Counterfeit website fraud risk management system and method based on big data

Abstract

The present invention relates to the technical field of financial network security management, and discloses a fake website fraud risk management system and method based on big data, wherein the system comprises a visiting website legitimacy identification management module, a visiting website fraud risk analysis management module, and a visiting website fraud risk feedback management module; visiting websites with fraud risks are intelligently identified through visiting website fraud risk assessment parameters and users are promptly prompted, thereby improving the reliability and applicability of financial institution websites and reducing user property losses; visiting websites with fraud risks are promptly fed back to a network security supervision platform, realizing intelligent feedback of fake websites with fraud risks, thereby improving the security and reliability of the financial institution website network environment, and improving the fraud risk identification effect and efficiency of the fake website fraud risk management system of the financial institution website.

Description

Technical Field

[0001] The present invention relates to the technical field of financial network security management, and in particular to a fake website fraud risk management system and method based on big data. Background Art

[0002] In most cases, criminals use a vulnerability to access other innocent users' hosts to run fake web pages, and then create and distribute misleading and deceptive emails on a large scale. Some of these emails appear to be from banks, claiming that there are some urgent requirements and that the recipients need to update their accounts; some appear to be from retailers, claiming that new products are available for sale. In response, Internet users who lack security awareness often follow the email prompts and click on the web links in the emails that appear normal but are actually fake. Once the user clicks on this link, he or she will be prompted to enter important personal information such as account information, credit card number, transaction password, etc. The criminals will eventually obtain this information and then steal money from the user's account; fake websites are created by constructing pages that are highly similar to a target website, commonly known as phishing websites. Phishing websites usually send deceptive messages claiming to be from the counterfeited institution through spam, instant messaging, mobile phone text messages or false web page advertisements, in order to trick users into visiting the phishing website to obtain their personal secret information, such as bank account numbers and account passwords. The active identification of fraudulent behavior of fake websites by the fraud risk management system of financial institutions has weak recognition accuracy, or does not have the function of accurately identifying fraudulent behavior of fake websites. The inability to accurately identify fake websites and provide timely feedback to users has caused property losses to users.

[0003] The Chinese invention patent with the publication number CN111047428B discloses a method for identifying high-risk fraudulent customers of banks based on a small number of fraud samples, using the following technical solutions S1: extract bank customer data D; S2: perform data preprocessing and data cleaning on the original data; S3: randomly extract s% of samples from Dp as spy samples, and put them into Du to generate new data sets and; S4: use and as two categories to train a logistic regression model; S5: train a random forest model; S6: construct a tree using the training set data; S7: use the validation set data to find the optimal tree F from the 9 trees generated in step S6. S8: repeat steps S5 to S7 until n optimal trees are obtained; improve the efficiency of identifying high-risk customers; however, the above technical solutions cannot guarantee accurate and scientific identification of fraudulent customer objects on the bank side based on a small number of fraud samples. Summary of the invention

[0004] 1. Technical issues to be solved

[0005] In order to solve the problem that the fraud risk management system of the above-mentioned financial institutions actively identifies fraudulent behaviors of fake websites with low accuracy, or does not have the function of accurately identifying fraudulent behaviors of fake websites. It is unable to accurately identify fake websites and timely feedback to remind users, causing property losses to users, and achieves the above purpose of accurately analyzing the legitimacy of the domain name of the visited website, autonomously analyzing the registration time type of the visited website, intelligently analyzing the characteristics of the visited website object website, and intelligently identifying and feedbacking fraud risk websites.

[0006] (II) Technical solution

[0007] The present invention is implemented by the following technical scheme: a method for managing fraud risks of counterfeit websites, the method comprising the following steps:

[0008] S1. Collect domain name data of visited websites;

[0009] S2, using a data search algorithm to compare the network domain name data characteristics of the visited website with the legitimate network domain name data of the website, and constructing the legitimacy analysis result data of the visited website domain name based on the comparison result of the network domain name data characteristics of the website;

[0010] S3. When the legitimacy analysis result data of the visited website domain name is legal, collect the registration time data of the visited website, the end time data of the visited website, and the time data of the visited website visiting the website of the financial institution;

[0011] S4, generating website registration time period data and website usage end time period data based on the website registration time data, website usage end time data, and website access financial institution website access time data in combination with a time period calculation formula;

[0012] S5, using a data search algorithm to perform numerical analysis on the registration time period data and the end-of-use time period data of the visited website, respectively, by comparing the visited website registration time period data with the visited website new registration time period threshold, the visited website use end time period data with the visited website near-expiry use end time period threshold, and construct and generate the visited website registration time type analysis result data;

[0013] S6. When the visited website registration time type analysis result data is a newly registered website or an expired website, collect the visited website web page interface feature image data, use a data recognition algorithm to match the visited website web page interface feature image data with the website's legitimate web page interface feature image data, and construct the visited website web page interface legitimacy analysis data based on the website's web page interface feature image matching result;

[0014] S7. Perform fraud risk assessment on the visited website based on the visited website domain name legitimacy analysis result data, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and generate visited website fraud risk assessment data; obtain the visited website fraud risk assessment data and perform user prompt operations on visited websites with fraud risks; push the visited website network domain name data, the visited website web page interface feature image data and the visited website fraud risk assessment data corresponding to the visited website with fraud risks to the network security supervision platform.

