A phishing website detection method, system, device and medium

Abstract

The present invention discloses a phishing website detection method, system, device, and medium, relating to the field of computer network security. The method comprises: based on a pre-stored whitelist of websites, measuring and weighting the character positions and similarities of the target website's uniform resource locator string, obtaining a position similarity weight and a visual similarity weight for each character; based on a pre-stored whitelist of websites, classifying and weighting the string operations of the target website's uniform resource locator, obtaining an operation similarity weight; converting the uniform resource locators of the whitelist and target websites into binary images, obtaining a whitelist binary image and a target binary image, and converting the binary images into one-dimensional vectors; calculating the visual distance between the two vectors; and determining whether the target website is a phishing website based on the weight and the visual distance. The present invention can detect phishing websites in real time, accurately, and stably.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a phishing website detection method, system, device and medium. Background Art

[0002] With the rapid development of Internet technology, network security issues are emerging one after another. Illegal websites are a typical example of online fraud, including phishing, pornographic gambling, and malware distribution. Among them, phishing websites use the Internet as a carrier to deceive users by disguising themselves as reputable and legitimate websites to obtain their sensitive information. The deceived users will suffer varying degrees of personal information leakage, which will lead to economic losses. How to quickly and accurately detect the Uniform Resource Locator (URL) of phishing websites is a hot topic in network security research. Currently, existing phishing website detection technologies mainly include:

[0003] (1) Detection technology based on blacklist and whitelist mechanism: As a practical core technology, blacklist and whitelist have the advantages of high efficiency and accuracy. By determining the domain name, phishing websites can be quickly located, which is one of the most commonly used implementation technologies.

[0004] (2) Bayesian algorithm-based detection technology: Jin Qing et al. developed a series of rules for matching phishing websites based on the Bayesian algorithm. They then assigned a corresponding weight to each rule, calculated its correction coefficient, and obtained the probability that the tested website is a phishing website. They then used the probability threshold to determine whether it is a phishing website.

[0005] (3) Document structure-based detection technology: Guo Minzhe et al. analyzed web page document objects and extracted sensitive phishing information features commonly used by phishers from the text object model to determine whether the website is a phishing website. This algorithm effectively filters out phishing pages from websites, effectively preventing malicious phishing attacks by phishers.

[0006] (4) Phishing website detection technology based on deep learning: Xu Longyu combined deep learning technology to propose a multi-layer DBN-KNN model, which was applied to the feature recognition of phishing websites to identify phishing websites.

[0007] Among the existing phishing website detection technologies mentioned above, those based on blacklists and whitelists are not only inefficient, but also have limited list coverage and low accuracy. Bayesian algorithms lack stability and generalization performance. Document-based detection suffers from incomplete feature coverage, high underreporting, and poor accuracy. Deep learning-based phishing website detection technologies offer advantages in feature recognition, but their features are less stable and susceptible to sample contamination. Therefore, achieving real-time, accurate, and stable phishing website detection has become a pressing issue. Summary of the Invention

[0008] Based on this, embodiments of the present invention provide a phishing website detection method, system, device, and medium to achieve real-time, accurate, and stable detection of phishing websites.

[0009] To achieve the above objectives, the embodiments of the present invention provide the following solutions:

[0010] A phishing website detection method, comprising:

[0011] Based on pre-stored whitelist websites, the character positions of the target website's uniform resource locator string are measured and weighted to obtain position similarity weights of each character in the target website's uniform resource locator string; wherein the position similarity weight of the difference character at the domain name position is greater than the similarity weight of the difference character at the path position; the difference character is a character at the same character position that differs between the target website and the whitelist website;

[0012] Based on the pre-stored whitelist websites, the similarity of the target website's uniform resource locator string is measured and weighted to obtain the visual similarity weight of each character in the target website's uniform resource locator string; wherein, for characters in the same character position on the target website and the whitelist website, the greater the degree of visual error, the greater the visual similarity weight;

[0013] Based on the pre-stored whitelist websites, the string operations of the target website's uniform resource locator are classified and weighted to obtain the operation similarity weights of the target website's uniform resource locator string; wherein different string operations correspond to different operation similarity weights;

[0014] Convert the uniform resource locator of the whitelist website into a binary image to obtain a whitelist binary image; convert the uniform resource locator of the target website into a binary image to obtain a target binary image;

[0015] Converting the whitelist binary image into a one-dimensional vector to obtain a whitelist vector, and converting the target binary image into a one-dimensional vector to obtain a target vector;

[0016] Calculating the visual distance between the target vector and the whitelist vector;

[0017] It is determined whether the target website is a phishing website according to the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance.

