A phishing website identification method and device, electronic equipment and storage medium

Abstract

This application discloses a method, apparatus, electronic device, and storage medium for identifying phishing websites. The method includes: extracting at least one first feature and at least one second feature of a website to be identified; the first feature represents URL-related features; the second feature represents website page-related features; inputting the at least one first feature and the at least one second feature into a predefined feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website; and determining that the website to be identified is a phishing website when the first probability is greater than a predefined threshold.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, apparatus, electronic device and storage medium for identifying phishing websites. Background Technology

[0002] Phishing websites refer to fake websites that deceive users. Related technologies primarily identify phishing websites through three methods: 1. Identifying phishing websites by judging the visual information of the webpage; 2. Identifying phishing websites by judging the characteristics of the webpage's logo; 3. Identifying phishing websites by judging the characteristics of the website's corresponding Uniform Resource Locator (URL). However, these methods all have a high false positive rate and low identification efficiency. Summary of the Invention

[0003] In view of this, the main objective of the embodiments of this application is to provide a phishing website identification method, device, electronic device and storage medium to solve the problems of high false positive rate and low identification efficiency of phishing websites in related technologies.

[0004] To achieve the above objectives, the technical solution of this application embodiment is implemented as follows:

[0005] This application provides a method for identifying phishing websites, the method comprising:

[0006] Extract at least one first feature and at least one second feature from the website to be identified; the first feature represents URL-related features; the second feature represents website page-related features;

[0007] The at least one first feature and the at least one second feature are input into a set feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website;

[0008] When the first probability is greater than a set threshold, the website to be identified is determined to be a phishing website.

[0009] In the above scheme, extracting at least one first feature and at least one second feature of the website to be identified includes:

[0010] The URL of the website to be identified is matched against the set field portion of each URL in the set whitelist and set blacklist to obtain the matching result;

[0011] If the matching result indicates that the set field portion of the URL of the website to be identified does not match the set field portion of each URL in the set whitelist or set blacklist, at least one first feature and at least one second feature of the website to be identified are extracted.

[0012] In the above scheme, the step of matching the set field portion of the URL of the website to be identified with the set field portion of each URL in the set whitelist and the set blacklist includes:

[0013] The URL of the website to be identified is preprocessed and converted into a URL in a set format;

[0014] The specified fields of the URL of the website to be identified are matched against the specified fields of each URL in the specified whitelist and the specified blacklist.

[0015] The method in the above scheme further includes:

[0016] If the matching result indicates that the set field of the URL of the website to be identified matches the set field of any URL in the set whitelist or set blacklist, the identification result corresponding to the website to be identified is output.

[0017] In the above scheme, the at least one first feature includes at least one of the following:

[0018] The character similarity between the URL of the website to be identified and each URL in the set whitelist;

[0019] The feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified.

[0020] The method in the above scheme further includes:

[0021] Based on the character length of the URL of the website to be identified, the character length of each URL in the whitelist, and the edit distance, the character similarity between the URL of the website to be identified and each URL in the whitelist is calculated; and / or,

[0022] The character vector corresponding to each character in the URL of the website to be identified is input into a set feature extraction model to obtain the vector output by the set feature extraction model. The vector output by the set feature extraction model is then input into a set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL of the website to be identified.

[0023] In the above scheme, the at least one second feature includes at least one of the following:

[0024] The characteristics of the logo in the website page to be identified;

[0025] The form features in the website page to be identified;

[0026] The ratio of the number of links of a specified type in the website page to be identified to the total number of links;

[0027] The number of sensitive keywords in the website pages to be identified.

[0028] In the above scheme, the at least one second feature includes the feature of the logo in the website page to be identified. When inputting the at least one first feature and the at least one second feature into the set feature fusion network model, the method includes:

[0029] The features of the logo on the website page to be identified are matched with each logo feature in the set logo feature library to obtain the first matching degree;

[0030] The first matching degree is input into the defined feature fusion network model; wherein...

[0031] The established logo feature library is obtained by extracting features from the logos on the website pages corresponding to each URL in the established whitelist.

[0032] This application embodiment also provides a phishing website identification device, the device comprising:

[0033] An extraction unit is configured to extract at least one first feature and at least one second feature of the website to be identified; the first feature represents a URL-related feature; and the second feature represents a website page-related feature.

[0034] An input unit is configured to input the at least one first feature and the at least one second feature into a predefined feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website;

[0035] The determining unit is used to determine that the website to be identified is a phishing website when the first probability is greater than a set threshold.

[0036] This application also provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor, wherein,

[0037] When the processor is used to run the computer program, it performs the steps of any of the above methods.

[0038] This application also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above methods.

