Phishing website detection model training method, phishing website detection method and device

Abstract

The application provides a phishing website detection model training method, a phishing website detection method and device. The method comprises the following steps: extracting a plurality of hyperlinks corresponding to each website data in a historical website data set to form a corresponding hyperlink set; constructing a corresponding directed structure graph according to each hyperlink set, and extracting the features corresponding to each hyperlink in each hyperlink set as the node features of each directed structure graph; calculating each directed structure graph by using a graph convolution layer and a graph pooling layer to obtain a corresponding website type prediction label; and training a preset graph classification model according to the historical website data set and the corresponding website type label to obtain a corresponding phishing website detection model. The application can accurately and effectively detect phishing websites.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a method for training a phishing website detection model, a phishing website detection method, and an apparatus. Background Technology

[0002] Phishing attacks take many forms and typically involve various communication methods, such as email, instant messaging, and social media. Regardless of the communication method used, the most prevalent type of phishing attack is the phishing website attack, which involves using phishing websites to steal sensitive information from victims, such as account details, passwords, and credit card information. Therefore, efficient and reliable phishing website detection is the foundation of phishing threat intelligence. Currently, artificial intelligence methods are being used to analyze websites to determine whether they are phishing sites.

[0003] Existing phishing website identification technologies include: search systems, phishing clue-based methods, and depth representation-based methods.

[0004] The search system primarily maintains a blacklist or whitelist of website URLs to determine website legitimacy. However, in this method, the whitelist may generate false positives due to outdated or incomplete information. The blacklist is insensitive to zero-day phishing websites. Phishing clue-based methods extract phishing clues from phishing websites and use classification techniques to detect them. This method typically requires feature engineering to manually extract phishing clues, allowing attackers to modify and construct phishing websites based on these clues to evade detection. Deep representation-based methods use deep learning models (such as CNN and LSTM) to learn website representations that automatically capture phishing clues from website content to aid detection. This method typically learns representations from website content information, while hyperlinks and their interrelationships are often overlooked and not fully and appropriately utilized. Summary of the Invention

[0005] In view of this, embodiments of this application provide a phishing website detection model training method, a phishing website detection method and apparatus, to eliminate or improve one or more defects existing in the prior art.

[0006] The first aspect of this application provides a method for training a phishing website detection model, the method comprising: Some embodiments of this application include: Extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data; Construct a corresponding directed structure graph based on each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as the node features of each set of directed structure graphs. Graph convolutional layers and graph pooling layers are used to calculate the predicted website type tags for each of the directed structural graphs. The preset graph classification model based on graph neural networks is trained using the historical website dataset and their corresponding website type labels to obtain the corresponding phishing website detection model.

[0007] In some embodiments of this application, the hyperlink set includes: the hyperlink corresponding to the website data and a plurality of multi-level hyperlinks extracted from the hyperlink.

[0008] In some embodiments of this application, the step of constructing corresponding directed structure graphs based on each of the hyperlink sets includes: Each set of hyperlinks is used as a node in the corresponding directed structure graph, and multiple edges between the nodes are determined according to the access relationship between the nodes, so as to obtain the directed structure graph corresponding to each set of hyperlinks.

[0009] In some embodiments of this application, the step of using graph convolutional layers and graph pooling layers to calculate the corresponding website type prediction tags for each of the directed structural graphs includes: Each of the directed structure graphs is sequentially input into three convolutional layers to obtain the first feature, second feature, and third feature corresponding to each of the directed structure graphs. The first, second and third features corresponding to each of the directed structure graphs are concatenated to obtain the corresponding pooling layer features. The features of each pooling layer are input into the graph pooling layer, and the directed structure graphs are updated according to the forward propagation formula of the pooling layer to obtain the new directed structure graphs and new node features corresponding to each directed structure graph. The readout layer reduces the dimensionality of each new directed structure graph and calculates the corresponding global pooling graph using the readout layer formula. The website type prediction tag for each of the directed structure graphs is calculated based on the fully connected layer formula for each of the global pooling graphs.

