A method, apparatus, and device for detecting website link information.
By using extreme gradient boosting of the XGBoost classification model in URL link detection, adding a sensitivity factor to adjust the cost of misclassification, and optimizing model parameters, the problem of low accuracy in malicious URL detection in existing technologies is solved, and efficient malicious URL detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-06-16
- Publication Date
- 2026-04-03
AI Technical Summary
Existing technologies have low accuracy in detecting malicious websites, blacklist technology has low update timeliness and high false positive rate, and heuristic algorithm rules are difficult to update, resulting in the inability to detect malicious websites in a timely manner.
An extreme gradient boosting (XGBoost) classification model is adopted. By adding a sensitivity factor for abnormal URL links, the misclassification cost is adjusted. The model parameters are optimized using a grid search algorithm to detect URL link information, and the extreme gradient boosting algorithm is used for classification.
It achieves a high accuracy rate in detecting malicious websites, solving the problem of low accuracy in existing technologies.
Smart Images
Figure CN115481333B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information detection technology, and in particular to a method, apparatus, and device for detecting website link information. Background Technology
[0002] Cybersecurity occupies one of the most critical and important positions in all social activities worldwide, including politics, economics, military affairs, and technology. With the development of the internet, cyberattacks have become an increasingly significant security issue. Many attack types, such as phishing, Trojan horses, and malware, frequently use malicious URLs as a means of attack. Therefore, identifying malicious URLs is of great importance in preventing various cyberattacks and maintaining network security.
[0003] Existing detection technologies for malicious URLs (which can also be understood as abnormal URL links) mainly include blacklisting and heuristic techniques; among which:
[0004] Blacklisting is the most traditional and classic technique in malicious website detection algorithms. A webpage blacklist contains a list of known malicious websites, typically generated and published by reputable websites based on user reports and webpage content analysis. When a user browses a website, the blacklist database begins searching. If the website is in the blacklist, it is considered malicious, and the browser displays a warning message; otherwise, it is considered a legitimate website.
[0005] Heuristic techniques are a complementary algorithm to blacklisting techniques. Their main principle is to utilize blacklist similarity rules discovered from malicious URLs to identify malicious web pages. This algorithm can identify malicious web pages based on existing heuristic rules (both existing and some previously unseen), without relying on precise matching from the blacklist.
[0006] However, the above technologies have the following drawbacks:
[0007] Blacklist technology cannot update all malicious URLs in a timely manner. Therefore, blacklist technology can only provide users with the minimum level of protection and cannot detect malicious websites in a timely manner or block users from accessing them; it has drawbacks such as serious missed detections and low update timeliness.
[0008] Heuristic algorithms have some well-known drawbacks, such as high false positive rates and difficulty in updating rules.
[0009] As can be seen from the above, the ever-increasing network traffic makes the effective identification of malicious links one of the most pressing cybersecurity issues. However, existing solutions for detecting malicious websites suffer from problems such as low accuracy. Summary of the Invention
[0010] The purpose of this invention is to provide a method, apparatus, and device for detecting website link information, so as to solve the problem of low accuracy in existing schemes for detecting malicious websites.
[0011] To address the aforementioned technical problems, embodiments of the present invention provide a method for detecting website link information, comprising:
[0012] Obtain the URL link information to be detected;
[0013] The XGBoost classification model, which utilizes extreme gradient boosting, is used to detect the URL link information and obtain the classification results.
[0014] The XGBoost classification model includes a sensitivity factor for abnormal URL links.
[0015] The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost.
[0016] The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0017] Optionally, the loss function of the XGBoost classification model is:
[0018]
[0019] Among them, L a The value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0020] Optionally, the value of the sensitivity factor is greater than 1.
[0021] Optionally, the value range of the sensitivity factor is [N / P, (N+P) / P];
[0022] Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0023] Optionally, before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result, the method further includes:
[0024] Based on the first model evaluation index, the first URL link test data, and the initial classification model, the value range of the sensitivity factor is obtained;
[0025] Obtain the training set based on the test data from the second URL link;
[0026] Using a grid search algorithm, the XGBoost classification model is obtained based on the value range of the sensitivity factor, the training set, and the initial classification model;
[0027] The first model evaluation metrics include at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Tort Phrase (TPR) for malicious link detection.
[0028] The test data for the second URL link may be the same as or different from the test data for the first URL link.
[0029] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain classification results includes:
[0030] The XGBoost classification model is used to detect the URL link information based on the category threshold, and the classification result is obtained.