[0039] In this embodiment, at least one first feature and at least one second feature of the website to be identified are extracted. The first feature represents a URL-related feature, and the second feature represents a website page-related feature. The at least one first feature and at least one second feature are input into a pre-defined feature fusion network model to obtain a first probability. The first probability represents the probability that the website to be identified is a phishing website. When the first probability is greater than a pre-defined threshold, the website to be identified is determined to be a phishing website. In this way, the website to be identified is evaluated from multiple dimensions based on both URL-related and page-related features. This not only identifies phishing websites with URLs similar to legitimate websites but also those with pages similar to legitimate websites, resulting in a more comprehensive phishing website identification. Furthermore, by simply inputting the extracted relevant features of the website to be identified into a pre-trained feature fusion network model, the first probability that the website to be identified is a phishing website can be obtained. Based on this first probability, the determination of whether the website to be identified is a phishing website is then made, achieving rapid identification of the website to be identified, improving identification efficiency, and making it suitable for large-scale phishing website identification. Attached Figure Description

[0040] Figure 1 A schematic diagram illustrating the implementation process of the phishing website identification method provided in this application embodiment;

[0041] Figure 2 A schematic diagram illustrating the implementation process of the phishing website identification method provided in the application embodiments of this application;

[0042] Figure 3 A schematic diagram illustrating the implementation flow of another phishing website identification method provided for an application embodiment of this application;

[0043] Figure 4 A schematic diagram of a phishing website identification device provided in an embodiment of this application;

[0044] Figure 5 This is a schematic diagram of the hardware structure of the electronic device according to an embodiment of this application. Detailed Implementation

[0045] Phishing websites often use deceptive URLs and visual features to mislead users and gain their trust. After analyzing numerous phishing websites, the following characteristics were found: 1. URLs that are similar to legitimate websites. For example, using... www.orange1. .com-abc.cn imitates www.orange.com; 2. Phishing websites often add the logo of a legitimate website to their pages to mislead users, similar to the visual characteristics of a normal website; 3. Phishing websites typically have pages for reporting lost items, claiming prizes, or logging in, containing various forms and sensitive keywords; 4. Phishing websites have a short lifespan, usually less than 24 hours, and are generally poorly made, with a large number of empty links and external links.

[0046] To address these characteristics, related technologies primarily employ three methods to identify phishing websites: 1. Identifying phishing websites by judging the URL characteristics of the website; 2. Identifying phishing websites by judging the visual information of the webpage; 3. Identifying phishing websites by judging the characteristics of the webpage's logo. However, these methods all suffer from high false positive rates and low identification efficiency.

[0047] Based on this, embodiments of this application provide a phishing website identification method, apparatus, electronic device, and storage medium. The method extracts at least one first feature and at least one second feature from the website to be identified. The first feature represents URL-related features, and the second feature represents website page-related features. The at least one first feature and at least one second feature are input into a pre-defined feature fusion network model to obtain a first probability. This first probability represents the probability that the website to be identified is a phishing website. When the first probability is greater than a pre-defined threshold, the website to be identified is determined to be a phishing website. In this way, the website to be identified is evaluated from multiple dimensions based on both URL-related and page-related features. This not only identifies phishing websites with URLs similar to legitimate websites but also those with pages similar to legitimate websites, resulting in a more comprehensive phishing website identification. Furthermore, by simply inputting the extracted relevant features of the website to be identified into a pre-trained feature fusion network model, the first probability that the website to be identified is a phishing website can be obtained. Based on this first probability, the determination of whether the website to be identified is a phishing website is then made, achieving rapid identification of the website to be identified, improving identification efficiency, and making it suitable for large-scale phishing website identification.

[0048] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0049] Figure 1 This is a schematic diagram illustrating the implementation process of the phishing website identification method provided in this application embodiment. Figure 1 As shown, the method includes:

[0050] Step 101: Extract at least one first feature and at least one second feature of the website to be identified; the first feature represents a URL-related feature; the second feature represents a website page-related feature.

[0051] Here, at least one first feature and one second feature of the website to be identified are extracted, wherein the first feature represents a URL-related feature and the second feature represents a website page-related feature.

[0052] In one embodiment, the at least one first feature includes at least one of the following:

[0053] The character similarity between the URL of the website to be identified and each URL in the set whitelist;

[0054] The feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified.

[0055] Here, the first feature includes the character similarity between the URL of the website to be identified and each URL in the whitelist. The whitelist stores multiple URLs of legitimate websites. The number of URLs stored in the whitelist can be set according to actual needs, such as 1000, but this embodiment does not limit this. Furthermore, the URLs stored in the whitelist are updated periodically based on the popularity of the websites.

[0056] In practical applications, web crawling technology can be used to crawl URLs of various categories of normal websites from the public network, including telecom operators, banks, e-commerce platforms, payment software, mobile phone manufacturers, social networking sites, game developers, cloud storage providers, securities and financial management companies, video websites, and travel websites, and then a whitelist can be built based on these crawled URLs.

[0057] The first feature may further include a feature vector of the URL of the website to be identified, wherein the feature vector is determined based on each character in the URL of the website to be identified. It should be noted that the feature vector of the URL is not a feature of a specific field contained in the URL, such as the domain name field, but rather a feature vector with semantic information determined based on each character contained within it. For example, in the URL of the website to be identified... www.orange In the case of .com-abc.cn, the character vectors corresponding to the characters w, o, r, a, n, g, e, c, m, b, and n are determined respectively. Then, based on the character vector corresponding to each character, the vector corresponding to the URL is determined. The vector corresponding to the URL is input into the set feature extraction model to obtain the vector output by the set feature extraction model. The vector output by the set feature extraction model is input into the set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL.

