A phishing website detection method integrating optimal artificial features and deep features

Abstract

The present invention discloses a phishing website detection method that integrates optimal artificial features and deep features. The method first encodes phishing features (artificial features for short), then deletes useless features using evidence weights; uses a bidirectional search algorithm combined with a simulated annealing strategy to remove redundant features; then automatically extracts deep features from URLs using a convolutional neural network (CNN) feature extraction model; after obtaining the URL deep features, they are integrated with the optimal artificial features after feature selection to express the characteristic information of phishing websites from multiple aspects; and detects phishing websites by establishing a random forest classification model. The present invention reduces the dimensionality of artificial features through a feature selection algorithm and integrates them with the URL deep features automatically extracted by a deep learning algorithm, greatly improving the accuracy and speed of phishing website detection.

Description

Technical Field

[0001] The present invention relates to computer information security technology, and in particular to a phishing website detection method that integrates optimal artificial features and deep features. Background Art

[0002] Phishing is a criminal activity that uses social engineering and technical tactics to deceive unwary internet users. Phishing attackers send malicious links via fake emails, directing users to spoofed websites to steal their personal identity data and financial account credentials. This poses a significant threat to internet users and causes significant financial losses. According to the Anti-Phishing Working Group (AWPQ) report for the third quarter of 2021, 260,642 phishing attacks occurred in July 2021, the highest monthly number in the report's history. Furthermore, the number of phishing attacks observed by the APWG and its members increased in 2021, doubling compared to the beginning of 2020.

[0003] To mitigate the threat of phishing, the industry and academia have proposed many automatic phishing detection technologies and methods, which are mainly divided into four categories: blacklist technology, heuristic rules, traditional machine learning methods and deep learning technology. However, these methods all have certain limitations.

[0004] Blacklist updates take time and are unable to process newly emerged URLs. Heuristic rules are designed to detect phishing attacks based on typical abnormal behavior and statistical analysis results. Compared to blacklist techniques, they offer improved real-time detection capabilities. However, phishing attackers can bypass the constructed filters after obtaining heuristic rules, rendering heuristic detection methods ineffective in such cases. Traditional machine learning methods primarily focus on feature engineering. The quality of the selected features determines the accuracy of the model. However, feature engineering relies on manually prepared expert knowledge, resulting in highly subjective conclusions. Deep learning methods, on the other hand, do not rely on prior knowledge. Instead, they discover features in the data that meet the classifier's criteria through an automated learning process. However, deep learning requires a large amount of training data. When data is sufficient or prior knowledge is limited, it can achieve better results than traditional machine learning models. Therefore, there is an urgent need for a method that combines the advantages of traditional feature engineering with the automatic feature extraction of deep learning to obtain features that can more accurately and efficiently identify phishing websites and improve the effectiveness of detection models. Summary of the Invention

[0005] Purpose of the invention: The purpose of the present invention is to address the deficiencies in the prior art and to provide a phishing website detection method that integrates optimal artificial features and deep features.

[0006] Technical solution: The present invention provides a phishing website detection method that integrates optimal artificial features and deep features, characterized by comprising the following steps:

[0007] Step S1: Obtain a URL sample dataset, where the URL types of the dataset include phishing websites and legitimate websites, which are used as training samples and test samples for the detection model. The training samples are used as the phishing dataset D.

[0008] Step S2: Perform artificial feature extraction and feature preprocessing on the URL training samples, and then design a feature selection algorithm to obtain a set of optimal artificial feature sets;

[0009] S2.1. Manual feature extraction: Extract features from the phishing dataset D based on existing common features (e.g., URL features, HTML features, and external features) to obtain the initial set of manual features F.

[0010] S2.2. Calculate the Gini coefficient of all features f in the artificial feature set F;

[0011] S2.3. Obtain the optimal feature segmentation point set for all features in the artificial feature set F: Take the feature corresponding to the minimum Gini coefficient as the optimal feature segmentation point. Use the same method to divide the set divided by the optimal feature segmentation point into smaller sets until the number of samples in the set is less than 10% of the total sample size. At this point, it can be considered that feature f has achieved optimal discretization, and the feature segmentation point set of feature f is obtained.