[0018] Optionally, the calculation formula for the visual distance is:

[0019]

[0020] Among them, M(v,u) represents the visual distance between the target vector and the whitelist vector; v represents the target vector; u represents the whitelist vector.

[0021] Optionally, determining whether the target website is a phishing website according to the location similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance specifically includes:

[0022] Determining whether the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance are within corresponding threshold ranges;

[0023] If so, it is determined that the target website is a phishing website; otherwise, the target website is a normal website.

[0024] Optionally, the string operation includes: inserting characters and deleting characters.

[0025] Optionally, pixels of the whitelist binary image and the target binary image are both 16*16 or 32*32.

[0026] The present invention also provides a phishing website detection system, comprising:

[0027] String visual feature measurer for:

[0028] Based on pre-stored whitelist websites, the character positions of the target website's uniform resource locator string are measured and weighted to obtain position similarity weights of each character in the target website's uniform resource locator string; wherein the position similarity weight of the difference character at the domain name position is greater than the similarity weight of the difference character at the path position; the difference character is a character at the same character position that differs between the target website and the whitelist website;

[0029] Based on the pre-stored whitelist websites, the similarity of the target website's uniform resource locator string is measured and weighted to obtain the visual similarity weight of each character in the target website's uniform resource locator string; wherein, for characters in the same character position on the target website and the whitelist website, the greater the degree of visual error, the greater the visual similarity weight;

[0030] Based on the pre-stored whitelist websites, the string operations of the target website's uniform resource locator are classified and weighted to obtain the operation similarity weights of the target website's uniform resource locator string; wherein different string operations correspond to different operation similarity weights;

[0031] Character similarity distance measurer, used for:

[0032] Convert the uniform resource locator of the whitelist website into a binary image to obtain a whitelist binary image; convert the uniform resource locator of the target website into a binary image to obtain a target binary image;

[0033] Converting the whitelist binary image into a one-dimensional vector to obtain a whitelist vector, and converting the target binary image into a one-dimensional vector to obtain a target vector;

[0034] Calculating the visual distance between the target vector and the whitelist vector;

[0035] Phishing detector for:

[0036] It is determined whether the target website is a phishing website according to the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance.

[0037] The present invention also provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned phishing website detection method.

[0038] The present invention also provides a computer-readable storage medium storing a computer program, which implements the above-mentioned phishing website detection method when executed by a processor.

[0039] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0040] The present invention provides a phishing website detection method, system, device, and medium. These methods detect phishing website Uniform Resource Locators (URLs) based on visual features, enabling real-time detection of phishing websites with high accuracy, recall, and robustness. These methods can be applied to online engineering systems, offering high availability and stability. Therefore, the present invention enables real-time, accurate, and stable detection of phishing websites. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A flowchart of a phishing website detection method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of converting characters into black and white binary images;

[0044] Figure 3 A structural diagram of a phishing website detection system provided by an embodiment of the present invention;

[0045] Figure 4 A deployment diagram of a phishing website detection system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0048] Example 1

[0049] See also Figure 1 The phishing website detection method of this embodiment includes:

[0050] Step 101: Based on pre-stored whitelist websites, character positions of the target website's uniform resource locator string are measured and weighted to obtain position similarity weights of each character in the target website's uniform resource locator string.

[0051] Among them, the position similarity weight of the difference characters at the domain name position is greater than the similarity weight of the difference characters at the path position; the difference characters are characters that are different between the target website and the whitelist website at the same character position.