[0031] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes:
[0032] The XGBoost classification model is used to detect the URL link information and obtain the corresponding predicted probability value.
[0033] The classification result of the URL link information is obtained based on the category threshold and the predicted probability value;
[0034] The predicted probability value represents the probability that the URL link information is in an abnormal category, or the probability that it is in a normal category.
[0035] This invention also provides an apparatus for detecting URL link information, comprising:
[0036] The first acquisition module is used to acquire the URL link information to be detected;
[0037] The first classification module is used to use the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result;
[0038] The XGBoost classification model includes a sensitivity factor for abnormal URL links.
[0039] The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost.
[0040] The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0041] Optionally, the loss function of the XGBoost classification model is:
[0042]
[0043] Among them, L a The value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0044] Optionally, the value of the sensitivity factor is greater than 1.
[0045] Optionally, the value range of the sensitivity factor is [N / P, (N+P) / P];
[0046] Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0047] Optional, also includes:
[0048] The second acquisition module is used to obtain the value range of the sensitivity factor based on the first model evaluation index, the first website link test data and the initial classification model before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result.
[0049] The third acquisition module is used to acquire the training set based on the test data linked from the second URL;
[0050] The first processing module is used to obtain the XGBoost classification model by using a grid search algorithm based on the value range of the sensitivity factor, the training set, and the initial classification model.
[0051] The first model evaluation metrics include at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Tort Phrase (TPR) for malicious link detection.
[0052] The test data for the second URL link may be the same as or different from the test data for the first URL link.
[0053] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain classification results includes:
[0054] The XGBoost classification model is used to detect the URL link information based on the category threshold, and the classification result is obtained.
[0055] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes:
[0056] The XGBoost classification model is used to detect the URL link information and obtain the corresponding predicted probability value.
[0057] The classification result of the URL link information is obtained based on the category threshold and the predicted probability value;
[0058] The predicted probability value represents the probability that the URL link information is in an abnormal category, or the probability that it is in a normal category.
[0059] This invention also provides a device for detecting URL link information, including: a processor and a transceiver;
[0060] The processor is used to obtain the URL link information to be detected;
[0061] The XGBoost classification model, which utilizes extreme gradient boosting, is used to detect the URL link information and obtain the classification results.
[0062] The XGBoost classification model includes a sensitivity factor for abnormal URL links.
[0063] The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost.
[0064] The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0065] Optionally, the loss function of the XGBoost classification model is:
[0066]
[0067] Among them, L aThe value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0068] Optionally, the value of the sensitivity factor is greater than 1.
[0069] Optionally, the value range of the sensitivity factor is [N / P, (N+P) / P];
[0070] Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0071] Optionally, the processor is further configured to:
[0072] Before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result, the value range of the sensitivity factor is obtained based on the first model evaluation index, the first URL link test data and the initial classification model.
[0073] Obtain the training set based on the test data from the second URL link;
[0074] Using a grid search algorithm, the XGBoost classification model is obtained based on the value range of the sensitivity factor, the training set, and the initial classification model;
[0075] The first model evaluation metrics include at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Tort Phrase (TPR) for malicious link detection.
[0076] The test data for the second URL link may be the same as or different from the test data for the first URL link.
[0077] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain classification results includes:
[0078] The XGBoost classification model is used to detect the URL link information based on the category threshold, and the classification result is obtained.
[0079] Optionally, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes:
[0080] The XGBoost classification model is used to detect the URL link information and obtain the corresponding predicted probability value.
[0081] The classification result of the URL link information is obtained based on the category threshold and the predicted probability value;
[0082] The predicted probability value represents the probability that the URL link information is in an abnormal category, or the probability that it is in a normal category.
[0083] This invention also provides a device for detecting URL link information, including a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, it implements the above-described method for detecting URL link information.
[0084] This invention also provides a readable storage medium storing a program that, when executed by a processor, implements the steps in the method for detecting URL link information described above.