[0012] S2.4. Delete useless features: Sort the phishing features by weight of evidence (WoE) and delete all features with InVa values less than the preset value;

[0013] S2.5. Delete redundant features: Combine simulated annealing strategy and bidirectional search algorithm to delete redundant features;

[0014] Step S3: Use one-hot encoding and character embedding technology to convert the URL into a dense vector, and then use convolutional neural network to learn the deep features of the URL, and then automatically extract the deep features F of the phishing website. deep ;

[0015] Step S4: extract the optimal artificial feature F optimal and deep features F deep Fusion mixed feature F hybrid , then the mixed feature F hybrid Input into the random forest classifier for training to obtain the final phishing website detection model;

[0016] Step S5: Send the URL to be detected to the phishing website detection model trained in step S4 for classification, determine whether the target URL is legal, and inform the user of the detection result, thereby reducing the risk of phishing.

[0017] Furthermore, the specific method for obtaining the URL sample dataset in step S1 is:

[0018] Detect the URL address of the network resource accessed by the user by clicking the mouse, and the user enters the website address to be accessed in the address bar and obtains the target URL address by pressing the Enter key; the target URL address includes the URL protocol, domain name, resource path and request parameters.

[0019] Furthermore, the specific content of the feature segmentation point set for obtaining the fishing feature f in step S2 is:

[0020] For any fishing feature f, there are V possible values. According to the CART algorithm, when the feature f is used to divide the data set D, the decision tree will have V branch nodes. The vth (v={1,2,…,V})th branch node contains all the feature values a v A sample of v As the feature segmentation point, the data set D is divided into two parts D1 and D2. At this time, the feature value a v The Gini coefficient is shown in formula (2):

[0021]

[0022] in,

[0023] k∈[1,K],p k is the proportion of the k-th category samples in D, K is the number of categories in the current data set. Since the phishing detection of the present invention includes phishing samples and legal samples, K is 2;

[0024] After obtaining the Gini coefficients of all eigenvalues of the fishing feature f, the minimum value is recorded as the optimal feature segmentation point

[0025]

[0026] Furthermore, the specific method for performing feature selection on the feature segmentation point set in step S2 is:

[0027] First, remove useless features:

[0028] Assume that the fishing feature f is discretized into d intervals, P i and L iThe number of phishing samples and legal samples in the i-th interval is specified respectively. The weight of evidence calculation method of phishing feature f is as shown in formula (4):

[0029]

[0030] By obtaining the weight of evidence WoE of all intervals of the feature, the information value of the fishing feature f is calculated according to formula (5):

[0031]

[0032] Sort fishing features by InVa value, and delete all features with InVa value less than 0.1 as useless features;

[0033] Since redundant features (i.e., highly correlated features) greatly increase the complexity of the underlying classifier, it is necessary to use a simulated annealing strategy combined with a bidirectional search algorithm to remove redundant features:

[0034] (a) Establish an initially empty target feature set X ori , set the initial parameters: number of iterations N, temperature T0, cooling coefficient α;

[0035] (b) Add the deleted and filtered features to the candidate set X according to the InVa value rem middle;

[0036] (c) Simulated annealing: sequentially select the candidate set X rem Randomly obtain features, and if adding them to the target set improves the evaluation function, then add them; otherwise, add them with a certain probability;

[0037] (d) From the target set X ori Randomly delete features in the function. If the evaluation function is improved after deletion, delete it. Otherwise, do not delete it.