[0015] Preferably, the operation steps for collecting the domain name data of the visited website are as follows:

[0016] S11. The website of the financial institution collects the network domain names of the visited websites online through a data collector and generates the network domain name data I of the visited websites. The data collector includes any one of an API interface and a log file.

[0017] The present invention achieves the effect of providing data support for intelligent analysis of the legitimacy of visited websites and improving the anti-fraud risk management capability of financial institutions' websites by accurately collecting network domain name parameters of visited websites.

[0018] Preferably, the data search algorithm is used to compare the network domain name data of the visited website with the legitimate network domain name data of the website, and the operation steps of constructing the legitimacy analysis result data of the visited website domain name based on the comparison result of the network domain name data of the website are as follows:

[0019] S21. Establish a data set of legal domain names for websites where a m Represents the legitimate domain name data of the mth website, Indicates the maximum number of legal domain name data of the website;

[0020] S22, using a bidirectional search algorithm to compare the visited website network domain name data I with the website legal network domain name data a in the website legal network domain name data set A. m Compare the characteristics of the website's network domain name data to construct the legitimacy analysis result data A of the visited website domain name yuming ;

[0021] When the network domain name data feature comparison between I and A is successful, it means that the visited website has been legally registered and filed, and the legality analysis result data of the visited website domain name A is output yuming To be legal;

[0022] When the domain name data feature comparison between I and A fails, it means that the accessed website has not been legally registered and filed, and the domain name legitimacy analysis result data A of the accessed website is output. yuming Is illegal.

[0023] The present invention achieves the effect of accurately identifying counterfeit websites from financial institution websites by scientifically presetting the big data parameters of network domain names of legitimate websites and combining a two-way search algorithm to efficiently and autonomously analyze the legitimacy of the network domain names of visited websites.

[0024] Preferably, when the legality analysis result data of the visited website domain name is legal, the operation steps of collecting the registration time point data of the visited website, the end time point data of the visited website use, and the time point data of the visited website visiting the website of the financial institution are as follows:

[0025] S31, when the domain name of the visited website is legitimate, the result data A yuming When it is legal, the website of the financial institution is used to collect the registration time of the website through the data collector online and generate the registration time data of the website. zhuce , where the time point is mainly composed of year, month and day, and the access website registration time point data represents the time point when the access website is registered on the legal server operator platform;

[0026] The end time point of the use of the visited website is collected online through the website of the financial institution through the data collector, and the end time point data of the use of the visited website is generated. jieshu , the access website use end time point data indicates the time point when the access website ends use after registration on the legal server operator platform;

[0027] The time point of the visit website to the financial institution website is collected online through the data collector through the financial institution website, and the time point data of the visit website to the financial institution website is generated. fangwen The data of the time point when the website visits the website of the financial institution indicates the time point when the website visits the website of the financial institution.

[0028] The present invention achieves the effect of providing data support for subsequent accurate analysis of the registration time type of the visited website by accurately obtaining the registration time point parameters of the visited website and using the end time point parameters to access the time point parameters of the financial institution website.

[0029] Preferably, the steps of generating the website registration time period data and the website use end time period data based on the website registration time point data, the website use end time point data, and the website visit financial institution website visit time point data in combination with the time period calculation formula are as follows:

[0030] S41, obtaining the registration time point data t of the visited website zhuce , the end time point data of the visited website jieshu , the time point data of the visited website visiting the website of the financial institution t fangwen ;

[0031] S42, according to the website access registration time point data t zhuce and the time point data of the website visited to the website of the financial institution t fangwen Combined with the time interval calculation formula, the registration time period data Δt of the visited website is calculated. zhuce =|t fangwen -t zhuce |,Δt zhuce The unit is day;

[0032] According to the data of the end time point of the visited website use t jieshu , the time point data of the visited website visiting the website of the financial institution t fangwen Combined with the time interval calculation formula, the end time period data Δt of the visited website is calculated. jieshu =|t fangwen -t jieshu |,Δt jieshu The unit is day.

[0033] The present invention achieves the effect of improving the scientificity of the financial institution website in identifying counterfeit websites by measuring the registration time period and the use end time period parameters of the access website.