[0085] The beneficial effects of the above-described technical solution of the present invention are as follows:
[0086] In the above scheme, the method for detecting URL link information obtains the URL link information to be detected; uses an extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a classification result; wherein, the XGBoost classification model includes a sensitivity factor for abnormal category URL links; the sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost; the first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model; it can avoid the XGBoost classification model's preference for the majority class (i.e., the class with more samples) by using the sensitivity factor, thereby avoiding the imbalance in class detection, improving the detection accuracy of abnormal category URL links, and effectively solving the problem of low accuracy in existing schemes for malicious URL detection. Attached Figure Description
[0087] Figure 1 This is a schematic flowchart of a method for detecting URL link information according to an embodiment of the present invention;
[0088] Figure 2 This is a schematic diagram of the XGBoost classification model acquisition process according to an embodiment of the present invention;
[0089] Figure 3 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 1 ;
[0090] Figure 4 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 2 ;
[0091] Figure 5 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 3 ;
[0092] Figure 6 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 4 ;
[0093] Figure 7 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 5 ;
[0094] Figure 8 This is a schematic diagram illustrating the relationship between G-mean and sensitivity factor in an embodiment of the present invention. Figure 6 ;
[0095] Figure 9 This is a schematic diagram of the device structure for detecting URL link information according to an embodiment of the present invention;
[0096] Figure 10 This is a schematic diagram of the device structure for detecting URL link information according to an embodiment of the present invention. Detailed Implementation
[0097] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.
[0098] This invention addresses the problem of low accuracy in existing malicious website detection solutions by providing a method for detecting website link information, such as... Figure 1 As shown, it includes:
[0099] Step 11: Obtain the URL link information to be detected;
[0100] Step 12: Use the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result; wherein, the XGBoost classification model includes a sensitivity factor for abnormal URL links; the sensitivity factor makes the first misclassification cost in the XGBoost classification model less than the second misclassification cost; the first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0101] Specifically, for example, the loss function for misclassifying a small number of samples (specifically, positive class samples, i.e., samples of abnormal category URL links) as a large number of samples (specifically, negative class samples, i.e., samples of normal category URL links) is: The larger this value, the greater the cost of misclassification. The algorithm's learning process aims to find the optimal solution that minimizes the loss function. Therefore, increasing the cost of misclassification (misclassifying a positive sample as a negative sample) will cause the algorithm to reduce misclassification and thus decrease the loss function. Thus, adding a sensitivity factor for abnormal URLs to the XGBoost classification model can control the cost of the first misclassification to be less than the cost of the second misclassification. Specifically, this can be achieved by adding a sensitivity factor for abnormal URLs to the loss function of the XGBoost classification model.
[0102] The method for detecting URL link information provided in this invention obtains the URL link information to be detected; utilizes an extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a classification result; wherein, the XGBoost classification model includes a sensitivity factor for abnormal category URL links; the sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost; the first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model; it can avoid the XGBoost classification model's preference for the majority class (i.e., the class with more samples) by using the sensitivity factor, thereby avoiding imbalance in class detection, improving the detection accuracy of abnormal category URL links, and effectively solving the problem of low accuracy in existing schemes for malicious URL detection.
[0103] In this embodiment of the invention, the loss function of the XGBoost classification model is: Among them, L a The value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0104] The samples are those used when training (i.e. obtaining) the XGBoost classification model, and may specifically belong to the test data linked in the second URL below.
[0105] In this embodiment of the invention, when the number of abnormal category URLs is less than the number of normal category URLs during the training of the XGBoost classification model, the value of the sensitivity factor is greater than 1.
[0106] In this embodiment of the invention, the value range of the sensitive factor is [N / P, (N+P) / P]; where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0107] This allows for higher model accuracy. Specifically, N represents the number of URLs in the normal category during XGBoost classification model training; P represents the number of URLs in the abnormal category during XGBoost classification model training.
[0108] Furthermore, before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result, the method further includes: obtaining the value range of the sensitivity factor based on the first model evaluation metric, the first URL link test data, and the initial classification model; obtaining the training set based on the second URL link test data; and using a grid search algorithm to obtain the XGBoost classification model based on the value range of the sensitivity factor, the training set, and the initial classification model. The first model evaluation metric includes at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Total Detection Reliability (TPR). The second URL link test data may be the same as or different from the first URL link test data.
[0109] This approach aims to obtain a model with high prediction accuracy. The first set of test data (URLs) can contain at least one set of test data. G-mean represents the combined accuracy for positive and negative examples.
[0110] Furthermore, the method further includes: obtaining a test set corresponding to the training set based on the second URL link test data; testing the XGBoost classification model based on the test set to obtain test results; updating the XGBoost classification model if the test results do not meet the accuracy conditions; wherein the accuracy conditions include: a threshold value of a second model evaluation metric; the second model evaluation metric includes at least one of: Area Under the Receiver Operating Characteristic (AUC), G-means, and TPR (Terror Point Recognition Precision).