[0010] In some embodiments of this application, the step of sequentially inputting each of the directed structure graphs into three convolutional layers to obtain multiple first features, second features, and third features corresponding to each of the directed structure graphs includes: Each of the directed structure graphs is input into the first convolutional layer, and each of the first features is obtained by calculation according to the forward propagation formula of the convolutional layer. Each of the first features is input into the second convolutional layer and calculated according to the forward propagation formula of the convolutional layer to obtain each of the second features; Each of the second features is input into the third convolutional layer and calculated according to the forward propagation formula of the convolutional layer to obtain each of the third features.

[0011] In some embodiments of this application, the step of training a preset graph classification model based on a graph neural network according to the historical website dataset and their respective corresponding website type labels to obtain a corresponding phishing website detection model includes: The graph classification model based on the graph neural network is trained according to the historical website dataset and the corresponding website type labels. During the training process, the loss value of each website type is calculated based on the predicted label and the corresponding website type label according to the preset loss function. The graph classification model is then iteratively trained based on the loss value to generate a phishing website detection model for phishing website detection.

[0012] A second aspect of this application provides a method for detecting phishing websites, the method comprising: Obtain hyperlinks from the target website; The hyperlink of the target website is input into a phishing website detection model pre-trained based on the phishing website detection model training method according to any one of claims 1-6, so that the phishing website detection model outputs the target category of the website.

[0013] A third aspect of this application provides a training apparatus for a phishing website detection model based on hyperlinks, the apparatus comprising: The hyperlink extraction module is used to extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data. A directed structure graph construction module is used to construct a corresponding directed structure graph based on each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as node features of each set of directed structure graphs. The website type prediction tag calculation module is used to calculate the corresponding website type prediction tags by using graph convolutional layers and graph pooling layers on each of the directed structure graphs. The model training module is used to train a preset graph classification model based on a graph neural network according to the historical website dataset and their respective website type labels, so as to obtain the corresponding phishing website detection model.

[0014] A fourth aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the phishing website detection model training method described in the first aspect, or implements the phishing website detection method described in the second aspect.

[0015] A fifth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the phishing website detection model training method described in the first aspect above, or implements the phishing website detection method described in the second aspect above.

[0016] This application provides a method for training a phishing website detection model, a phishing website detection method, and an apparatus. The method includes: extracting multiple hyperlinks corresponding to each website in a pre-acquired historical website dataset to form corresponding hyperlink sets; constructing corresponding directed structure graphs based on each hyperlink set, and extracting features corresponding to each hyperlink in each hyperlink set as node features of each directed structure graph; using graph convolutional layers and graph pooling layers to calculate the corresponding website type prediction labels for each directed structure graph; and training a pre-set graph classification model based on the historical website dataset and the corresponding website type labels to obtain the corresponding phishing website detection model. This application can accurately and effectively detect phishing websites.

[0017] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0018] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings: Figure 1 This is a flowchart illustrating the phishing website detection model training method in one embodiment of this application.

[0020] Figure 2 This is a flowchart illustrating a phishing website monitoring method in another embodiment of this application.

[0021] Figure 3 This is a schematic diagram of the structure of a phishing website detection model training device in another embodiment of this application.

[0022] Figure 4(a) is a schematic diagram of the first example of the hyperlink structure graph construction rule in another embodiment of this application.

[0023] Figure 4(b) is a schematic diagram of a second example of the hyperlink structure graph construction rule in another embodiment of this application.

[0024] Figure 4(c) is a schematic diagram of the third example of the hyperlink structure graph construction rule in another embodiment of this application.

[0025] Figure 5 This is a structural diagram of a graph classification model in another embodiment of this application.

[0026] Figure 6 This is a schematic diagram of the hyperlink judgment formula value in another embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0028] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the scheme according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0029] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0030] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0031] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0032] The following examples will provide a detailed description.