[0058] By setting the first feature as the character similarity between the URL of the website to be identified and each URL in the set whitelist, and / or the feature vector of the URL of the website to be identified, features related to the URL of the website to be identified can be fully extracted, making it easier to accurately identify whether the website to be identified is a phishing website and improving the accuracy of identification.

[0059] In one embodiment, the method further includes:

[0060] Based on the character length of the URL of the website to be identified, the character length of each URL in the whitelist, and the edit distance, the character similarity between the URL of the website to be identified and each URL in the whitelist is calculated; and / or,

[0061] The character vector corresponding to each character in the URL of the website to be identified is input into a set feature extraction model to obtain the vector output by the set feature extraction model. The vector output by the set feature extraction model is then input into a set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL of the website to be identified.

[0062] Here, based on the character length of the URL of the website to be identified, the character length of each URL in the whitelist, and the edit distance, the character similarity between the URL of the website to be identified and each URL in the whitelist is calculated. The specific formula for calculating the character similarity S between the URL of the website to be identified and any URL in the whitelist is as follows:

[0063]

[0064] Here, Lev represents the edit distance. URL1 represents any URL in the whitelist, and URL2 represents the URL of the website to be identified. Len(URL1) represents the character length of any URL in the whitelist, and Len(URL2) represents the character length of the URL of the website to be identified.

[0065] Edit distance represents the minimum number of single-character editing operations required to transform one word into another. Single-character editing operations include insertion, deletion, and substitution. For example, if word 1 is "kitten" and word 2 is "sitting", then to transform word 1 into word 2, we first need to replace the character "k" with the character "s" to get "sitten", then replace the character "e" with the character "i" to get "sittin", and finally insert the character "g" to get "sitting". Thus, transforming word 1 into word 2 requires 3 single-character editing operations. Therefore, the edit distance between word 1 and word 2 is 3.

[0066] The specific calculation process for S is as follows: The character lengths of URL1 and URL2 are compared to obtain their maximum and minimum character lengths. The maximum character length is subtracted from the edit distance between URL1 and URL2, and the result is compared with the minimum character length. This comparison yields the character similarity between URL1 and URL2. When the characters and character lengths of URL1 and URL2 are exactly the same, S is 1; when the characters and character lengths of URL1 and URL2 are completely different, S is 0. For example, if the character length of URL1 is 7 and the character length of URL2 is 5, and their characters are completely different, converting URL1 to URL2 requires 5 single-character replacement operations and 2 single-character insertion operations. Therefore, the edit distance is 7. Since the maximum character length of URL1 and URL2 is 7 and the minimum is 5, the calculated S is 0.

[0067] Preferably, the character similarity between the URL of the website to be identified and each URL in the whitelist can be calculated based on the length of the specified character portion of the URL of the website to be identified, the length of the specified character portion of each URL in the whitelist, and the edit distance. Here, the specified character portion of the URL of the website to be identified represents the domain name portion of the URL. Because the domain name portion of the URL best reflects the differences between different URLs, the characters in the domain name portion of the URL can be used to calculate character similarity. For example, the URL format of the website to be identified is http: / / mail.111.com / index.html, where http: / / is the protocol, mail is the server name, 111.com is the domain name portion, / is the root directory, and index.html is the default webpage under the root directory. Therefore, the character similarity between the URL of the website to be identified and each URL in the whitelist can be calculated based on the character length of the domain name portion (i.e., 111.com) of the URL of the website to be identified, the length of the domain name portion of each URL in the whitelist, and the edit distance.

[0068] After calculating the character similarity between the URL of the website to be identified and each URL in the set whitelist, the largest character similarity is selected from multiple character similarities and input into the set feature fusion network model.

[0069] Here, the character vector corresponding to each character in the URL of the website to be identified is input into the set feature extraction model to obtain the vector output by the set feature extraction model. The output vector is then input into the set pooling layer for dimensionality reduction to obtain the feature vector of the URL of the website to be identified.

[0070] Specifically, each character in the URL of the website to be identified is first converted into a corresponding character vector using a convolutional neural network model, and the vector corresponding to the URL is formed based on the character vector corresponding to each character.

[0071] The vector corresponding to the URL, composed of character vectors for each character, is input into a pre-defined feature extraction model. This model extracts features from the URL vector, yielding the output vector. The pre-defined feature extraction model is a pre-trained model, such as a Char-CNN network.

[0072] Since the character vector corresponding to each character has a high dimension, the vector corresponding to the URL also has a high dimension. After feature extraction, the vector output by the feature extraction model also has a high dimension. To facilitate subsequent processing, the vector output by the feature extraction model needs to be dimensionality reduced. Therefore, the vector output by the feature extraction model is input into a pooling layer for dimensionality reduction to obtain the feature vector of the URL of the website to be identified after dimensionality reduction.