[0111] This approach aims to obtain a model with high prediction accuracy. The second set of URL link test data can include at least one set of URL link test data. G-mean represents the combined accuracy of positive and negative examples. The "updating the XGBoost classification model" step specifically includes: re-executing the process based on the first set of URL link test data to obtain the training set; and using a grid search algorithm, obtaining the XGBoost classification model based on the training set and the initial classification model.
[0112] In this embodiment of the invention, the step of using the Extreme Gradient Boosting XGBoost classification model to detect the URL link information and obtain a classification result includes: using the Extreme Gradient Boosting XGBoost classification model to detect the URL link information according to a category threshold and obtain a classification result.
[0113] This makes it easier to determine the category of URL link information.
[0114] Specifically, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes: using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a corresponding predicted probability value; and obtaining a classification result of the URL link information based on the category threshold and the predicted probability value; wherein the predicted probability value represents the probability value that the URL link information belongs to an abnormal category, or the probability value that belongs to a normal category.
[0115] The classification result can be understood as the category.
[0116] In this embodiment of the invention, obtaining a training set and a test set based on the second URL link test data includes: obtaining the second URL link test data (also known as the original URL link data), extracting features from the second URL link test data to obtain feature data; performing standardization processing on the feature data (e.g., 0-1 standardization processing) to obtain a sample set; and dividing the sample set according to a first ratio (e.g., 9:1) to obtain a training set and a test set.
[0117] The following is an example illustrating the method for detecting URL link information provided in the embodiments of the present invention.
[0118] To address the aforementioned technical problems, and considering that in practical applications, the number of malicious links is far less than the number of normal links, meaning the data used to train the model is class-imbalanced; traditional XGBoost algorithms, if trained on highly imbalanced datasets, often exhibit weak classification ability for minority class samples, resulting in weak detection of malicious links; this invention provides a method for detecting URL link information, specifically a cost-sensitive XGBoost-based method for detecting malicious links (corresponding to the aforementioned abnormal category of URL links). This involves using a cost-sensitive learning strategy: cost-sensitive learning assigns a higher misclassification cost (corresponding to the second misclassification cost) to minority class samples and a lower misclassification cost (corresponding to the first misclassification cost) to majority class samples. In this way, cost-sensitive learning increases the importance of minority class samples during the learner's training process, thereby reducing the classifier's bias towards the majority class. The cost-sensitive XGBoost proposed in this solution can solve the problem of data class imbalance without changing the original data distribution, improve the detection ability of malicious links, reduce the likelihood of overfitting, and enhance the model's generalization ability. This can also be understood as the malicious link detection method proposed in this scheme utilizing cost-sensitive learning, which can solve the problem of data class imbalance without changing the original data distribution, and reduce the classifier's preference for the majority class.
[0119] Specifically, the malicious link detection method based on cost-sensitive XGBoost proposed in this solution involves... Figure 2 The process shown:
[0120] (1) Obtain the original URL (Uniform Resource Locator) data. The original URL data contains the complete URL link (corresponding to the above URL link information) and the corresponding tag, whether it is malicious or normal. Malicious tags are 1, and normal tags are 0.
[0121] (2) Analyze the original URL data and extract relevant feature data from the URL according to certain rules.
[0122] (3) The extracted feature data can be standardized by 0-1 to determine the sample set, which can be divided into training set and test set according to the ratio of 9:1.
[0123] (4) Construct a cost-sensitive XGBoost binary classification model (corresponding to the XGBoost classification model above), set the initial parameters of the model (corresponding to the initial classification model above), input the training set and train it according to the grid search algorithm to obtain the best malicious link classification model.
[0124] (5) Subsequently, the trained cost-sensitive XGBoost binary classification model can be tested using the test set, and the predicted probability value of malicious links corresponding to each sample (corresponding to the above predicted probability value) can be output. Then, a threshold (corresponding to the above category threshold) can be set to convert the predicted probability value into a 0-1 label. 0 corresponds to normal links (negative class) and 1 corresponds to malicious links (positive class), thus obtaining the classification results corresponding to each URL link in the test set.
[0125] The following sections will introduce each part of this plan.
[0126] I. Regarding the raw URL data mentioned above, specifically, this solution uses web crawlers to collect 600,000 URLs online, of which 200,000 are malicious links and 400,000 are legitimate links. Random samples are then randomly selected from these 600,000 data points at different proportions to construct 18 imbalanced datasets, as shown in Table 1. The number of legitimate links (corresponding to the number of URLs in the normal category used to obtain the aforementioned sensitive factors) is denoted as N, and the number of malicious links (corresponding to the number of URLs in the abnormal category used to obtain the aforementioned sensitive factors) is denoted as P. The total number of samples is then N+P.