[0038] Furthermore, the detailed process of automatically extracting depth features in step S3 is as follows:

[0039] S3.1. Fix the length of each URL string to L. If the string length is less than L, pad it with zeros until its length reaches L. If the string length exceeds L, delete the content after the Lth character and convert the URL to the target encoding according to the set character-integer mapping relationship;

[0040] At this point, a complete URL is represented as an N×L matrix E;

[0041] E=(e1,e2,…,e L ) T Formula (6)

[0042] S3.2. The target code is encoded using the character embedding method to learn the vector representation of the characters. That is, an embedding layer is added after the input layer to achieve the conversion from sparse vector to dense vector:

[0043] First, the high-dimensional sparse one-hot vector e i Project it into a low-dimensional dense character embedding space and use the weight matrix W to convert the sparse one-hot encoding matrix E into a dense matrix S;

[0044] S=W p×N ×E N×L Formula (7), N is the number of character types;

[0045] Then, the URL is represented as a feature matrix through character embedding technology as shown in Equation (8), where the vector value in S is automatically adjusted as the optimization process of the target task;

[0046] F url =(s1,s2,…s i ,…,s L ) Formula (8)

[0047] S3.3, the feature matrix F url Input to the convolution layer to automatically learn the local features of the URL; the convolution kernel sizes used in the convolution layer are q1 and q2, and the number of different convolution kernels is set to 2 β , β=1,2,3…;

[0048] S3.4. Input the vectors of different scales extracted by the convolution layer into the maximum pooling layer, and then concatenate the outputs of the pooling layer to obtain the final extracted feature vector, as shown in formula (9):

[0049]

[0050] Finally, the obtained feature vector is input into the fully connected layer to automatically optimize the feature vector y cnn (U).

[0051] S3.5. Use the trained neural network as a deep feature extractor to obtain deep features F deep .

[0052] Furthermore, the step S4 converts the optimal artificial feature F optimal and automatic deep features F deep Combined to generate mixed features F hybrid ;

[0053] F hybrid =F optimal ∪F deep Formula (10).

[0054] Furthermore, the optimal artificial features obtained previously are first fused with the deep features as the features of the training set; then the random forest classification model is trained, and important parameters are adjusted to optimize the model; finally, the URL to be detected is input into the trained model, and the input results are returned to the user.

[0055] Beneficial effects: Compared with the prior art, the present invention has the following advantages

[0056] 1. This paper proposes a new feature selection algorithm based on feature importance index (weight of evidence), simulated annealing and bidirectional search. By removing irrelevant and redundant features, a set of features that can effectively detect phishing websites is obtained.

[0057] 2. This invention uses CNN to automatically learn deep features of URLs, evaluate the characteristics of different parts of the URL, and compensate for the shortcomings of artificial features, further improving the model's detection performance. 3. This invention fuses optimal artificial features with deep features to train a random forest classifier, improving the accuracy and timeliness of the phishing website detection model. The detection accuracy of this invention reaches 99.65%, with an F1 score of 99.41%. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is the overall flow chart of the present invention;

[0059] Figure 2 This is the basic structure of the URL in this embodiment;

[0060] Figure 3 This is a flow chart of the feature selection algorithm in the embodiment;

[0061] Figure 4 Flowchart of CNN feature extraction in the embodiment;

[0062] Figure 5 This is the process of training a classification model using mixed features in the present invention. DETAILED DESCRIPTION

[0063] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0064] like Figure 1 As shown, a phishing website detection method that integrates optimal artificial features and deep features in this embodiment includes the following steps:

[0065] Step S1: Obtain a URL sample dataset, where the URL types in the dataset include phishing websites and legitimate websites, which serve as training samples (phishing dataset D) and test samples for the detection model;

[0066] The URL of this embodiment consists of four parts: the URL protocol, such as http, ftp, etc.; the domain name, through which any host on the network can be located; the resource path, through which the address of the resource to be accessed can be found; the request parameters, which carry other information about the resource to be accessed;

[0067] Step S2: Perform artificial feature extraction and feature preprocessing on the URL training samples, and then design a feature selection algorithm to obtain a set of optimal artificial feature sets;

[0068] S2.1. Manual feature extraction: extract features from the fishing dataset D based on commonly used features to obtain the initial manual feature set F;

[0069] S2.2. Calculate the Gini coefficient of all features f in the artificial feature set F;

[0070] S2.3. Obtain the optimal feature segmentation point set for all features in the artificial feature set F: Take the feature corresponding to the minimum Gini coefficient as the optimal feature segmentation point. Use the same method to divide the set divided by the optimal feature segmentation point into smaller sets until the number of samples in the set is less than 10% of the total sample size. At this point, it can be considered that feature f has achieved optimal discretization, and the feature segmentation point set of feature f is obtained.