[0033] This application provides a method for training a phishing website detection model that can be executed by a hyperlink-based phishing website detection model training device. See [link to relevant documentation]. Figure 1 The phishing website detection model training method specifically includes the following: Step 110: Extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data; Step 120: Construct a directed structure graph corresponding to each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as the node features of each set of directed structure graphs. Step 130: Graph convolutional layers and graph pooling layers are used to calculate the predicted website type tags for each of the directed structural graphs. Step 140: Train the preset graph classification model based on graph neural network according to the historical website dataset and their corresponding website type labels to obtain the corresponding phishing website detection model.

[0034] Specifically, firstly, multiple hyperlinks corresponding to each website in the pre-acquired historical website dataset are extracted to form a hyperlink set for each website. Then, a directed structure graph is constructed based on each hyperlink set, and the features corresponding to each hyperlink in each set are extracted as node features of each directed structure graph. Finally, graph convolutional layers and graph pooling layers are used to calculate the predicted labels for each directed structure graph to obtain the corresponding website type. Based on the historical website dataset and the corresponding website type labels, a pre-set graph classification model based on graph neural networks is trained to obtain the corresponding phishing website detection model, which can accurately and effectively detect phishing websites.

[0035] The historical website dataset was crawled from four authoritative websites: CommonCrawl, SimilarWeb, OpenPhish, and PhishTank. Legitimate website data was crawled from CommonCrawl and SimilarWeb, while phishing website data was crawled from OpenPhish and PhishTank. The obtained website data exists in the form of hyperlinks, such as "https: / / abc".

[0036] To further improve the accuracy of model training, the hyperlink set in step 110 includes: the hyperlink corresponding to the website data and multiple multi-level hyperlinks extracted from the hyperlink.

[0037] Specifically, for each website in the historical website dataset, the HTML source code is obtained, and hyperlinks are extracted. In particular, hyperlinks in the historical website dataset are called level 0 hyperlinks, and hyperlinks extracted from the HTML source code of level 0 hyperlinks are called level 1 hyperlinks. Next, websites with level 1 hyperlinks are requested, their HTML source code is obtained, and hyperlinks are extracted from these level 1 hyperlinks; these are called level 2 hyperlinks, and so on, until all unique hyperlinks are extracted. The extracted hyperlinks will exist in several forms: Form 1: "https: / / def", which is the full representation of a hyperlink.

[0038] Format 2: " / g / h / i / " This format represents the relative hyperlink. Concatenating it with the domain name of the website from which the hyperlink was extracted yields the complete hyperlink representation. For example, if the domain name of the website from which the hyperlink was extracted is "https: / / jkl", then the complete representation after concatenation is "https: / / jkl / g / h / i / ".

[0039] Format 3: "#", this format is a redirect hyperlink that redirects to the current website.

[0040] It's worth noting that a single hyperlink's HTML source code may contain multiple hyperlinks of various types. Storing all the extracted hyperlinks as a JSON file forms a hyperlink set.

[0041] To further improve the accuracy of model training, step 120 involves constructing a corresponding directed structure graph for each hyperlink set, including: Each set of hyperlinks is used as a node in the corresponding directed structure graph, and multiple edges between the nodes are determined according to the access relationship between the nodes, so as to obtain the directed structure graph corresponding to each set of hyperlinks.

[0042] Specifically, a hyperlink structure graph (i.e., a directed structure graph) is constructed for each website based on the aforementioned multiple hyperlink sets. The hyperlink structure graph is a directed graph, in which... These are the nodes in the hyperlink structure graph; the nodes are the hyperlinks extracted above. These are the edges of the hyperlink structure graph. The construction rules (i.e., access relationships) of the hyperlink structure graph in this application are as follows: Rule 1: As shown in Figure 4(a), assume that from the hyperlink (i.e., node Vi in Figure 4(a)) can be directly accessed via hyperlinks. (i.e., node Vj in Figure 4(a)), then there exists an edge in the graph. From the representative nodes Pointer represents nodes .