[0127] Table 1. List of Datasets
[0128] Dataset number total Number of valid links (N) Number of malicious links (P) N:P A1 150000 100000 50000 2：1 A2 130000 100000 30000 10：3 A3 120000 100000 20000 5：1 A4 110000 100000 10000 10：1 A5 105000 100000 5000 20：1 A6 101000 100000 1000 100：1 B1 300000 200000 100000 2：1 B2 260000 200000 60000 10：3 B3 240000 200000 40000 5：1 B4 220000 200000 20000 10：1 B5 210000 200000 10000 20：1 B6 202000 200000 2000 100：1 C1 600000 400000 200000 2：1 C2 520000 400000 120000 10：3 C3 480000 400000 80000 5：1 C4 440000 400000 40000 10：1 C5 420000 400000 20000 20：1 C6 404000 400000 4000 100：1
[0129] II. The model evaluation metrics mentioned above are introduced as follows: 1. AUC: The area under the ROC curve (receiver operating characteristic curve). The ROC value is generally between 0.5 and 1.0. The larger the value, the higher the accuracy of the model's judgment; that is, the closer to 1, the better.
[0130] 2. G-mean: A combined metric of positive and negative accuracy, comprehensively measuring the model's classification ability while taking into account the evaluation data for minority class recognition. This metric is commonly used when the model is imbalanced. A higher value indicates better model classification ability. Specifically, G-mean = [(TP / (TP+FN)) × (TN / (TN+FP))] 1 / 2 Where FN represents the number of positive classes predicted as negative classes; FP represents the number of negative classes predicted as positive classes; TP represents the number of positive classes predicted as positive classes; and TN represents the number of negative classes predicted as negative classes.
[0131] 3. Malicious Link Detection Accuracy (TPR): TPR = Number of malicious links predicted as malicious links / Total number of malicious links.
[0132] III. Regarding cost-sensitive XGBoost:
[0133] XGBoost using the default loss function is prone to overfitting when learning from imbalanced samples, resulting in poor model generalization and meaningless predictions. To address imbalanced data without altering the original data distribution, this approach combines XGBoost with cost-sensitive learning. Cost-sensitive learning assigns higher misclassification costs to minority class samples and lower misclassification costs to majority class samples. This increases the importance of minority class samples during learner training, reducing the classifier's bias towards the majority class and thus improving the detection rate of malicious links. In this approach, cost-sensitive XGBoost adds a cost-sensitive factor 'a' (for positive class samples): when 'a' > 1, it increases the penalty for FN (Fluidity), specifically for predicting a positive class as a negative class, reducing the bias towards the negative class and improving the detection rate of positive (malicious links). When 'a' < 1, it increases the penalty for FP (Fluidity), specifically for predicting a negative class as a positive class, reducing the bias towards the positive class. The case of 'a' < 1 does not meet the criteria for malicious link detection.
[0134] The loss function of XGBoost in this scheme is as follows:
[0135] The meanings of each parameter are explained above and will not be repeated here.
[0136] Specifically, based on the loss function described above, the corresponding first and second derivatives can be obtained:
[0137]
[0138]
[0139] The cost-sensitive XGBoost algorithm can then be derived based on the loss function described above.
[0140] IV. The cost-sensitivity factor a is introduced as follows:
[0141] 1) The range of values for the cost sensitivity factor 'a':
[0142] When the number of negative samples (normal links) is less than the number of positive samples (malicious links), the value of 'a' is 0. <a<1;
[0143] When the number of positive samples (malicious links) is less than the number of negative samples (normal links), the value of a is: a>1.
[0144] When the number of positive samples (malicious links) equals the number of negative samples (normal links), the value of a is: a = 1.
[0145] The problem of malicious link detection specifically corresponds to the situation where the number of positive class samples is less than the number of negative class samples, so this solution can specifically consider the case where a>1.