[0052] Step 102: Based on the pre-stored whitelist websites, measure and weight the similarity of the character string of the uniform resource locator of the target website to obtain the visual similarity weight of each character in the character string of the uniform resource locator of the target website.

[0053] Among them, for characters in the same character position in the target website and the whitelist website, the character with a greater degree of visual error has a greater visual similarity weight.

[0054] Step 103: Based on the pre-stored whitelist websites, classify and weight the string operations of the target website's uniform resource locator to obtain the operation similarity weight of the target website's uniform resource locator string.

[0055] Different string operations correspond to different operation similarity weights. The string operations include: inserting characters and deleting characters.

[0056] Step 104: convert the uniform resource locator of the whitelist website into a binary image to obtain the whitelist binary image; convert the uniform resource locator of the target website into a binary image to obtain the target binary image.

[0057] The pixels of the whitelist binary image and the target binary image are both 16*16 or 32*32.

[0058] Step 105: Convert the whitelist binary image into a one-dimensional vector to obtain a whitelist vector, and convert the target binary image into a one-dimensional vector to obtain a target vector.

[0059] Step 106: Calculate the visual distance between the target vector and the whitelist vector. The calculation formula of the visual distance is:

[0060]

[0061] Where M(v,u) represents the visual distance between the target vector and the whitelist vector; v represents the target vector; and u represents the whitelist vector. The more similar the two vectors are, the closer the visual distance is to 0.

[0062] Step 107: Determine whether the target website is a phishing website based on the location similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance. Specifically:

[0063] It is determined whether the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance are within corresponding threshold ranges.

[0064] If so, it is determined that the target website is a phishing website; otherwise, the target website is a normal website.

[0065] The phishing website detection method of this embodiment is a phishing website URL detection method based on visual features. It can perform real-time detection of phishing website URLs with high accuracy, recall rate, and robustness; it can handle high-performance real-time detection of massive URLs; it can be used in online engineering systems with high availability and stability.

[0066] In actual application, a specific implementation process of the phishing website detection method of the above embodiment is as follows.

[0067] (1) Measure the character positions and weight the characters in the URL of the target website. Considering the distance between character strings from the perspective of human vision, the character positions in the URL have different weights in the domain name position and the path position. Different character positions have different effects on human vision, so different weights should be assigned to characters in different positions. For example, the difference between b and d in "icbc.com.cn" and "icdc.com.cn" is in the domain name, so the weight of similarity should be different from the weight of t and c in "icbc.com.cn / regedit.asp" and "icbc.com.cn / regedic.asp".

[0068] (2) Measure and weight the string similarity of the target website's URL. Based on the traditional character edit distance, different weights are assigned to different characters according to the human visual error similarity. For example, the visual effect between the lowercase letter "l" and the number 1 is basically the same.

[0069] (3) Classify and weight the string operations in the target website's URL. Different weights should be assigned to combinations of preceding and following words that insert or delete certain characters. For example, deleting the character "i" between "china.net" and "chna.net" will have a lower degree of differentiation between the two domain names than deleting the character "o" between "microsoft.com" and "micrsoft.com."

[0070] (4) Convert the URL characters of the target website and the whitelist website into black and white binary images to obtain the target binary image and the whitelist binary image. The pixels of the target binary image and the whitelist binary image are 16*16 or 32*32. The binary image is a 0-1 matrix. Figure 2A black and white binary image corresponding to the number 0 is shown.

[0071] (5) Convert both the target binary image and the whitelist binary image into one-dimensional vectors, and obtain the target vector v = [0, 0, ..., 0, 1, 1, ..., 0, 0] and the whitelist vector u = [0, 0, ..., 1, 1, 1, ..., 0, 0].

[0072] (6) Calculate the direct visual distance between the two vectors. The visual distance between the target vector v and the whitelist vector u is defined as:

[0073]

[0074] Determine whether the target website is a phishing website based on the visual distance M(v,u).

[0075] Example 2

[0076] In order to execute the method corresponding to the above-mentioned embodiment 1 and achieve corresponding functions and technical effects, a phishing website detection system is provided below.

[0077] See also Figure 3 The system includes: a character string visual feature measurer 301, a character similarity distance measurer 302 and a phishing website detector 303.