[0071] S2.4. Delete useless features: Sort the phishing features by weight of evidence (WoE) and delete all features with InVa values less than the preset value;

[0072] S2.5. Delete redundant features: Combine simulated annealing strategy and bidirectional search algorithm to delete redundant features;

[0073] Step S3: Use one-hot encoding and character embedding technology to convert the URL into a dense vector, and then use convolutional neural network to learn the deep features of the URL, and then automatically extract the deep features F of the phishing website. deep ;

[0074] S3.1. Fix the length of each URL string to L. If the string length is less than L, pad it with zeros until its length reaches L. If the string length exceeds L, delete the content after the Lth character and convert the URL to the target encoding according to the set character-integer mapping relationship;

[0075] At this point, a complete URL is represented as an N×L matrix E;

[0076] E=(e1,e2,…,e L ) T Formula (6)

[0077] S3.2. The target code is encoded using the character embedding method to learn the vector representation of the characters. That is, an embedding layer is added after the input layer to achieve the conversion from sparse vector to dense vector:

[0078] First, the high-dimensional sparse one-hot vector e i Project it into a low-dimensional dense character embedding space and use the weight matrix W to convert the sparse one-hot encoding matrix E into a dense matrix S;

[0079] S=W p×N ×E N×L Formula (7), N is the number of character types;

[0080] Then, the URL is represented as a feature matrix through character embedding technology as shown in Equation (8), where the vector value in S is automatically adjusted as the optimization process of the target task;

[0081] F url =(s1,s2,…s i ,…,s L ) Formula (8)

[0082] S3.3, the feature matrix F url Input to the convolution layer to automatically learn the local features of the URL; the convolution kernel sizes used in the convolution layer are q1 and q2, and the number of different convolution kernels is set to 2 β , β=1,2,3…;

[0083] S3.4. Input the vectors of different scales extracted by the convolution layer into the maximum pooling layer, and then concatenate the outputs of the pooling layer to obtain the final extracted feature vector, as shown in formula (9):

[0084]

[0085] Finally, the obtained feature vector is input into the fully connected layer to automatically optimize the feature vector y cnn (U).

[0086] S3.5. Use the trained neural network as a deep feature extractor to obtain deep features F deep ;

[0087] Step S4: extract the optimal artificial feature F optimal and deep features F deep Fusion mixed feature F hybrid , then the mixed feature F hybrid Input into the random forest classifier for training to obtain the final phishing website detection model;

[0088] The optimal artificial feature F is converted into optimaland automatic deep features F deep Combined to generate mixed features F hybrid ;

[0089] F hybrid =F optimal ∪F deep Formula (10);

[0090] Step S5: Send the URL to be detected to the phishing website detection model trained in step S4 for classification, determine whether the target URL is legitimate, and inform the user of the detection result, thereby reducing the risk of phishing;

[0091] First, the optimal artificial features obtained previously are fused with the deep features to serve as the features of the training set; then the random forest classification model is trained, and important parameters are adjusted to optimize the model; finally, the URL to be detected is input into the trained model, and the input results are returned to the user.

[0092] In this embodiment, the specific content of the feature segmentation point set for obtaining the fishing feature f in step S2 is:

[0093] For any fishing feature f, there are V possible values. According to the CART algorithm, when the feature f is used to divide the data set D, the decision tree will have V branch nodes. The vth (v={1,2,…,V})th branch node contains all the feature values a v A sample of v As the feature segmentation point, the data set D is divided into two parts. At this time, the feature value a v The Gini coefficient is shown in formula (2):

[0094]

[0095] in,

[0096] k∈[1,K],p k is the proportion of the k-th category samples in D, K is the number of categories in the current data set. Since the phishing detection of the present invention includes both phishing samples and legitimate samples, K is fixed to 2;