[0034] Preferably, the data search algorithm is used to perform numerical analysis on the registration time period data and the end-of-use time period data of the visited website, respectively, by comparing the registration time period data of the visited website with the new registration time period threshold of the visited website, and the end-of-use time period data of the visited website with the end-of-use time period threshold of the visited website, and the operation steps of constructing and generating the analysis result data of the registration time type of the visited website are as follows:

[0035] S51. Establish a threshold value S for a new registration time period for visiting a website zhuce , the threshold value of the newly registered time period for visiting a website represents the maximum value of the newly registered time period for visiting a website to visit a financial institution platform;

[0036] Establish a threshold S for the time period when the website is about to expire jieshu The threshold of the time period for the website to be used immediately before expiration indicates the maximum value of the time period for the website to be used immediately before expiration when the website visits the financial institution platform, and the website to be used immediately before expiration indicates that the time period for the website to be used immediately before expiration is not greater than the threshold of the time period for the website to be used immediately before expiration;

[0037] S52, using a bidirectional search algorithm to respectively search the website visit registration time period data Δt zhuce The threshold value S for the new registration period for visiting the website zhuce , the access website uses the end time period data Δt jieshu The threshold value S of the time period when the access website is about to expire jieshu Perform numerical analysis on the registration time period data and the end time period data of the website access, and construct and generate the website access registration time type analysis result data P;

[0038] When Δt zhuce >S zhuce And Δt jieshu >S jieshu , indicating that the visited website is neither a newly registered website nor an expired website, then the output visited website registration time type analysis result data P is a normal website;

[0039] When Δt zhuce ≤S zhuce , indicating that the visited website is a newly registered website, then the output visit website registration time type analysis result data P is a newly registered website;

[0040] When Δt jieshu ≤S jieshu , indicating that the visited website is a expiring website, then the output visited website registration time type analysis result data P is an expiring website.

[0041] The present invention combines the registration time period parameter of the visited website with the new registration time period threshold of the visited website through a two-way search algorithm, and compares the time period values ​​of the visited website use end time period parameter with the visited website use end time period threshold, and analyzes the registration time type of the visited website, thereby achieving the effect of autonomously and accurately analyzing the registration time type of the visited website.

[0042] Preferably, when the visit website registration time type analysis result data is a newly registered website or an expired website, the visit website web page interface feature image data is collected, and the visit website web page interface feature image data is matched with the website's legitimate web page interface feature image data using a data recognition algorithm. The operation steps for constructing the visit website web page interface legitimacy analysis data based on the website's web page interface feature image matching results are as follows:

[0043] S61. When the visited website registration time type analysis result data P is a newly registered website or a nearly expired website, the visited website network domain name data I is input into the website search platform to enter the website interface of the visited website, intercept and collect the web page interface feature image of the visited website and establish the visited website web page interface feature image data set B = (b1, ..., b n,…,b θ ), n=1,2,3,…,θ; where b n represents the collection of the nth characteristic image data of the web page interface of the visited website, θ represents the maximum value of the number of characteristic image data of the web page interface of the visited website, and the website search platform includes any one of the Baidu search platform, the Google search platform, the 360 ​​search platform, and the Sogou search platform;

[0044] S62. Establishing the website's legal web page interface feature image data where b' m Indicates the website's legal domain name data a m The characteristic image data of the legitimate web page interface of the corresponding website;

[0045] S63, using a data recognition algorithm to identify the visited website web page interface feature image data set B. n The legitimate web page interface feature image data b' of the website in the legitimate web page interface feature image data set B' m The specific steps of performing feature image matching on the web page interface of the website and the data recognition algorithm for performing feature image matching on the web page interface are as follows:

[0046] S631, Parameter initialization: Identify bat population size on web interface Maximum number of iterations K, objective function f(X), web interface to identify the position of bat individual i and speed α i , sound wave frequency β i , sound wave loudness χ i Sum frequency δ i ;

[0047] S632, find out the optimal web page interface recognition bat position w in the current web page interface recognition bat population * , that is, the web page interface recognizes the bat population and searches for the characteristic image data b of the visited website web page interface in the search space of the legal website web page interface characteristic image data set B′ n The most matching website legitimate web page interface feature image data b' m The speed and position are updated according to the following formulas:

[0048] in represents the speed of web page interface recognition bat individual i in the search space of the website legal web page interface feature image data set B′ after k+1 iterations, It represents the speed of web page interface recognition bat individual i in the search space of the website legal web page interface feature image data set B′ after k iterations; It represents the position of bat individual i in the search space of the website’s legal web interface feature image data set B′ after k iterations. It represents the position of web page interface recognition bat individual i in the search space of the website's legal web page interface feature image data set B′ after k+1 iterations; It represents the sound wave loudness of bat individual i in the search space of the website’s legal web interface feature image data set B′ after k+1 iterations. It represents the sound wave loudness of bat individual i in the search space of the website's legal web interface feature image data set B′ after k iterations; represents the frequency of web page interface recognition bat individual i in the search space of the website's legal web page interface feature image data set B′ after k+1 iterations, represents the initial frequency of bat individual i in the search space of the legal web interface feature image data set B' after k iterations; exp represents a random function with values ​​(-∞, +∞), ψ and l are constants and 0﹤ψ﹤1, l>0;