[0043] Rule 2: As shown in Figure 4(b), assume that from the hyperlink Hyperlinks cannot be accessed directly But from Accessible , , And other hyperlinks, at the same time , , Hyperlinks can be accessed directly When the number of these hyperlinks is greater than If 50% of the hyperlinks are directly accessible, then an edge exists in the graph. From the representative nodes Pointer represents nodes .

[0044] Rule 3: As shown in Figure 4(c), assume that from the hyperlink Hyperlinks cannot be accessed directly But from You can access it directly. , , Hyperlinks, from , Hyperlinks can be accessed directly , Similarly. This situation is, and Accessible hyperlinks and accessible and Hyperlinks contain identical parts; when the number of identical hyperlinks is greater than... Figure 6 When the value of the expression shown is: Therefore, there exists an edge in Figure 4(c). From the representative nodes Pointer represents nodes , coexisting ,represent nodes Pointer represents nodes .

[0045] This application stores the generated hyperlink structure graph G in a CSV (Comma-Separated Values) file. Each row of data in the CSV file is a quadruple of [source node id, source node URL, destination node id, destination node URL]. The source node and destination node are nodes V in the hyperlink structure graph G, and a quadruple represents an edge E in the hyperlink structure graph G.

[0046] This application generates a CSV file for the hyperlink structure graph G constructed for each website in the dataset.

[0047] In addition, the characteristics of each node in the hyperlink structure graph include the following: Feature 1: "is_access". Whether the hyperlinks of the current node are accessible.

[0048] Feature 2: "domain_time_difference". The time difference between the registration time of the current hyperlink domain and the registration time of the 0th-order hyperlink domain. Specifically, when the current hyperlink domain and the 0th-order hyperlink domain are the same, the value of this feature is 0. The 0th-order hyperlink is explained by claim 2.

[0049] Feature 3: "is_same_domain". Whether the hyperlink and the 0th-order hyperlink belong to the same domain.

[0050] Feature 4: "in_degree_num". The number of in-degrees of a node.

[0051] Feature 5: "out_degree_num". The number of out-degrees of a node.

[0052] Feature 6: "in_degree_can_access_num". The number of hyperlinks in an in-degree node that can be accessed normally.

[0053] Feature 7: "out_degree_can_access_num". The number of hyperlinks in the out-degree node that can be accessed normally.

[0054] Feature 8: "in_degree_same_domain_num". The number of hyperlinks in an in-degree node that share the same domain as a 0th-degree hyperlink.

[0055] Feature 9: "out_degree_same_domain_num". The number of hyperlinks in the out-degree nodes that share the same domain as the 0th-order hyperlinks.

[0056] Feature 10: "in_degree_diffrent_domain_num". The number of hyperlinks from different domains among the hyperlinks of in-degree nodes and 0th-degree hyperlinks.

[0057] Feature 11: "out_degree_diffrent_domain_num". The number of hyperlinks from different domains among the out-degree nodes' hyperlinks and 0-order hyperlinks.

[0058] Feature 12: "out_relative_num". The relative number of hyperlinks in the out-degree node. The relative number of hyperlinks is defined by form 2 in claim 2.

[0059] Feature 13: "out_redirect_num". The number of redirect hyperlinks in the out-degree node's hyperlinks. Redirect hyperlinks are defined by form 3 in claim 2.

[0060] Feature 14: ("out_relative_num" + "out_redirect_num") / "out_degree_num" > 0.5? 1:0. In the out-degree node's hyperlinks, is the sum of relative hyperlinks and redirect hyperlinks (#) greater than 50% of the total number of outgoing hyperlinks? If yes, the feature is 1; otherwise, it's 0. A legitimate website typically requires navigation between different pages on the same domain. If a website's HTML source code contains a small number of relative hyperlinks, it's highly likely to be a phishing website.

[0061] Feature 15: "out_redirect_num" / "out_degree_num" > 0.5 ? 1:0. In the hyperlinks of outgoing nodes, is the proportion of redirect hyperlinks (#) greater than 50% of the total outgoing hyperlinks? If it is, the feature is 1; if it is less, the feature is 0. A legitimate website doesn't need excessive redirects to itself. Therefore, if most of the hyperlinks in a website's HTML source code are redirect hyperlinks (#), the website is very likely a phishing website.