[0097] After obtaining the Gini coefficients of all eigenvalues of the fishing feature f, the minimum value is recorded as the optimal feature segmentation point

[0098]

[0099] In this embodiment, the specific method for performing feature selection on the feature segmentation point set is:

[0100] First, remove useless features:

[0101] Assume that the fishing feature f is discretized into d intervals, P i and L i The number of phishing samples and legal samples in the i-th interval is specified respectively. The weight of evidence calculation method of phishing feature f is as shown in formula (4):

[0102]

[0103] By obtaining the WoE of all intervals of the feature, the information value of the fishing feature f is calculated according to formula (5):

[0104]

[0105] Sort fishing features by InVa value, and delete all features with InVa value less than 0.1 as useless features;

[0106] Then, a simulated annealing strategy combined with a bidirectional search algorithm is used to remove redundant features:

[0107] (a) Establish an initially empty target feature set X ori , set the initial parameters: number of iterations N, temperature T0, cooling coefficient α;

[0108] (b) Add the deleted and filtered features to the candidate set X according to the InVa value rem middle;

[0109] (c) Simulated annealing: sequentially select the candidate set X rem Randomly obtain features, and if adding them to the target set improves the evaluation function, then add them; otherwise, add them with a certain probability;

[0110] (d) From the target set X ori Randomly delete features in the function. If the evaluation function is improved after deletion, delete it. Otherwise, do not delete it.

Claims

1. A phishing website detection method that integrates optimal artificial features and deep features, characterized in that: The following steps are involved: Step S1: Obtain a URL sample dataset, where the URL types of the dataset include phishing websites and legitimate websites, as training samples and test samples, and use the training samples as the phishing dataset D; Step S2: performing artificial feature extraction and feature preprocessing on the URL training samples, and then designing a feature selection method to obtain a set of optimal artificial feature sets; S2.

1. Manual feature extraction: extract features from the fishing dataset D based on existing features to obtain the initial manual feature set F; S2.

2. Calculate the Gini coefficient of all features f in the artificial feature set F; S2.

3. Obtain the optimal feature segmentation point set for all features in the artificial feature set F: Take the feature corresponding to the minimum Gini coefficient as the optimal feature segmentation point; Continue to divide the subset divided by this optimal feature segmentation point into smaller sets until the number of samples in the set is less than 10% of the total sample size. At this point, it can be considered that feature f has achieved optimal discretization, and obtain the feature segmentation point set for feature f; S2.

4. Delete useless features: Sort the phishing features by weight of evidence (WoE) and delete all features with InVa values less than the preset value; S2.

5. Delete redundant features: Combine simulated annealing strategy and bidirectional search algorithm to delete redundant features; Step S3: Use one-hot encoding and character embedding technology to convert the URL into a dense vector, and then use convolutional neural network to learn the deep features of the URL, and then automatically extract the deep features F of the phishing website. deep ; Step S4: extract the optimal artificial feature F optimal and deep features F deep Fusion into mixed features F hybrid , then the mixed feature F hybrid Input into the random forest classifier for training to obtain the final phishing website detection model; Step S5: Send the URL to be detected to the phishing website detection model trained in step S4 for classification, determine whether the target URL is legal, and inform the user of the detection result, thereby reducing the risk of phishing.

2. The phishing website detection method integrating optimal artificial features and deep features according to claim 1, characterized in that: The specific method for obtaining the URL sample dataset in step S1 is: Detect the URL address of the network resource accessed by the user by clicking the mouse, and the user enters the website address to be accessed in the address bar and obtains the target URL address by pressing the Enter key; the target URL address includes the URL protocol, domain name, resource path and request parameters.

