deceive users to obtain sensitive information of users by disguising themselves as reputable and legitimate websites. loss. How to quickly and accurately detect phishing websites has become a research hotspot in Web (Global Wide Area Network) information security. Currently public phishing website detection technologies mainly include the following methods:

[0003] (1) Detection technology based on the black and white list mechanism: as a practical core technology, the black and white list has the advantages of high efficiency and accuracy. Through the det...

Examples

Embodiment Construction

[0060] The technical solutions of the present invention will be described in detail below in conjunction with the accompanying drawings and embodiments. The examples given are only for explaining the present invention, not for limiting the scope of the present invention.

[0061] Such as figure 1 As shown, the present invention provides a kind of phishing website detection method based on adaptive heterogeneous multi-classification model (AHMC), this method comprises the detection of the study of self-adaptive heterogeneous multi-classification model and phishing website, each specific implementation is described below step.

[0062] Step 1: Select phishing websites of the same category, such as counterfeit phishing websites of the same bank type, as a sample set D, where |D|=n, where n represents the number of samples in D. Leave-one-out cross-validation was used to classify the samples into training set and test set.

[0063] The jth training sample set is: D j ={(x 1 ,...