[0062] A total of 15 features are used as node features in the website's hyperlink structure graph.

[0063] For example, most nodes in the hyperlink structure graph of a legitimate website will have similar domain names and characteristics to the 0th-order hyperlink node. For instance, a node's hyperlink might be accessible and share the same domain name as the 0th-order hyperlink, thus the domain registration time difference is zero. It might be accessible from 927 other hyperlinks, of which 921 are accessible, 925 share the same domain name as the 0th-order hyperlink, and 2 have different domain names. Furthermore, it might be accessible from 45 other hyperlinks. Of these, 45 are accessible, 42 share the same domain as the 0th-order hyperlink, and 3 have different domains. Among the 45 outgoing hyperlinks, 39 are relative hyperlinks and 1 is a redirect hyperlink. The total number of these two types of hyperlinks accounts for 88.89% of the total number of outgoing hyperlinks, with the redirect hyperlink accounting for 2.22%. Therefore, the characteristics of this hyperlink are [1,0,1,927,45,921,45,925,42,2,3,39,1,1,0].

[0064] Conversely, most nodes in the hyperlink structure diagram of a phishing website are quite different from the 0-level hyperlink node. For example, the 0-level hyperlink node can be accessed normally, and its domain name and registration time are itself. There is one 0-level hyperlink node that can be accessed from other hyperlinks, and it has the same domain name as the 0-level hyperlink. There are 43 other hyperlinks that can be accessed from the 0-level hyperlink node, of which 37 can be accessed normally, 34 have the same domain name as the 0-level hyperlink, and 9 have different domain names. Among the 43 outgoing hyperlinks, there are 6 relative hyperlinks and 28 redirect hyperlinks. The total number of these two types of hyperlinks accounts for 79.06% of the total number of outgoing hyperlinks, of which redirect hyperlinks account for 65.11%. Therefore, the characteristics of this 0-level hyperlink node are [1,0,0,1,43,1,37,1,34,0,9,6,28,1,1]. Suppose that one of the outgoing hyperlinks in this 0th-order hyperlink node is a legitimate website hyperlink impersonated by a phishing attacker, then the characteristic of this node in the hyperlink structure graph is [1,32684632,0,927,45,921,45,0,0,927,45,39,1,1,0].

[0065] It can be seen that even among legitimate hyperlinks, the characteristics of different hyperlink structure graphs are not necessarily the same, depending on whether the 0th-order hyperlink is from a legitimate website or a phishing website. This application stores all node features of each hyperlink structure graph G in a CSV file.

[0066] To further improve the accuracy of model training, step 130 includes: Each of the directed structure graphs is sequentially input into three convolutional layers to obtain the first feature, second feature, and third feature corresponding to each of the directed structure graphs. The first, second and third features corresponding to each of the directed structure graphs are concatenated to obtain the corresponding pooling layer features. The features of each pooling layer are input into the graph pooling layer, and the directed structure graphs are updated according to the forward propagation formula of the pooling layer to obtain the new directed structure graphs and new node features corresponding to each directed structure graph. The readout layer reduces the dimensionality of each new directed structure graph and calculates the corresponding global pooling graph using the readout layer formula. The website type prediction tag for each of the directed structure graphs is calculated based on the fully connected layer formula for each of the global pooling graphs.

[0067] Specifically, graph convolution operations are mainly used for feature transformation and extraction of graphs, while graph pooling operations are mainly used in conjunction with graph convolution operations to reduce the dimensionality of the representation and obtain a representation of the entire graph. This application uses GCN as the graph convolution method and SAGPool, a self-attention-based graph pooling method, as the graph pooling method, which can consider node features and graph structure.