[0073] It should be noted that in this embodiment, convolutional neural networks with convolutional kernels of different sizes are used to extract deep features from the URLs of the websites to be identified. Compared with time-series related neural networks such as LSTM, the computation speed is faster and can quickly determine the feature vectors of URLs of a large number of websites to be identified, which is more suitable for the identification of large-scale phishing websites in 5G scenarios.

[0074] By calculating the character similarity between the URL of the website to be identified and each URL in the set whitelist, and / or calculating the feature vector of the URL of the website to be identified, the features related to the URL of the website to be identified can be fully extracted, which makes it easier to accurately identify whether the website to be identified is a phishing website and improves the accuracy of identification.

[0075] In one embodiment, the at least one second feature includes at least one of the following:

[0076] The characteristics of the logo in the website page to be identified;

[0077] The form features in the website page to be identified;

[0078] The ratio of the number of links of a specified type in the website page to be identified to the total number of links;

[0079] The number of sensitive keywords in the website pages to be identified.

[0080] Here, the second feature can be the feature of the logo on the website page to be identified. After obtaining the logo on the website page to be identified, the feature of the logo on the website page to be identified is extracted using the Oriented Fast and Rotated BRIEF algorithm.

[0081] The second feature can be the form features on the website page to be identified. Phishing websites typically have pages for reporting lost items or logging in, which require users to fill out various forms. Therefore, form features can be extracted from the website page to be identified, and further identification of whether the website is a phishing website can be based on these form features.

[0082] The second feature can be the ratio of the number of links of a specific type on the target website page to the total number of links. Here, the specified link type includes backlinks and empty links. Phishing websites have a relatively large number of backlinks and empty links on their pages. Therefore, the ratios of backlinks and empty links on the target website page can be extracted, and these ratios can be used to further identify whether the target website is a phishing website.

[0083] The second feature can be the number of sensitive keywords in the website page to be identified. The words contained in the website page are obtained through text segmentation, and then it is determined whether the words in the website page are sensitive words. Specifically, each word in the website page to be identified can be matched against sensitive words in a pre-defined sensitive word list. If a word in the website page to be identified matches any sensitive word in the pre-defined sensitive word list, then that word in the website page to be identified is a sensitive word. After obtaining the judgment result for each word in the website page to be identified, the number of sensitive words in the website page to be identified is counted. The pre-defined sensitive word list is pre-created, and the number of sensitive words in it can be 300. The specific value is determined according to the actual situation, and this embodiment of the application does not limit it. The sensitive word list includes words such as login, password, credit card, and reporting lost / stolen.

[0084] By extracting features such as logo characteristics, form characteristics, the ratio of the number of links of a specified type to the total number of links, and the number of sensitive words from the pages of the website to be identified, we can fully extract features related to the pages of the website to be identified, making it easier to accurately identify whether the website to be identified is a phishing website and improving the accuracy of identification.

[0085] Step 102: Input the at least one first feature and the at least one second feature into the set feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website.

[0086] Here, at least one first feature and at least one second feature are extracted and input into a predefined feature fusion network model. The predefined feature fusion network model outputs a first probability, which represents the probability that the website to be identified is a phishing website. The predefined feature fusion network model consists of two fully connected layers and one softmax layer.

[0087] Step 103: When the first probability is greater than a set threshold, determine that the website to be identified is a phishing website.

[0088] If the probability of a phishing website is greater than a set threshold, then the website to be identified is determined to be a phishing website. The set threshold can be 80%, 85%, or 90%, and the specific value of the set threshold can be set according to the actual situation. This application embodiment does not limit this.

[0089] In one embodiment, extracting at least one first feature and at least one second feature of the website to be identified includes:

[0090] The URL of the website to be identified is matched against the set field portion of each URL in the set whitelist and set blacklist to obtain the matching result;

[0091] If the matching result indicates that the set field portion of the URL of the website to be identified does not match the set field portion of each URL in the set whitelist or set blacklist, at least one first feature and at least one second feature of the website to be identified are extracted.

[0092] Here, a whitelist stores a set number of URLs from legitimate websites, while a blacklist stores a set number of URLs from identified phishing websites. In practice, a set number of URLs can be extracted from the phishtank website and stored in the blacklist. The phishtank website contains a large number of URLs that have been identified as phishing websites.

[0093] The domain name portion of the URL of the website to be identified is represented by the specified field. The domain name portion of the URL of the website to be identified is matched with the domain name portion of each URL in the specified whitelist and blacklist. If the domain name portion of the URL of the website to be identified does not match the domain name portion of each URL in the specified whitelist or blacklist, it means that it cannot be determined whether the URL of the website to be identified is in the specified whitelist or blacklist. Therefore, it is necessary to further determine whether the website to be identified is a phishing website. Thus, at least one first feature and at least one second feature of the website to be identified are extracted. Based on the first and second features of the website to be identified, the identification of the website to be identified continues.

[0094] By matching the URL fields of the website to be identified with the URL fields of the whitelist and blacklist before extracting the first and second features of the website to be identified, the identification efficiency of phishing websites can be improved.