[0146] 2) The optimal range of values for a (taking G-mean as an example for the evaluation index of the first model above):
[0147] On 18 datasets, the model was trained by taking different values of 'a', and the relationship between G-mean and 'a' was obtained, see [link to data]. Figures 3 to 8 It can be concluded that: 1) For datasets with different balance, the relationship between G-mean and a for each graph is basically consistent. As a increases, the general trend of G-mean is consistent: G-mean first increases, then tends to stabilize and then decreases; 2) With Figure 3 For example, the horizontal axis is 'a', the vertical axis is G-mean, and A1, B1, and C1 are three datasets with the same degree of imbalance but different data sizes. Different datasets are represented by different line types. As 'a' increases, the trend of G-mean on each dataset is basically consistent. Figures 4 to 8 The same applies to China. Figures 3 to 8 The imbalance of the datasets corresponding to the various graphs is different, but the curves corresponding to different dataset sizes in each graph show consistent behavior. Therefore, the value of 'a' is mainly related to the degree of imbalance of the dataset. 3) For 18 datasets, the G-mean value reaches its maximum for the first time when 'a' takes values in the interval [N / P, (N+P) / P]. Therefore, when using cost-sensitive XGBoost, the model performs best when the value takes values in the interval [N / P, (N+P) / P]. It should be noted that... Figures 3 to 8 The vertical dashed line in the diagram corresponds to a = (N + P) / P.
[0148] V. Comparison Results of Cost-Sensitive XGBoost and Conventional XGBoost in this Scheme
[0149] Table 2 shows the comparison results of cost-sensitive XGBoost and regular XGBoost across 18 datasets. In datasets with varying degrees of imbalance, and in datasets with the same degree of imbalance but different data volumes, the AUC, G-mean, and TPR values of the CS-XGB (cost-sensitive XGBoost) model are all higher than those of regular XGB (XGBoost).
[0150] Table 2
[0151]
[0152] As can be seen from the above, the solutions provided by the embodiments of the present invention involve:
[0153] 1. The introduction of 'a' in the cost-sensitive XGBoost method and the impact of the value of 'a' on the model.
[0154] 2. Cost-sensitive XGBoost: Compared to XGBoost, XGBoost solves the problem of data imbalance and improves the model's generalization ability.
[0155] 3. Cost-sensitive XGBoost improves the AUC, G-mean, and TPR of the model compared to XGBoost.
[0156] This can also be understood as follows: this scheme introduces a sensitive factor to construct a new cost-sensitive binary classification model, and then uses this new model to detect malicious links. By introducing the sensitive factor, the imbalance problem between different datasets can be addressed, improving the model's generalization ability and thus increasing the accuracy of malicious link detection. Specifically, this scheme does not change the original dataset; it addresses the imbalance problem by altering the algorithm's preference for the majority class (here, the negative class).
[0157] In summary, the solution provided by the embodiments of the present invention can:
[0158] (1) Solve the problem of imbalanced data classification;
[0159] (2) Improve the accuracy of malicious link detection (specifically, by combining cost-sensitive learning and the XGBoost algorithm, the accuracy of malicious link detection is greatly improved).
[0160] (2) Improves the generalization ability of the model and is less prone to overfitting.
[0161] In this embodiment of the invention, the XGBoost algorithm can extract important feature representations of a domain name by analyzing the webpage URL and webpage information, and train a prediction model.
[0162] XGBoost is an open-source machine learning project that efficiently implements the GBDT (Gradient Boosting Decision Tree) algorithm and makes many algorithmic and engineering improvements, leading to its widespread application. Specifically, the XGBoost algorithm introduces second-order derivatives for Taylor expansion of the loss function and L2 regularization of parameters to comprehensively evaluate the model's complexity. It supports parallel computation, improves algorithm accuracy, and the regularization term prevents overfitting.
[0163] This invention also provides a device for detecting website link information, such as... Figure 9 As shown, it includes:
[0164] The first acquisition module 91 is used to acquire the URL link information to be detected;
[0165] The first classification module 92 is used to use the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result;
[0166] The XGBoost classification model includes a sensitivity factor for abnormal URL links.
[0167] The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost.
[0168] The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0169] The apparatus for detecting URL link information provided in this invention acquires the URL link information to be detected; utilizes an extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a classification result; wherein, the XGBoost classification model includes a sensitivity factor for abnormal category URL links; the sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost; the first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model; it can avoid the XGBoost classification model's preference for the majority class (i.e., the class with more samples) by using the sensitivity factor, thereby avoiding imbalance in class detection, improving the detection accuracy of abnormal category URL links, and effectively solving the problem of low accuracy in existing schemes for detecting malicious URLs.
[0170] In this embodiment of the invention, the loss function of the XGBoost classification model is: Among them, L a The value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0171] In this embodiment of the invention, the value of the sensitivity factor is greater than 1.