[0068] The model in this application (i.e., the pre-defined graph classification model based on graph neural networks) is as follows: Figure 5 As shown, the model includes three operations: graph convolution, graph pooling, and graph classification. The graph convolution operation consists of three graph convolutional layers, the graph pooling operation consists of one graph pooling layer and one graph readout layer, and the graph classification operation consists of one fully connected layer. Details are as follows: (1) The initial input data of the model is . The number of samples in the dataset. This is a hyperlink structure diagram of the historical website dataset, where... , For the image adjacency matrix , for The number of nodes can be obtained from claim 1. For the image The feature matrix of the nodes , This represents the dimension of the feature representation for each node initially. This can be obtained from claim 3.

[0069] (2) The forward propagation formula for the graph convolutional layer is: Equation (1) A self-connected adjacency matrix was added to G. for The degree matrix, then For the image G The Laplace matrix in its renormalized form. Indicates the node at the 1st Layer feature representation , Indicates the node at the 1st Layer feature representation In particular, This represents the features of a node at layer 0, i.e., the initial features. . For learnable parameters , For the node at the th The dimension of the feature representation of the layer. Similarly. For activation functions, the ReLU function is used in all graph convolutional layers of this application. After the input data passes through three graph convolutional layers (i.e., the first, second, and third convolutional layers), the output data are as follows: , , (i.e., the first feature, the second feature, and the third feature), these three features are concatenated to obtain the features used for the pooling layer. , , .

[0070] (3) The forward propagation formula for graph pooling layers is: Equation (2) Equation (3) Equation (4) Equation (5) In formula (2), The self-attention score of the node A higher self-attention score indicates that the node is more important. For learnable parameters , For activation function, A self-connected adjacency matrix was added to G. for The degree matrix, then For the image G The Laplace matrix in its renormalized form. , , This represents the concatenated features of the hyperlink structure graph after three convolutional layers. The activation function used in the graph pooling layer is... . In formula (3), The function's purpose is to calculate the attention score. , for each graph Choose which ones to keep. 1 node For hyperparameters This application is valid. , Reserved node number , The self-attention scores of the retained nodes are then calculated. Next, the graph structure is updated using formula (4), and the nodes in the updated graph are the nodes that were previously retained. The number of nodes to retain for each graph G. For the image reserve The adjacency matrix of the graph after each node. The node features are updated using formula (5). To preserve the feature representation of the nodes in the graph convolutional layer output, multiplying this feature representation by the attention score of each node to be preserved yields a new feature representation for the preserved nodes. In summary, the output data of the pooling layer consists of the updated graph structure and node features. , .

[0071] (4) The structure and node features of each graph are updated through the above pooling layer. To perform graph classification, a global pooling operation is also needed to reduce graphs with different numbers of nodes to the same dimension. This application uses a readout layer to achieve this function, as shown in the following formula: Equation (6) The output data of this layer is , The number of nodes to be retained for each graph G.

[0072] (5) The formula for the fully connected layer is as follows: Equation (7) The above six layers are the dataset. Each graph Output a global feature representation, i.e. , In addition, the graph labels for the dataset are... , . Learnable parameters for fully connected layers The input data for the fully connected layer is: and The output data is: The graph labels for the website predicted by the model are 0 for legitimate and 1 for phishing.

[0073] To further optimize the model, step 140 includes: The graph classification model based on the graph neural network is trained according to the historical website dataset and the corresponding website type labels. During the training process, the loss value of each website type is calculated based on the predicted label and the corresponding website type label according to the preset loss function. The graph classification model is then iteratively trained based on the loss value to generate a phishing website detection model for phishing website detection.

[0074] Specifically, the graph classification model based on a graph neural network is trained using historical website datasets and their corresponding website type labels. During training, a loss value is calculated based on the predicted label of each website type and its corresponding website type label, using a preset loss function. The graph classification model is then iteratively trained based on this loss value to generate a phishing website detection model, thereby further optimizing the phishing website detection model.

[0075] The loss function is calculated as follows, and the model is iteratively optimized through backpropagation, training, and testing.

[0076] Equation (8) Here, represents the website's tag, with 0 for legitimate websites and 1 for phishing websites. L is the loss function, and m is the number of data points in the dataset. Predict tags for website types.