[0095] In one embodiment, the method further includes:

[0096] If the matching result indicates that the set field of the URL of the website to be identified matches the set field of any URL in the set whitelist or set blacklist, the identification result corresponding to the website to be identified is output.

[0097] Here, the domain name portion of the URL of the website to be identified is represented in the specified field. If the domain name portion of the URL of the website to be identified matches the domain name portion of any URL in the specified whitelist, it means that the URL of the website to be identified is a URL in the specified whitelist. Therefore, the result indicating that the website to be identified is a normal website is output.

[0098] If the domain part of the URL of the website to be identified matches the domain part of any URL in the blacklist, it means that the URL of the website to be identified is a URL in the blacklist, and therefore the result of identifying the website as a phishing website is output.

[0099] By matching the specified fields of the URL of the website to be identified with the specified fields of URLs in the whitelist or blacklist, the system outputs the identification result corresponding to the website to be identified, which can quickly obtain the identification result of the website to be identified and improve the identification efficiency of phishing websites.

[0100] In one embodiment, matching the specified field portion of the URL of the website to be identified with the specified field portion of each URL in the specified whitelist and the specified blacklist includes:

[0101] The URL of the website to be identified is preprocessed and converted into a URL in a set format;

[0102] The specified fields of the URL of the website to be identified are matched against the specified fields of each URL in the specified whitelist and the specified blacklist.

[0103] Here, after obtaining the URL of the website to be identified, the URL is preprocessed. Specifically, the URL is converted into a URL with a predetermined format. The URL with the predetermined format represents a complete URL. A complete URL consists of four parts: protocol, host, port, and path. However, the obtained URL of the website to be identified may only contain the host and port parts. Therefore, it is necessary to preprocess the URL of the website to be identified by converting it into a URL with the predetermined format that includes the protocol, host, port, and path.

[0104] After preprocessing, the specified fields of the URLs of the websites to be identified are matched against the specified fields of each URL in the whitelist and blacklist. The specified fields of the URL represent the domain name portion of the URL.

[0105] Matching based on URLs with a pre-processed format of the websites to be identified can improve the accuracy and efficiency of the matching process.

[0106] In one embodiment, the at least one second feature includes a feature of the logo on the website page to be identified, and the method includes inputting the at least one first feature and the at least one second feature into a set feature fusion network model:

[0107] The features of the logo on the website page to be identified are matched with each logo feature in the set logo feature library to obtain the first matching degree;

[0108] The first matching degree is input into the defined feature fusion network model; wherein...

[0109] The established logo feature library is obtained by extracting features from the logos on the website pages corresponding to each URL in the established whitelist.

[0110] Here, at least one second feature includes features of the logo on the website page to be identified. When at least one first feature and at least one second feature are input into the defined feature fusion network model, the ORB algorithm is used to extract features of the logo on the website page to be identified. The extracted features of the logo on the website page to be identified are then matched with each logo feature in the defined logo feature library to obtain a first matching degree. This first matching degree is then input into the defined feature fusion network model to identify the website based on the features of the logo on the website page to be identified.

[0111] The logo feature library is established by extracting features from the logos on the website pages corresponding to each URL in the whitelist. Specifically, based on the website pages corresponding to each URL in the whitelist, the logo corresponding to each URL is obtained. The ORB algorithm is used to extract features from all the obtained logos, and the established logo feature library is built based on the extracted logo features.

[0112] The first matching degree, obtained by matching the features of the logo on the website page to be identified with each logo feature in the set logo feature library, is input into the set feature fusion network model. This facilitates further identification of whether the website to be identified is a phishing website based on the features of the logo on the website page, thus improving the accuracy of identification.

[0113] Figure 2 A schematic diagram illustrating the implementation flow of the phishing website identification method provided in the application embodiments of this application is shown below. Figure 2 As shown:

[0114] After obtaining the URL of the website to be identified, the URL is first preprocessed to obtain the URL of the website in the specified format.

[0115] The URL of the website to be identified is matched against the specified fields of each URL in the specified whitelist and blacklist. If the specified fields of the URL of the website to be identified match any URL in the specified whitelist or blacklist, the identification result corresponding to the website to be identified is output. If the specified fields of the URL of the website to be identified do not match any URL in the specified whitelist or blacklist, at least one URL-related first feature and at least one page-related second feature of the website to be identified are extracted. The first feature includes at least the character similarity between the URL of the website to be identified and each URL in the specified whitelist, and / or, the feature vector of the URL of the website to be identified, which is determined based on each character in the URL of the website to be identified. The second feature includes at least the features of the logo on the page of the website to be identified, and / or, other webpage features of the page of the website to be identified, such as form features on the page of the website to be identified, the ratio of the number of links of a specified type to the total number of links on the page of the website to be identified, and the number of sensitive keywords on the page of the website to be identified.

[0116] By inputting at least one first feature and at least one second feature of the website to be identified into a set feature fusion network model, the first probability that the website to be identified is a phishing website is obtained.

[0117] If the probability of a given event is greater than a set threshold, the website to be identified is determined to be a phishing website.