[0049] S633, generate a random number rand1, rand1 is a random number in the interval [0,1], when rand1>δ i , select an optimal web page interface identification bat individual from the optimal web page interface identification bat individual, that is, search for the web page interface feature image data b of the visited website in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m , and then select the optimal web page interface to identify the vicinity of the bat individual, through the formula exp→∞ generates a local solution, that is, searching for the feature image data b of the visited website web page interface in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m , otherwise according to the formula, Update the web page interface to identify the bat position, that is, update the searched feature image data b of the visited website web page interface in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m location;

[0050] S634, generate another random number rand2, rand2 is a random number on [0,1]; when rand2<χ i, and the fitness of the objective function f(X) is better than the new solution in S633, that is, the solution found in the search space of the website legal web page interface feature image data set B′ that is consistent with the visited website web page interface feature image data b n Matching website legitimate web page interface feature image data b' m The fitness is better than the website legal web page interface feature image data b' matched in S633 m , then accept the website's legal web page interface feature image data b' m The position of the search space in the website's legal web page interface feature image data set B' is updated, and the position update formula is as follows: new =w old +ε×χ i , Adjust χ i and δ i ; where w new represents the new position of bat individual i in the search space of the website’s legal web interface feature image data set B′, w old represents the old position of bat individual i in the search space of the website’s legal web interface feature image data set B′, and ε is an arbitrary number in the interval [-1,1];

[0051] S635, sort the fitness values ​​of all individuals in the bat population identified by the web page interface, and find the current best w * , that is, the searched data in the search space of the legitimate web page interface feature image data set B′ of the website is related to the visited website web page interface feature image data b n The most matching website legitimate web page interface feature image data b' m location;

[0052] S636, repeat S632 to S635, and when the maximum number of iterations K is met, output b n With b' m Perform feature image matching results of the website's web page interface;

[0053] S64, constructing the legitimacy analysis data R of the visited website web page interface according to the result of the web page interface feature image matching of the website in step S636;

[0054] When b n With b' m If the website's web page interface feature image matching is successful, it means that the newly registered website or the expired website's web page interface is in compliance with the legal web page interface, then the legality analysis data R of the visited website's web page interface is outputted, indicating that the visited website's web page interface is legal;

[0055] When b n With b' mIf the characteristic image of the website's web page interface is not matched successfully, it means that the web page interface of the newly registered website or the expiring website does not meet the legal web page interface, then the legality analysis data R of the accessed website's web page interface is output as the accessed website's web page interface is illegal.

[0056] The present invention obtains the characteristic image parameters of the web page interface of the visited website online and combines the bat optimization algorithm with the characteristic image parameters of the legal web page interface of the preset website to analyze and construct the legality analysis result of the web page interface of the visited website, so as to achieve the effect of intelligent legal evaluation of the web page interface of the newly registered or expired visited website.

[0057] Preferably, the fraud risk assessment of the visited website is performed based on the visited website domain name legitimacy analysis result data, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and the visited website fraud risk assessment data is generated; the visited website fraud risk assessment data is obtained and a user prompt operation is performed on the visited website with fraud risk; the visited website network domain name data corresponding to the visited website with fraud risk, the visited website web page interface feature image data and the visited website fraud risk assessment data are pushed and fed back to the network security supervision platform in the following operating steps:

[0058] S71, based on the legitimacy analysis result data A of the visited website domain name yuming , performing fraud risk assessment of the visited website based on the visited website registration time type analysis result data P and the visited website webpage interface legitimacy analysis data R, and generating visited website fraud risk assessment data G;

[0059] When the domain name legitimacy analysis result data A of the visited website yuming If it is illegal, the fraud risk assessment data G for visiting the website is outputted, indicating that there is a fraud risk in visiting the website;

[0060] When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legitimate and the access website registration time type analysis result data P is a normal website, the output access website fraud risk assessment data G is that the access website does not have a fraud risk;

[0061] When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is that the access website web page interface is legal, then the output access website fraud risk assessment data G is that the access website does not have a fraud risk;

[0062] When the domain name legitimacy analysis result data A of the visited website yumingIf the access website is legal and the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk;

[0063] When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is an expired website and the access website web page interface legitimacy analysis data R is that the access website web page interface is legal, then the output access website fraud risk assessment data G is that the access website does not have a fraud risk;

[0064] When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is an expired website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk;

[0065] S72, obtaining the website visit fraud risk assessment data G;

[0066] S73. When the visited website fraud risk assessment data G indicates that the visited website has a fraud risk, the visited website fraud risk assessment data G is pushed through the mobile communication network and the user is prompted; at the same time, the visited website network domain name data I, the visited website web page interface feature image data set B and the visited website fraud risk assessment data G are pushed and fed back to the network security supervision platform through the mobile communication network.