[0077] This application also provides a method for detecting phishing websites, the method comprising: Obtain hyperlinks from the target website; The hyperlink of the target website is input into the phishing website detection model trained by the phishing website detection model training method mentioned in the foregoing embodiment, so that the phishing website detection model outputs the target category of the website.

[0078] Specifically, the hyperlinks of the target website are first obtained, and then the hyperlinks of the target website are input into the phishing website detection model trained by the phishing website detection model training method mentioned in the foregoing embodiments, so that the phishing website detection model outputs the target category of the website, thereby enabling accurate and effective detection of phishing websites.

[0079] From a software perspective, this application also provides a training apparatus for a hyperlink-based phishing website detection model, which performs all or part of the aforementioned phishing website detection model training method. (See also...) Figure 3The aforementioned training device for the phishing website detection model based on hyperlinks specifically includes the following components: Hyperlink extraction module 10 is used to extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data. The directed structure graph construction module 20 is used to construct a corresponding directed structure graph based on each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as node features of each set of directed structure graphs. The website type prediction tag calculation module 30 is used to calculate the corresponding website type prediction tags by using graph convolutional layers and graph pooling layers on each of the directed structure graphs. The model training module 40 is used to train a preset graph classification model based on a graph neural network according to the historical website dataset and their respective website type labels, so as to obtain the corresponding phishing website detection model.

[0080] The embodiments of the phishing website detection model training device provided in this application can be used to execute the phishing website detection model training method or the processing flow of the phishing website detection method in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the phishing website detection model training method embodiments above.

[0081] This application provides a training device for a phishing website detection model. This device is used to train the following method: extracting multiple hyperlinks corresponding to each website in a pre-acquired historical website dataset to form corresponding hyperlink sets; constructing corresponding directed structure graphs based on each hyperlink set, and extracting features corresponding to each hyperlink in each hyperlink set as node features of each directed structure graph; using graph convolutional layers and graph pooling layers to calculate the corresponding website type prediction labels for each directed structure graph; and training a pre-set graph classification model based on the historical website dataset and the corresponding website type labels to obtain the corresponding phishing website detection model. This application can accurately and effectively detect phishing websites.

[0082] This application also provides an electronic device, such as a central server, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the phishing website detection model training method mentioned in the above embodiments or the phishing website detection method in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0083] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0084] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the phishing website detection model training method in the embodiments of this application or the program instructions / modules corresponding to the phishing website detection method in the above embodiments. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the phishing website detection model training method in the above method embodiments.

[0085] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0086] The one or more modules are stored in the memory, and when executed by the processor, they execute the phishing website detection model training method in the embodiment or the phishing website detection method in the above embodiment.

[0087] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0088] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0089] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0090] This application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the aforementioned phishing website detection model training method or the phishing website detection method in the above embodiments. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0091] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0092] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0093] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0094] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for training a phishing website detection model, characterized in that, include: Extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data; Construct a corresponding directed structure graph based on each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as the node features of each set of directed structure graphs. Graph convolutional layers and graph pooling layers are used to calculate the predicted website type tags for each of the directed structural graphs. The preset graph classification model based on graph neural network is trained based on the historical website dataset and their corresponding website type labels to obtain the corresponding phishing website detection model. The step of constructing a corresponding directed structure graph based on each of the hyperlink sets includes: Each set of hyperlinks is used as a node in a corresponding directed graph, and multiple edges between the nodes are determined based on their access relationships to obtain the directed graph corresponding to each set of hyperlinks. Specifically, a hyperlink graph is constructed for each website based on the aforementioned sets of hyperlinks. The hyperlink structure graph is a directed graph, in which... These are the nodes in the hyperlink structure graph; the nodes are the hyperlinks extracted above. These are the edges of the hyperlink structure graph; the rules for constructing the hyperlink structure graph are as follows: Rule 1: Assuming from hyperlinks You can directly access the hyperlink. Then there exists an edge in the graph. From the representative nodes Pointer represents nodes ; Rule 2: Assuming from hyperlinks Hyperlinks cannot be accessed directly But from Accessible , , And other hyperlinks, at the same time , , Hyperlinks can be accessed directly When the number of these hyperlinks is greater than If 50% of the hyperlinks are directly accessible, then an edge exists in the graph. From the representative nodes Pointer represents nodes ; Rule 3: and Accessible hyperlinks and accessible and If hyperlinks have the same part, and the number of identical hyperlinks exceeds the value of the following formula: Then there exists an edge From the representative nodes Pointer represents nodes , coexisting ,represent nodes Pointer represents nodes .