[0118] Figure 3 A schematic diagram illustrating the implementation flow of another phishing website identification method provided in this application embodiment is shown below. Figure 3 As shown:

[0119] First, each character in the URL of the website to be identified is converted into a corresponding character vector using a convolutional neural network model. Then, based on the character vectors corresponding to each character, a vector corresponding to the URL is constructed. For example, in the URL of the website to be identified... www.orangeIn the case of .com-abc.cn, each character is converted into a corresponding character vector, and these vectors are used to form the vector corresponding to the URL. This vector is then input into a predefined feature extraction model to extract features from the URL vector, resulting in the output vector of the feature extraction model. The predefined feature extraction model can be a Char-CNN network model. Since the character vectors for each character have high dimensionality, the resulting vector for the URL also has high dimensionality, and consequently, the output vector of the feature extraction model also has high dimensionality. To facilitate subsequent processing, the output vector of the feature extraction model needs to be dimensionality-reduced. Therefore, the output vector of the feature extraction model is input into a predefined pooling layer for dimensionality reduction, obtaining the feature vector of the URL with reduced dimensionality.

[0120] The URL of the website to be identified is www.orange In the case of .com-abc.cn, the character similarity is calculated based on the character length of the URL, the character length of each URL in the whitelist, and the edit distance.

[0121] The features of the logo on the website page to be identified are matched with each logo feature in the set logo feature library to obtain the first matching degree.

[0122] Extract form features, the ratio of the number of backlinks to the total number of links, the ratio of the number of empty links to the total number of links, and the number of sensitive keywords from the website pages to be identified.

[0123] The results obtained from the above four steps are input into the set feature fusion network model to obtain the first probability that the website to be identified is a phishing website. The set feature fusion network model consists of two fully connected layers and one softmax layer.

[0124] If the probability of a given event is greater than a set threshold, the website to be identified is determined to be a phishing website.

[0125] In this embodiment, at least one first feature and at least one second feature of the website to be identified are extracted. The first feature represents a URL-related feature, and the second feature represents a website page-related feature. The at least one first feature and at least one second feature are input into a pre-defined feature fusion network model to obtain a first probability. The first probability represents the probability that the website to be identified is a phishing website. When the first probability is greater than a pre-defined threshold, the website to be identified is determined to be a phishing website. In this way, the website to be identified is evaluated from multiple dimensions based on both URL-related and page-related features. This not only identifies phishing websites with URLs similar to legitimate websites but also those with pages similar to legitimate websites, resulting in a more comprehensive phishing website identification. Furthermore, by simply inputting the extracted relevant features of the website to be identified into a pre-trained feature fusion network model, the first probability that the website to be identified is a phishing website can be obtained. Based on this first probability, the determination of whether the website to be identified is a phishing website is then made, achieving rapid identification of the website to be identified, improving identification efficiency, and making it suitable for large-scale phishing website identification.

[0126] To implement the method of this application embodiment, this application embodiment also provides a phishing website identification device. Figure 4 For a schematic diagram of the phishing website identification device provided in the embodiments of this application, please refer to [link / reference]. Figure 4 The device includes:

[0127] Extraction unit 401 is used to extract at least one first feature and at least one second feature of the website to be identified; the first feature represents a URL-related feature; the second feature represents a website page-related feature;

[0128] Input unit 402 is used to input the at least one first feature and the at least one second feature into a set feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website;

[0129] The determining unit 403 is used to determine that the website to be identified is a phishing website when the first probability is greater than a set threshold.

[0130] In one embodiment, the extraction unit 401 is further configured to match the set field portion of the URL of the website to be identified with the set field portion of each URL in the set whitelist and the set blacklist respectively to obtain a matching result;

[0131] If the matching result indicates that the set field portion of the URL of the website to be identified does not match the set field portion of each URL in the set whitelist or set blacklist, at least one first feature and at least one second feature of the website to be identified are extracted.

[0132] In one embodiment, the apparatus further includes: a matching unit, configured to preprocess the URL of the website to be identified and convert the URL into a URL of a set format;

[0133] The specified fields of the URL of the website to be identified are matched against the specified fields of each URL in the specified whitelist and the specified blacklist.

[0134] In one embodiment, the apparatus further includes an output unit, configured to output an identification result corresponding to the website to be identified when the matching result indicates that a set field portion of the URL of the website to be identified matches a set field portion of any URL in the set whitelist or the set blacklist.

[0135] In one embodiment, the at least one first feature includes at least one of the following:

[0136] The character similarity between the URL of the website to be identified and each URL in the set whitelist;

[0137] The feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified.

[0138] In one embodiment, the apparatus further includes: a computing unit, and / or a dimensionality reduction processing unit, wherein,

[0139] The calculation unit is used to calculate the character similarity between the URL of the website to be identified and each URL in the set whitelist based on the character length of the URL of the website to be identified, the character length of each URL in the set whitelist, and the edit distance.