[0067] The present invention generates fraud risk assessment parameters for visited websites, intelligently identifies visited websites with fraud risks, prompts users, and feeds back to a network security supervision platform, thereby achieving standardized and efficient fraud risk assessment for visited websites and improving the security and reliability of the network environment of financial institution websites.

[0068] A big data-based counterfeit website fraud risk management system that implements the counterfeit website fraud risk management method, the system comprising a visit website legitimacy identification management module, a visit website fraud risk analysis management module, and a visit website fraud risk feedback management module;

[0069] The access website legitimacy identification management module includes a access website network domain name collection unit, a website legal network domain name storage unit, and a access website domain name legitimacy analysis unit;

[0070] The visited website network domain name collection unit collects the visited website network domain name data through a data collector; the website legal network domain name storage unit is used to store the website legal network domain name data; the visited website domain name legality analysis unit is used to use a data search algorithm to compare the visited website network domain name data with the website legal network domain name data to perform network domain name data feature comparison of the website, and construct the visited website domain name legality analysis result data based on the website network domain name data feature comparison result;

[0071] The website access fraud risk analysis management module includes a website access registration time and use end time collection unit, a website access execution access time collection unit, a website access registration duration and use end duration measurement unit, a website access registration duration threshold and use end duration threshold storage unit, a website access registration time type analysis unit, a website access web page interface feature image collection unit, a website legal web page interface feature image storage unit, a website access web page interface legitimacy analysis unit, and a website access fraud risk assessment unit;

[0072] The website registration time and end of use time acquisition unit acquires website registration time data and website end of use time data through a data collector; the website execution access time acquisition unit acquires website access to financial institution website time data through a data collector; the website registration duration and end of use time measurement unit generates website registration time period data and website end of use time period data based on the website registration time point data, the website end of use time point data, and the website access to financial institution website time point data in combination with a time period calculation formula; the website registration duration threshold and end of use time threshold storage unit is used to store the website new registration time period threshold and the website near-expiry end of use time period threshold; the website registration time type analysis unit uses a data search algorithm to respectively compare the website registration time period data with the website new registration time period threshold, the website end of use time period data with the website near-expiry end of use time The method comprises the following steps: performing numerical analysis on the registration time period data and the end time period data of the visited website according to the segment threshold, and constructing and generating the analysis result data of the registration time type of the visited website; the visited website web page interface feature image acquisition unit, collecting the visited website web page interface feature image data; the website legal web page interface feature image storage unit, for storing the website legal web page interface feature image data; the visited website web page interface legitimacy analysis unit, collecting the visited website web page interface feature image data, using the data recognition algorithm to match the visited website web page interface feature image data with the website legal web page interface feature image data, and constructing the visited website web page interface legitimacy analysis data according to the website web page interface feature image matching result; the visited website fraud risk assessment unit, performing the visited website fraud risk assessment according to the visited website domain name legitimacy analysis result data, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and generating the visited website fraud risk assessment data;

[0073] The website fraud risk feedback management module includes a website fraud risk assessment result acquisition unit, a website fraud risk user prompt unit, and a website fraud risk feedback unit;

[0074] The visiting website fraud risk assessment result acquisition unit is used to obtain the visiting website fraud risk assessment data; the visiting website fraud risk user prompt unit performs user prompt operations on the visiting website with fraud risks based on the visiting website fraud risk assessment data; the visiting website fraud risk feedback unit pushes and feeds back the visiting website network domain name data corresponding to the visiting website with fraud risks, the visiting website web page interface feature image data and the visiting website fraud risk assessment data to the network security supervision platform.

[0075] (III) Beneficial effects

[0076] The present invention provides a fake website fraud risk management system and method based on big data. It has the following beneficial effects:

[0077] 1. Through the website network domain name collection unit, the network domain name parameters of the visited website are accurately collected to provide data support for the intelligent analysis of the legitimacy of the visited website, thereby improving the anti-fraud risk management capabilities of the financial institution website; the website legal network domain name storage unit and the visited website domain name legitimacy analysis unit cooperate with each other to scientifically preset the network domain name big data parameters of the legal website, and combine with the intelligent search algorithm to efficiently and autonomously analyze the legitimacy of the visited website network domain name, thereby realizing the accurate identification of counterfeit websites by the financial institution website and improving the risk identification accuracy and security of the financial institution website.