[0172] In this embodiment of the invention, the value range of the sensitive factor is [N / P, (N+P) / P]; where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0173] Furthermore, the apparatus further includes: a second acquisition module, used to acquire the value range of the sensitivity factor based on a first model evaluation metric, first website link test data, and an initial classification model before detecting the URL link information using an extreme gradient boosting XGBoost classification model to obtain a classification result; a third acquisition module, used to acquire a training set based on the second website link test data; and a first processing module, used to acquire the XGBoost classification model using a grid search algorithm based on the value range of the sensitivity factor, the training set, and the initial classification model; wherein the first model evaluation metric includes at least one of the area under the receiver operating characteristic curve (AUC), G-mean, and malicious link detection accuracy (TPR); and the second website link test data may be the same as or different from the first website link test data.
[0174] The step of using the Extreme Gradient Boosting (XGBoost) classification model to detect the URL link information and obtain classification results includes: using the Extreme Gradient Boosting (XGBoost) classification model to detect the URL link information according to a category threshold and obtain classification results.
[0175] Specifically, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes: using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a corresponding predicted probability value; and obtaining a classification result of the URL link information based on the category threshold and the predicted probability value; wherein the predicted probability value represents the probability value that the URL link information belongs to an abnormal category, or the probability value that belongs to a normal category.
[0176] The implementation embodiments of the above-described method for detecting URL link information are all applicable to the embodiments of the device for detecting URL link information, and can achieve the same technical effect.
[0177] This invention also provides a device for detecting website link information, such as... Figure 10 As shown, it includes: processor 101 and transceiver 102;
[0178] The processor 101 is used to obtain the URL link information to be detected;
[0179] The XGBoost classification model, which utilizes extreme gradient boosting, is used to detect the URL link information and obtain the classification results.
[0180] The XGBoost classification model includes a sensitivity factor for abnormal URL links.
[0181] The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost.
[0182] The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model.
[0183] The device for detecting URL link information provided in this embodiment of the invention acquires the URL link information to be detected; it uses an extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a classification result; wherein, the XGBoost classification model includes a sensitivity factor for abnormal category URL links; the sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost; the first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model; it can avoid the XGBoost classification model's preference for the majority class (i.e., the class with more samples) by using the sensitivity factor, thereby avoiding the imbalance in class detection, improving the detection accuracy of abnormal category URL links, and effectively solving the problem of low accuracy in existing schemes for detecting malicious URLs.
[0184] In this embodiment of the invention, the loss function of the XGBoost classification model is: Among them, L a The value represents the loss function of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, a represents the sensitivity factor, and y represents the loss function of the XGBoost classification model. i This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample.
[0185] In this embodiment of the invention, the value of the sensitivity factor is greater than 1.
[0186] In this embodiment of the invention, the value range of the sensitive factor is [N / P, (N+P) / P]; where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
[0187] Furthermore, the processor is also configured to: before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result, obtain the value range of the sensitivity factor based on the first model evaluation metric, the first URL link test data, and the initial classification model; obtain a training set based on the second URL link test data; and obtain the XGBoost classification model using a grid search algorithm based on the value range of the sensitivity factor, the training set, and the initial classification model; wherein, the first model evaluation metric includes at least one of the area under the receiver operating characteristic curve (AUC), G-mean, and malicious link detection accuracy (TPR); and the second URL link test data may be the same as or different from the first URL link test data.
[0188] The step of using the Extreme Gradient Boosting (XGBoost) classification model to detect the URL link information and obtain classification results includes: using the Extreme Gradient Boosting (XGBoost) classification model to detect the URL link information according to a category threshold and obtain classification results.
[0189] Specifically, the step of using the extreme gradient boosting XGBoost classification model to detect the URL link information based on a category threshold and obtain a classification result includes: using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain a corresponding predicted probability value; and obtaining a classification result of the URL link information based on the category threshold and the predicted probability value; wherein the predicted probability value represents the probability value that the URL link information belongs to an abnormal category, or the probability value that belongs to a normal category.
[0190] The implementation embodiments of the above-described method for detecting URL link information are all applicable to the embodiments of the device for detecting URL link information, and can achieve the same technical effect.
[0191] This invention also provides a device for detecting URL link information, including a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, it implements the above-described method for detecting URL link information.
[0192] The implementation embodiments of the above-described method for detecting URL link information are all applicable to the embodiments of the device for detecting URL link information, and can achieve the same technical effect.
[0193] This invention also provides a readable storage medium storing a program that, when executed by a processor, implements the steps in the method for detecting URL link information described above.
[0194] The implementation embodiments of the above-described method for detecting URL link information are all applicable to the embodiments of the readable storage medium and can achieve the same technical effect.