[0140] The dimensionality reduction processing unit is used to input the character vector corresponding to each character in the URL of the website to be identified into a set feature extraction model, obtain the vector output by the set feature extraction model, and input the vector output by the set feature extraction model into a set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL of the website to be identified.

[0141] In one embodiment, the at least one second feature includes at least one of the following:

[0142] The characteristics of the logo in the website page to be identified;

[0143] The form features in the website page to be identified;

[0144] The ratio of the number of links of a specified type in the website page to be identified to the total number of links;

[0145] The number of sensitive keywords in the website pages to be identified.

[0146] In one embodiment, the at least one second feature includes the feature of the logo in the website page to be identified, and the input unit 402 is further configured to match the feature of the logo in the website page to be identified with each logo feature in a set logo feature library to obtain a first matching degree;

[0147] The first matching degree is input into the defined feature fusion network model; wherein...

[0148] The established logo feature library is obtained by extracting features from the logos on the website pages corresponding to each URL in the established whitelist.

[0149] In practical applications, the extraction unit 401, the input unit 402, the determination unit 403, the matching unit, the output unit, the calculation unit, and the dimensionality reduction processing unit can be implemented by a processor in the terminal, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU), or a field-programmable gate array (FPGA).

[0150] It should be noted that the phishing website identification device provided in the above embodiments is only illustrated by the division of the above program modules when displaying information. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the phishing website identification device and the phishing website identification method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0151] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 5 This is a schematic diagram of the hardware composition structure of the electronic device provided in the embodiments of this application, such as... Figure 5 As shown, the electronic device includes:

[0152] The communication interface 501 enables information exchange with other devices, such as network devices.

[0153] The processor 502 is connected to the communication interface 501 to enable information interaction with other devices and, when running a computer program, executes the methods provided by one or more of the aforementioned terminal-side technical solutions. The computer program is stored in the memory 503.

[0154] Specifically, the processor 502 is configured to extract at least one first feature and at least one second feature of the website to be identified; the first feature represents a URL-related feature; and the second feature represents a website page-related feature.

[0155] The at least one first feature and the at least one second feature are input into a set feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website;

[0156] When the first probability is greater than a set threshold, the website to be identified is determined to be a phishing website.

[0157] In one embodiment, the processor 502 is further configured to match the set field portion of the URL of the website to be identified with the set field portion of each URL in the set whitelist and the set blacklist respectively, to obtain a matching result;

[0158] If the matching result indicates that the set field portion of the URL of the website to be identified does not match the set field portion of each URL in the set whitelist or set blacklist, at least one first feature and at least one second feature of the website to be identified are extracted.

[0159] In one embodiment, the processor 502 is further configured to preprocess the URL of the website to be identified, converting the URL into a URL of a set format;

[0160] The specified fields of the URL of the website to be identified are matched against the specified fields of each URL in the specified whitelist and the specified blacklist.

[0161] In one embodiment, the processor 502 is further configured to output the identification result corresponding to the website to be identified when the matching result indicates that the set field portion of the URL of the website to be identified matches the set field portion of any URL in the set whitelist or the set blacklist.

[0162] In one embodiment, the at least one first feature includes at least one of the following:

[0163] The character similarity between the URL of the website to be identified and each URL in the set whitelist;

[0164] The feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified.

[0165] In one embodiment, the processor 502 is further configured to calculate the character similarity between the URL of the website to be identified and each URL in the whitelist based on the character length of the URL of the website to be identified, the character length of each URL in the whitelist, and the edit distance; and / or,

[0166] The character vector corresponding to each character in the URL of the website to be identified is input into a set feature extraction model to obtain the vector output by the set feature extraction model. The vector output by the set feature extraction model is then input into a set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL of the website to be identified.

[0167] In one embodiment, the at least one second feature includes at least one of the following:

[0168] The characteristics of the logo in the website page to be identified;

[0169] The form features in the website page to be identified;

[0170] The ratio of the number of links of a specified type in the website page to be identified to the total number of links;

[0171] The number of sensitive keywords in the website pages to be identified.

[0172] In one embodiment, the at least one second feature includes the feature of the logo in the website page to be identified, and the processor 502 is further configured to match the feature of the logo in the website page to be identified with each logo feature in a set logo feature library to obtain a first matching degree;

[0173] The first matching degree is input into the defined feature fusion network model; wherein...

[0174] The established logo feature library is obtained by extracting features from the logos on the website pages corresponding to each URL in the established whitelist.

[0175] Of course, in practical applications, the various components in an electronic device are coupled together through a bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 5 The general designated all buses as Bus System 504.

[0176] The memory 503 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0177] It is understood that memory 503 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 503 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0178] The methods disclosed in the embodiments of this application can be applied to or implemented by the processor 502. The processor 502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 502 or by instructions in the form of software. The processor 502 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 502 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the memory 503. The processor 502 reads the program in the memory 503 and combines it with its hardware to complete the steps of the aforementioned method.

[0179] When processor 502 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application.