[0078] The character string visual feature measurer 301 is used to:

[0079] Based on the pre-stored whitelist websites, the character positions of the target website's uniform resource locator string are measured and weighted to obtain the position similarity weight of each character in the target website's uniform resource locator string; wherein the position similarity weight of the difference character at the domain name position is greater than the similarity weight of the difference character at the path position; the difference character is a character at the same character position where there is a difference between the target website and the whitelist website.

[0080] Based on the pre-stored whitelist websites, the similarity of the character string of the uniform resource locator of the target website is measured and weighted, and the visual similarity weight of each character in the uniform resource locator string of the target website is obtained; among which, for the characters in the same character position in the target website and the whitelist website, the characters with greater visual error have greater visual similarity weight.

[0081] Based on the pre-stored whitelist websites, the string operations of the target website's uniform resource locator are classified and weighted to obtain the operation similarity weights of the target website's uniform resource locator string; different string operations correspond to different operation similarity weights.

[0082] The character similarity distance measurer 302 is used to:

[0083] The uniform resource locator of the whitelist website is converted into a binary image to obtain a whitelist binary image; the uniform resource locator of the target website is converted into a binary image to obtain a target binary image.

[0084] The whitelist binary image is converted into a one-dimensional vector to obtain a whitelist vector, and the target binary image is converted into a one-dimensional vector to obtain a target vector.

[0085] Calculate the visual distance between the target vector and the whitelist vector.

[0086] Phishing website detector 303, used to:

[0087] It is determined whether the target website is a phishing website according to the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance.

[0088] Example 3

[0089] This embodiment is to implement the deployment of the phishing website detection system of the above embodiment 2, and the deployment diagram is as follows: Figure 4 See Figure 4 The URL character information preprocessing server 401 completes the preprocessing of the URL information and provides an input data source for visual feature acquisition. The visual feature acquisition server 402 mainly obtains relevant distance values ​​such as position similarity, visual similarity, and operation similarity. The string violation URL server 403 includes a string visual feature measurer 301, a character similarity distance measurer 302, and a phishing website detector 303 to detect the target website. The networking switch 404 is used to realize the network connection between the URL character information preprocessing server 401, the visual feature acquisition server 402, and the string violation URL server 403.

[0090] Based on the above deployment, each part of the phishing website detection system can achieve the following functions.

[0091] (1) String Visual Feature Meter 301: Considers the distance between strings from the perspective of human vision. Its main functions include: 1) Character position in the URL. Characters in different URL positions are assigned different weights, such as different values ​​in the domain name and path. 2) Character similarity. This is divided into similarity distance measurements between single characters and combined characters with morpheme fragments. 3) Character insertion and deletion. When calculating the edit distance of a string, the changed characters are weighted according to different operations.

[0092] (2) Character Similarity Distance Measuring Module 302: Its main functions include: 1) converting characters into black and white binary images; 2) converting the black and white binary images into one-dimensional vectors; and 3) calculating the visual distance between the two vectors. The conversion of the black and white binary images involves converting the characters into 32*32 pixel black and white binary images and then converting the black and white binary images into 1*1024 pixel one-dimensional vectors. The visual distance between the two vectors can be calculated using the formula for calculating the visual distance in Example 1, which will not be further described here.

[0093] (3) Phishing website detector 303: vectorize the input URL string, calculate the visual distance between the vectorized vector and the whitelist website URL string, and the website corresponding to the URL with a visual distance within the threshold range is the phishing website URL. The detection judgment log is output to the relevant business system through the API interface.

[0094] Example 4

[0095] This embodiment provides an electronic device, including a memory and a processor. The memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the phishing website detection method of the first embodiment.

[0096] Optionally, the above-mentioned electronic device may be a server.

[0097] In addition, an embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the phishing website detection method of embodiment 1 when executed by a processor.

[0098] All the above embodiments have the following advantages:

[0099] (1) A lightweight detection strategy based only on URL strings is used to detect phishing websites, which reduces computing and storage overhead and is suitable for detection scenarios in large-scale URL application environments.