[0195] It should be noted that many of the functional components described in this specification are referred to as modules in order to more specifically emphasize the independence of their implementation.
[0196] In this embodiment of the invention, the module can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.
[0197] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.
[0198] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.
[0199] The above describes the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A method for detecting URL link information, characterized in that, include: Obtain the URL link information to be detected; The XGBoost classification model, which utilizes extreme gradients, is used to detect the URL link information and obtain the classification results. The XGBoost classification model includes a sensitivity factor for abnormal URL links. The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost. The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model. The loss function of the XGBoost classification model is: ； in, This represents the loss function value of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, and a represents the sensitivity factor. This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample; The value range of the sensitivity factor is [N / P, (N+P) / P]; Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
2. The method according to claim 1, characterized in that, Before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result, the following steps are also included: Based on the first model evaluation index, the first URL link test data, and the initial classification model, the value range of the sensitivity factor is obtained; Obtain the training set based on the test data from the second URL link; Using a grid search algorithm, the XGBoost classification model is obtained based on the value range of the sensitivity factor, the training set, and the initial classification model. The first model evaluation metrics include at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Tort Phrase (TPR) for malicious link detection. The test data for the second URL link may be the same as or different from the test data for the first URL link.
3. The method according to claim 1, characterized in that, The XGBoost classification model, which utilizes extreme gradient boosting, is used to detect the URL link information and obtain classification results, including: The XGBoost classification model is used to detect the URL link information and obtain the corresponding predicted probability value. The classification result of the URL link information is obtained based on the category threshold and the predicted probability value; The predicted probability value represents the probability that the URL link information is in an abnormal category, or the probability that it is in a normal category.
4. A device for detecting website link information, characterized in that, include: The first acquisition module is used to acquire the URL link information to be detected; The first classification module is used to use the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result; The XGBoost classification model includes a sensitivity factor for abnormal URL links. The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost. The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model. The loss function of the XGBoost classification model is: ； in, This represents the loss function value of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, and a represents the sensitivity factor. This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample; The value range of the sensitivity factor is [N / P, (N+P) / P]; Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
5. The apparatus according to claim 4, characterized in that, Also includes: The second acquisition module is used to obtain the value range of the sensitivity factor based on the first model evaluation index, the first website link test data and the initial classification model before using the extreme gradient boosting XGBoost classification model to detect the URL link information and obtain the classification result. The third acquisition module is used to acquire the training set based on the test data linked from the second URL; The first processing module is used to obtain the XGBoost classification model by using a grid search algorithm based on the value range of the sensitivity factor, the training set, and the initial classification model. The first model evaluation metrics include at least one of the following: Area Under the Receiver Operating Characteristic (AUC), G-mean, and Tort Phrase (TPR) for malicious link detection. The test data for the second URL link may be the same as or different from the test data for the first URL link.
6. The apparatus according to claim 4, characterized in that, The XGBoost classification model, which utilizes extreme gradient boosting, is used to detect the URL link information and obtain classification results, including: The XGBoost classification model is used to detect the URL link information and obtain the corresponding predicted probability value. The classification result of the URL link information is obtained based on the category threshold and the predicted probability value; The predicted probability value represents the probability that the URL link information is in an abnormal category, or the probability that it is in a normal category.
7. A device for detecting website link information, characterized in that, include: Processor and transceiver; The processor is used to obtain the URL link information to be detected; The XGBoost classification model, which utilizes extreme gradients, is used to detect the URL link information and obtain the classification results. The XGBoost classification model includes a sensitivity factor for abnormal URL links. The sensitivity factor enables the first misclassification cost in the XGBoost classification model to be less than the second misclassification cost. The first misclassification cost corresponds to the misclassification cost of a large number of samples when training the XGBoost classification model, and the second misclassification cost corresponds to the misclassification cost of a small number of samples when training the XGBoost classification model. The loss function of the XGBoost classification model is: ； in, This represents the loss function value of the XGBoost classification model, where n represents the total number of samples, i represents the i-th sample, and a represents the sensitivity factor. This represents the true classification value of the i-th sample. This represents the predicted classification value of the i-th sample; The value range of the sensitivity factor is [N / P, (N+P) / P]; Where N represents the number of URL links used to obtain the normal category of the sensitive factor, P represents the number of URL links used to obtain the abnormal category of the sensitive factor, and N is greater than P.
8. A device for detecting URL link information, comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that, When the processor executes the program, it implements the method for detecting URL link information as described in any one of claims 1 to 3.
9. A readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method for detecting URL link information as described in any one of claims 1 to 3.