[0180] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 503 storing a computer program, which can be executed by a processor 502 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed apparatus, terminal, and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0182] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0184] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0185] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0186] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying phishing websites, characterized in that, The method includes: Extract at least one first feature and at least one second feature from the website to be identified; the first feature represents features related to the Uniform Resource Locator (URL); the second feature represents features related to the website page; the at least one first feature includes the character similarity between the URL of the website to be identified and each URL in a predefined whitelist, and a feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified and has deep semantic information about the URL of the website to be identified; the character similarity between the URL of the website to be identified and each URL in the predefined whitelist is calculated based on the ratio of a first value and a second value corresponding to the corresponding URL in the predefined whitelist, where the first value is the first value corresponding to the first character of the URL in the predefined whitelist. The difference between the third and fourth values, wherein the third value is the maximum of the length of the corresponding URL and the length of the URL of the website to be identified, the fourth value is the edit distance between the corresponding URL and the URL of the website to be identified, and the second value is the minimum of the length of the corresponding URL and the length of the URL of the website to be identified; the at least one second feature includes at least one of the following: a first matching degree, form features in the page to be identified, the ratio of the number of links of a set type in the page to the total number of links, and the number of sensitive keywords in the page to be identified; the first matching degree indicates the matching degree between the features of the logo in the page to be identified and each logo feature in the set logo feature library; The at least one first feature and the at least one second feature are input into a set feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website; When the first probability is greater than a set threshold, the website to be identified is determined to be a phishing website.

2. The phishing website identification method according to claim 1, characterized in that, The extraction of at least one first feature and at least one second feature of the website to be identified includes: The URL of the website to be identified is matched against the set field portion of each URL in the set whitelist and set blacklist to obtain the matching result; If the matching result indicates that the set field portion of the URL of the website to be identified does not match the set field portion of each URL in the set whitelist or set blacklist, at least one first feature and at least one second feature of the website to be identified are extracted.

3. The method for identifying phishing websites according to claim 2, characterized in that, The step of matching the set field portion of the URL of the website to be identified with the set field portion of each URL in the set whitelist and the set blacklist includes: The URL of the website to be identified is preprocessed and converted into a URL in a set format; The specified fields of the URL of the website to be identified are matched against the specified fields of each URL in the specified whitelist and the specified blacklist.

4. The method for identifying phishing websites according to claim 2 or 3, characterized in that, The method further includes: If the matching result indicates that the set field of the URL of the website to be identified matches the set field of any URL in the set whitelist or set blacklist, the identification result corresponding to the website to be identified is output.

5. The method for identifying phishing websites according to claim 1, characterized in that, The method further includes: Based on the character length of the URL of the website to be identified, the character length of each URL in the whitelist, and the edit distance, the character similarity between the URL of the website to be identified and each URL in the whitelist is calculated; and / or, The character vector corresponding to each character in the URL of the website to be identified is input into a set feature extraction model to obtain the vector output by the set feature extraction model. The vector output by the set feature extraction model is then input into a set pooling layer for dimensionality reduction processing to obtain the feature vector of the URL of the website to be identified.

6. The phishing website identification method according to claim 1, characterized in that, The at least one second feature includes features of the logo on the website page to be identified. When inputting the at least one first feature and the at least one second feature into a predefined feature fusion network model, the method includes: The features of the logo on the website page to be identified are matched with each logo feature in the set logo feature library to obtain the first matching degree; The first matching degree is input into the defined feature fusion network model; wherein... The established logo feature library is obtained by extracting features from the logos on the website pages corresponding to each URL in the established whitelist.

7. A phishing website identification device, characterized in that, The device includes: An extraction unit is configured to extract at least one first feature and at least one second feature of a website to be identified; the first feature represents URL-related features; the second feature represents website page-related features; the at least one first feature includes the character similarity between the URL of the website to be identified and each URL in a predefined whitelist, and a feature vector of the URL of the website to be identified; the feature vector is determined based on each character in the URL of the website to be identified and has deep semantic information about the URL of the website to be identified; the character similarity between the URL of the website to be identified and each URL in the predefined whitelist is calculated based on the ratio of a first value and a second value corresponding to the corresponding URL in the predefined whitelist, where the first value is the first value corresponding to the first URL. The difference between the third and fourth values, wherein the third value is the maximum of the length of the corresponding URL and the length of the URL of the website to be identified, the fourth value is the edit distance between the corresponding URL and the URL of the website to be identified, and the second value is the minimum of the length of the corresponding URL and the length of the URL of the website to be identified; the at least one second feature includes at least one of the following: a first matching degree, form features in the page to be identified, the ratio of the number of links of a set type in the page to the total number of links, and the number of sensitive keywords in the page to be identified; the first matching degree indicates the matching degree between the features of the logo in the page to be identified and each logo feature in the set logo feature library; An input unit is configured to input the at least one first feature and the at least one second feature into a predefined feature fusion network model to obtain a first probability; the first probability represents the probability that the website to be identified is a phishing website; The determining unit is used to determine that the website to be identified is a phishing website when the first probability is greater than a set threshold.

8. An electronic device, characterized in that, include: A processor and memory for storing computer programs that can run on the processor, wherein, When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1-6.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

Images