[0078] 2. Through the cooperation between the website registration time and end of use time collection unit, the website access execution time collection unit, and the website registration time and end of use time measurement unit, the website registration time point parameters, the end of use time point parameters, the time point parameters of the financial institution website, and the registration time period and end of use time period parameters of the website are accurately obtained, so as to provide data support for the subsequent accurate analysis of the registration time type of the website, and improve the scientificity and effectiveness of the financial institution website in identifying counterfeit websites; the website registration time threshold and end of use threshold storage unit and the website registration time type analysis unit cooperate with each other, and use the intelligent search algorithm to combine the website registration time period parameters with the website new registration time period threshold, and the website end of use time period parameters with the website near-expiry end of use time period threshold for the website to conduct By comparing the numerical values ​​of time periods, the registration time type of the visited website can be analyzed independently and accurately, thereby improving the accuracy of the fraud risk analysis of the financial institution website on counterfeit websites; the characteristic image acquisition unit of the visited website web interface and the legality analysis unit of the visited website web interface cooperate with each other to obtain the characteristic image parameters of the visited website web interface online and combine the intelligent recognition algorithm with the characteristic image parameters of the preset website legal web interface to analyze and construct the legality analysis result of the visited website web interface, thereby realizing the intelligent legality evaluation of the web interface of the newly registered or expired visited website, thereby improving the scientific nature of the fraud risk assessment results of the financial institution website on counterfeit websites; the visited website fraud risk assessment unit accurately generates the fraud risk assessment parameters of the visited website, thereby realizing the standardized and efficient fraud risk assessment of the visited website, thereby improving the intelligence of the financial institution website and the accuracy of risk identification.

[0079] 3. Through the website fraud risk user prompt unit, the website fraud risk assessment parameters of the website fraud risk are used to intelligently identify the website fraud risk and promptly prompt the user, thereby improving the reliability and applicability of the financial institution's website and reducing the user's property loss; the website fraud risk feedback unit promptly feeds back the website fraud risk to the network security supervision platform, realizes intelligent feedback of counterfeit websites with fraud risks, improves the security and reliability of the financial institution's website network environment, and improves the fraud risk identification effect and efficiency of the counterfeit website fraud risk management system of the financial institution's website. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 A schematic diagram of the modules of the big data-based counterfeit website fraud risk management system provided by the present invention;

[0081] Figure 2 This is a flow chart of the counterfeit website fraud risk management method provided by the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] The implementation examples of the fake website fraud risk management system and method based on big data are as follows:

[0084] See also Figure 1 - Figure 2 , a method for managing fraud risk of fake websites, the method comprising the following steps:

[0085] S1. Collect domain name data of visited websites;

[0086] S2. Using a data search algorithm, the domain name data of the visited website is compared with the legitimate domain name data of the website to perform domain name data feature comparison of the website, and based on the domain name data feature comparison result of the website, the legitimate domain name analysis result data of the visited website is constructed;

[0087] S3. When the domain name legitimacy analysis result data of the visited website is legal, collect the registration time data of the visited website, the end time data of the visited website, and the time data of the visited website visiting the website of the financial institution;

[0088] S4, generating website registration time period data and website usage end time period data based on the website registration time point data, website usage end time point data, and website access to financial institution website time point data in combination with a time period calculation formula;

[0089] S5, using a data search algorithm to perform numerical analysis on the registration time period data and the end-of-use time period data of the visited website, respectively, by comparing the registration time period data of the visited website with the new registration time period threshold of the visited website, and the end-of-use time period data of the visited website with the end-of-use time period threshold of the visited website, and construct and generate the analysis result data of the registration time type of the visited website;

[0090] S6. When the visit website registration time type analysis result data is a newly registered website or an expired website, collect the visit website web page interface feature image data, use the data recognition algorithm to match the visit website web page interface feature image data with the website's legitimate web page interface feature image data, and construct the visit website web page interface legitimacy analysis data based on the website's web page interface feature image matching results;

[0091] S7. Perform fraud risk assessment on the visited website based on the legitimacy analysis result data of the visited website domain name, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and generate visited website fraud risk assessment data; obtain visited website fraud risk assessment data and perform user prompt operations on visited websites with fraud risks; push visited website network domain name data, visited website web page interface feature image data and visited website fraud risk assessment data corresponding to visited websites with fraud risks to the network security supervision platform.

[0092] For further information, see Figure 1 - Figure 2 , the steps to collect the domain name data of the visited website are as follows:

[0093] S11. The website of the financial institution collects the network domain names of the visited websites online through a data collector and generates the network domain name data I of the visited websites. The data collector includes any one of an API interface and a log file.