3. The phishing website detection method integrating optimal artificial features and deep features according to claim 1, characterized in that: The specific content of obtaining the feature segmentation point set of the fishing feature f in step S2 is: For any fishing feature f, there are V possible values. According to the CART algorithm, when the feature f is used to divide the data set D, the decision tree will have V branch nodes. The v()th branch node contains all the feature values a v Samples, v = {1, 2, ..., V}, with a v As the feature segmentation point, the data set D is divided into two parts D1 and D2. At this time, the feature value a v The Gini coefficient is shown in formula (2): in, k∈[1,K],p k is the proportion of the k-th class samples in D, K is the number of categories divided in the current data set, and K is 2; After obtaining the Gini coefficients of all eigenvalues of the fishing feature f, the minimum value is recorded as the optimal feature segmentation point 4. According to the phishing website detection method integrating optimal artificial features and deep features in claim 1, the specific method of performing feature selection on the feature segmentation point set in step S2 is: First, remove useless features: Assume that the fishing feature f is discretized into d intervals, P i and L i The number of phishing samples and legal samples in the i-th interval is specified respectively. The weight of evidence calculation method of phishing feature f is as shown in formula (4): By obtaining the WoE of all intervals of the feature, the information value of the fishing feature f is calculated according to formula (5): Sort fishing features by InVa value, and delete all features with InVa value less than 0.1 as useless features; Then, a simulated annealing strategy combined with a bidirectional search algorithm is used to remove redundant features: (a) Establish an initially empty target feature set X ori , set the initial parameters: number of iterations N, temperature T0, cooling coefficient α; (b) Add the deleted and filtered features to the candidate set X according to the InVa value rem middle; (c) Simulated annealing: sequentially select the candidate set X rem Randomly obtain features, and if adding them to the target set improves the evaluation function, then add them; otherwise, add them with a certain probability; (d) From the target set X ori Randomly delete features in the function. If the evaluation function is improved after deletion, delete it. Otherwise, do not delete it.

5. The phishing website detection method integrating optimal artificial features and deep features according to claim 1 is characterized in that: The detailed process of automatically extracting depth features in step S3 is as follows: S3.

1. Fix the length of each URL string to L. If the string length is less than L, pad it with zeros until its length reaches L. If the string length exceeds L, delete the content after the Lth character and convert the URL to the target encoding according to the set character-integer mapping relationship; At this point, a complete URL is represented as an N×L matrix E; E = (e1, e2,..., e L ) T Equation (6) S3.

2. The target code is encoded using the character embedding method to learn the vector representation of the characters. That is, an embedding layer is added after the input layer to achieve the conversion from sparse vector to dense vector: First, the high-dimensional sparse one-hot vector e i Project it into a low-dimensional dense character embedding space and use the weight matrix W to convert the sparse one-hot encoding matrix E into a dense matrix S; S=W p×N ×E N×L Formula (7), N is the number of character types; Then, the URL is represented as a feature matrix through character embedding technology as shown in Equation (8), where the vector value in S is automatically adjusted as the optimization process of the target task; F url = (s 1， s2,...s i ,..., s L ) Equation (8) S3.3, the feature matrix F url Input to the convolution layer to automatically learn the local features of the URL; the convolution kernel sizes used in the convolution layer are q1 and q2, and the number of different convolution kernels is set to 2 β , β=1,2,3…; S3.

4. Input the vectors of different scales extracted by the convolution layer into the maximum pooling layer, and then concatenate the outputs of the pooling layer to obtain the final extracted feature vector, as shown in formula (9): Finally, the obtained feature vector is input into the fully connected layer to automatically optimize the feature vector y cnn (U); S3.

5. Use the trained neural network as a deep feature extractor to obtain deep features F deep .

6. According to the phishing website detection method of integrating the best artificial features and deep features in claim 1, the step S4 converts the best artificial feature F optimal and automatic deep features F deep Combined to generate mixed features F hybrid ; F hybrid =F optimal ∪F deep Formula (10).

7. The phishing website detection method integrating optimal artificial features and deep features according to claim 1, characterized in that: The specific method for detecting the target URL in step S5 is: First, the optimal artificial features obtained previously are fused with the deep features to serve as the features of the training set; then the random forest classification model is trained, and important parameters are adjusted to optimize the model; finally, the URL to be detected is input into the trained model, and the input results are returned to the user.

Images