2. The phishing website detection model training method according to claim 1, characterized in that, The hyperlink set includes: the hyperlink corresponding to the website data and multiple multi-level hyperlinks extracted from the hyperlink.

3. The phishing website detection model training method according to claim 1, characterized in that, The step of using graph convolutional layers and graph pooling layers to calculate the corresponding website type prediction tags for each of the directed structural graphs includes: Each of the directed structure graphs is sequentially input into three convolutional layers to obtain the first feature, second feature, and third feature corresponding to each of the directed structure graphs. The first, second and third features corresponding to each of the directed structure graphs are concatenated to obtain the corresponding pooling layer features. The features of each pooling layer are input into the graph pooling layer, and the directed structure graphs are updated according to the forward propagation formula of the pooling layer to obtain the new directed structure graphs and new node features corresponding to each directed structure graph. The readout layer reduces the dimensionality of each new directed structure graph and calculates the corresponding global pooling graph using the readout layer formula. The website type prediction tag for each of the directed structure graphs is calculated based on the fully connected layer formula for each of the global pooling graphs.

4. The phishing website detection model training method according to claim 3, characterized in that, The step of sequentially inputting each of the directed structural graphs into three convolutional layers to obtain multiple first features, second features, and third features corresponding to each directed structural graph includes: Each of the directed structure graphs is input into the first convolutional layer, and each of the first features is obtained by calculation according to the forward propagation formula of the convolutional layer. Each of the first features is input into the second convolutional layer and calculated according to the forward propagation formula of the convolutional layer to obtain each of the second features; Each of the second features is input into the third convolutional layer and calculated according to the forward propagation formula of the convolutional layer to obtain each of the third features.

5. The phishing website detection model training method according to claim 3, characterized in that, The step of training a preset graph classification model based on a graph neural network according to the historical website dataset and their corresponding website type labels to obtain a corresponding phishing website detection model includes: The graph classification model based on the graph neural network is trained according to the historical website dataset and the corresponding website type labels. During the training process, the loss value of each website type is calculated based on the predicted label and the corresponding website type label according to the preset loss function. The graph classification model is then iteratively trained based on the loss value to generate a phishing website detection model for phishing website detection.

6. A method for detecting phishing websites, characterized in that, include: Obtain hyperlinks from the target website; The hyperlink of the target website is input into a phishing website detection model pre-trained based on the phishing website detection model training method according to any one of claims 1-5, so that the phishing website detection model outputs the target category of the website.

7. A training device for a phishing website detection model based on hyperlinks, characterized in that, The apparatus is used to implement the phishing website detection model training method as described in claim 1; the apparatus includes: The hyperlink extraction module is used to extract multiple hyperlinks corresponding to each website data in the pre-acquired historical website dataset to form a hyperlink set corresponding to each website data. A directed structure graph construction module is used to construct a corresponding directed structure graph based on each set of hyperlinks, and extract the features corresponding to each hyperlink in each set of hyperlinks as node features of each set of directed structure graphs. The website type prediction tag calculation module is used to calculate the corresponding website type prediction tags by using graph convolutional layers and graph pooling layers on each of the directed structure graphs. The model training module is used to train a preset graph classification model based on a graph neural network according to the historical website dataset and their respective website type labels, so as to obtain the corresponding phishing website detection model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the phishing website detection model training method as described in any one of claims 1 to 5, or executes the phishing website detection method as described in claim 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the phishing website detection model training method as described in any one of claims 1 to 5, or performs the phishing website detection method as described in claim 6.

Images