[0094] The data search algorithm is used to compare the domain name data of the visited website with the legitimate domain name data of the website. Based on the comparison results of the domain name data characteristics of the website, the operation steps for constructing the legitimate analysis result data of the visited website domain name are as follows:

[0095] S21. Establish a data set of legal domain names for websites where a m Represents the legitimate domain name data of the mth website, Indicates the maximum number of legal domain name data of the website;

[0096] S22, using a bidirectional search algorithm to compare the visited website network domain name data I with the website legal network domain name data set A. m Compare the characteristics of the website's network domain name data to construct the legitimacy analysis result data A of the visited website domain name yuming ;

[0097] When the network domain name data feature comparison between I and A is successful, it means that the visited website has been legally registered and filed, and the legality analysis result data of the visited website domain name A is output yuming To be legal;

[0098] When the domain name data feature comparison between I and A fails, it means that the accessed website has not been legally registered and filed, and the domain name legitimacy analysis result data A of the accessed website is output. yuming Is illegal.

[0099] Through the website network domain name collection unit, the network domain name parameters of the visited website are accurately collected to provide data support for the intelligent analysis of the legitimacy of the visited website, thereby improving the anti-fraud risk management capabilities of the financial institution's website; the website's legal network domain name storage unit and the visited website domain name legitimacy analysis unit cooperate with each other to scientifically preset the network domain name big data parameters of the legal website, and combine with the intelligent search algorithm to efficiently and autonomously analyze the legitimacy of the visited website network domain name, thereby realizing the accurate identification of counterfeit websites by the financial institution's website and improving the risk identification accuracy and security of the financial institution's website.

[0100] For further information, see Figure 1 - Figure 2 When the domain name legitimacy analysis result data of the visited website is legal, the operation steps for collecting the registration time point data of the visited website, the end time point data of the visited website, and the time point data of the visited website visiting the website of the financial institution are as follows:

[0101] S31, when accessing the website domain name legitimacy analysis result data A yuming When it is legal, the website of the financial institution is used to collect the registration time of the website through the data collector online and generate the registration time data of the website. zhuce , where the time point is mainly composed of year, month and day, and the registration time point data of the visited website indicates the time point when the visited website is registered on the legal server operator platform;

[0102] The end time point of the use of the visited website is collected online through the website of the financial institution through the data collector, and the end time point data of the use of the visited website is generated. jieshu ,The end time of the use of the visited website indicates the time when the use of the visited website ends after registration on the legal server operator platform;

[0103] The time point of the visit website to the financial institution website is collected online through the data collector through the financial institution website, and the time point data of the visit website to the financial institution website is generated. fangwen , the time point data of visiting a website and visiting a financial institution's website represents the time point when the website is visited and the financial institution's website is visited.

[0104] The steps for generating website registration time period data and website usage end time period data based on the website registration time point data, website usage end time point data, and website access to financial institution website time point data combined with the time period calculation formula are as follows:

[0105] S41. Obtaining the registration time data of the visited website t zhuce , the end time data of the website visit jieshu , website visit time data of visiting financial institution website tfangwen ;

[0106] S42, based on the registration time data of the visited website t zhuce and the time point data of visiting the website and visiting the website of the financial institution fangwen Combined with the time interval calculation formula, the registration time period data Δt of the visited website is calculated. zhuce =|t fangwen -t zhuce |,Δt zhuce The unit is day;

[0107] Based on the data of the end time of the website visit jieshu , website visit time data of visiting financial institution website t fangwen Combined with the time interval calculation formula, the end time period data Δt of the visited website is calculated. jieshu =|t fangwen -t jieshu |,Δt jieshu The unit is day.

[0108] The data search algorithm is used to analyze the registration time period data of the visited website and the new registration time period threshold of the visited website, the end time period data of the visited website and the end time period threshold of the visited website, and the operation steps of constructing and generating the analysis result data of the registration time type of the visited website are as follows:

[0109] S51. Establish a threshold value S for a new registration time period for visiting a website zhuce ,The threshold value of the newly registered time period for visiting a website indicates the maximum value of the newly registered time period for visiting a website to access a financial institution platform;

[0110] Establish a threshold S for the time period when the website is about to expire jieshu , the threshold of the time period for the website to be used immediately before expiration indicates the maximum value of the time period for the website to be used immediately before expiration when the website visits the financial institution platform, and the website to be used immediately before expiration indicates that the time period for the website to be used immediately before expiration is not greater than the threshold of the time period for the website to be used immediately before expiration;

[0111] S52, using a two-way search algorithm to respectively search the website registration time period data Δt zhuce The threshold value S for the new registration period for visiting the website zhuce , visit the website and use the end time period data Δt jieshu The threshold value S of the time period when the website is about to expire jieshu Perform numerical analysis on the registration time period data and the end time period data of the website access, and construct and generate the website access registration time type analysis result data P;

[0112] When Δt zhuce >S zhuce And Δt jieshu >S jieshu , indicating that the visited website is neither a newly registered website nor an expired website, then the output visited website registration time type analysis result data P is a normal website;

[0113] When Δt zhuce ≤S zhuce , indicating that the visited website is a newly registered website, then the output visit website registration time type analysis result data P is a newly registered website;

[0114] When Δt jieshu ≤S jieshu , indicating that the visited website is a expiring website, then the output visited website registration time type analysis result data P is an expiring website.