[0100] (2) A method for calculating URL visual similarity is proposed. On the one hand, a detection model for illegal URL websites is constructed by combining URL visual similarity to solve the false positive problem caused by traditional edit distance in illegal URL website detection; on the other hand, detecting illegal URLs from a visual perspective can effectively deal with the situation of URL visual imitation.

[0101] (3) A large number of experiments were conducted on real datasets to verify the detection effect.

[0102] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0103] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. A method for detecting phishing websites, characterized in that: include: Based on pre-stored whitelist websites, the character positions of the target website's uniform resource locator string are measured and weighted to obtain position similarity weights of each character in the target website's uniform resource locator string; wherein the position similarity weight of the difference character at the domain name position is greater than the similarity weight of the difference character at the path position; the difference character is a character at the same character position that differs between the target website and the whitelist website; Based on the pre-stored whitelist websites, the similarity of the target website's uniform resource locator string is measured and weighted to obtain the visual similarity weight of each character in the target website's uniform resource locator string; wherein, for characters in the same character position on the target website and the whitelist website, the greater the degree of visual error, the greater the visual similarity weight; Based on the pre-stored whitelist websites, the string operations of the target website's uniform resource locator are classified and weighted to obtain the operation similarity weights of the target website's uniform resource locator string; wherein different string operations correspond to different operation similarity weights; Convert the uniform resource locator of the whitelist website into a binary image to obtain a whitelist binary image; convert the uniform resource locator of the target website into a binary image to obtain a target binary image; Converting the whitelist binary image into a one-dimensional vector to obtain a whitelist vector, and converting the target binary image into a one-dimensional vector to obtain a target vector; Calculating the visual distance between the target vector and the whitelist vector; It is determined whether the target website is a phishing website according to the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance.

2. A phishing website detection method according to claim 1, characterized in that: The calculation formula of the visual distance is: Among them, M(v,u) represents the visual distance between the target vector and the whitelist vector; v represents the target vector; u represents the whitelist vector.

3. A phishing website detection method according to claim 1, characterized in that: Determining whether the target website is a phishing website according to the location similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance specifically includes: Determining whether the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance are within corresponding threshold ranges; If so, it is determined that the target website is a phishing website; otherwise, the target website is a normal website.

4. A phishing website detection method according to claim 1, characterized in that: The string operation includes: inserting characters and deleting characters.

5. A phishing website detection method according to claim 1, characterized in that: The pixels of the whitelist binary image and the target binary image are both 16*16 or 32*32.

6. A phishing website detection system, characterized in that: include: String visual feature measurer for: Based on pre-stored whitelist websites, the character positions of the target website's uniform resource locator string are measured and weighted to obtain position similarity weights of each character in the target website's uniform resource locator string; wherein the position similarity weight of the difference character at the domain name position is greater than the similarity weight of the difference character at the path position; the difference character is a character at the same character position that differs between the target website and the whitelist website; Based on the pre-stored whitelist websites, the similarity of the target website's uniform resource locator string is measured and weighted to obtain the visual similarity weight of each character in the target website's uniform resource locator string; wherein, for characters in the same character position on the target website and the whitelist website, the greater the degree of visual error, the greater the visual similarity weight; Based on the pre-stored whitelist websites, the string operations of the target website's uniform resource locator are classified and weighted to obtain the operation similarity weights of the target website's uniform resource locator string; wherein different string operations correspond to different operation similarity weights; Character similarity distance measurer, used for: Convert the uniform resource locator of the whitelist website into a binary image to obtain a whitelist binary image; convert the uniform resource locator of the target website into a binary image to obtain a target binary image; Converting the whitelist binary image into a one-dimensional vector to obtain a whitelist vector, and converting the target binary image into a one-dimensional vector to obtain a target vector; Calculating the visual distance between the target vector and the whitelist vector; Phishing detector for: It is determined whether the target website is a phishing website according to the position similarity weight, the visual similarity weight, the operation similarity weight, and the visual distance.

7. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the phishing website detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that It stores a computer program, which, when executed by a processor, implements the phishing website detection method according to any one of claims 1 to 5.

Images