[0115] When the visit website registration time type analysis result data is a newly registered website or a nearly expired website, collect the visit website web page interface feature image data, use the data recognition algorithm to match the visit website web page interface feature image data with the website's legitimate web page interface feature image data, and construct the visit website web page interface legitimacy analysis data based on the website's web page interface feature image matching results as follows:

[0116] S61. When the visited website registration time type analysis result data P is a newly registered website or a nearly expired website, the visited website network domain name data I is input into the website search platform to enter the website interface of the visited website, intercept and collect the web page interface feature image of the visited website and establish the visited website web page interface feature image data set B = (b1, ..., b n ,…,b θ ), n=1,2,3,…,θ; where b n represents the collection of the nth characteristic image data of the web page interface of the visited website, θ represents the maximum value of the number of characteristic image data of the web page interface of the visited website, and the website search platform includes any one of the Baidu search platform, the Google search platform, the 360 ​​search platform, and the Sogou search platform;

[0117] S62. Establishing the website's legal web page interface feature image data where b' m Indicates the website's legal domain name data a m The characteristic image data of the legitimate web page interface of the corresponding website;

[0118] S63, using a data recognition algorithm to identify the visited website web page interface feature image data set B. nThe legitimate web page interface feature image data b' of the website in the legitimate web page interface feature image data set B' m The specific steps of performing feature image matching on the web page interface of the website and the data recognition algorithm for performing feature image matching on the web page interface are as follows:

[0119] S631, Parameter initialization: Identify bat population size on web interface Maximum number of iterations K, objective function f(X), web interface to identify the position of bat individual i and speed α i , sound wave frequency β i , sound wave loudness χ i Sum frequency δ i ;

[0120] S632, find out the optimal web page interface recognition bat position w in the current web page interface recognition bat population * , that is, the web page interface recognizes the bat population and searches for the characteristic image data b of the visited website web page interface in the search space of the legal website web page interface characteristic image data set B′ n The most matching website legitimate web page interface feature image data b' m The speed and position are updated according to the following formulas:

[0121]

[0122] in represents the speed of web page interface recognition bat individual i in the search space of the website legal web page interface feature image data set B′ after k+1 iterations, It represents the speed of web page interface recognition bat individual i in the search space of the website legal web page interface feature image data set B′ after k iterations; It represents the position of bat individual i in the search space of the website’s legal web interface feature image data set B′ after k iterations. It represents the position of web page interface recognition bat individual i in the search space of the website's legal web page interface feature image data set B′ after k+1 iterations; It represents the sound wave loudness of bat individual i in the search space of the website’s legal web interface feature image data set B′ after k+1 iterations. It represents the sound wave loudness of bat individual i in the search space of the website's legal web interface feature image data set B′ after k iterations; represents the frequency of web page interface recognition bat individual i in the search space of the website's legal web page interface feature image data set B′ after k+1 iterations, represents the initial frequency of bat individual i in the search space of the legal web interface feature image data set B' after k iterations; exp represents a random function with values ​​(-∞, +∞), ψ and l are constants and 0﹤ψ﹤1, l>0;

[0123] S633, generate a random number rand1, rand1 is a random number in the interval [0,1], when rand1>δ i , select an optimal web page interface identification bat individual from the optimal web page interface identification bat individual, that is, search for the web page interface feature image data b of the visited website in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m , and then select the optimal web page interface to identify the vicinity of the bat individual, through the formula exp→∞ generates a local solution, that is, searching for the feature image data b of the visited website web page interface in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m , otherwise according to the formula, Update the web page interface to identify the bat position, that is, update the searched feature image data b of the visited website web page interface in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m location;

[0124] S634, generate another random number rand2, rand2 is a random number on [0,1]; when rand2<χ i , and the fitness of the objective function f(X) is better than the new solution in S633, that is, the solution found in the search space of the website legal web page interface feature image data set B′ that is consistent with the visited website web page interface feature image data b n Matching website legitimate web page interface feature image data b' m The fitness is better than the website legal web page interface feature image data b' matched in S633 m , then accept the website's legal web page interface feature image data b' m The position of the search space in the website's legal web page interface feature image data set B' is updated, and the position update formula is as follows: new =w old +ε×χ i , Adjust χ i and δ i ; where w newrepresents the new position of bat individual i in the search space of the website’s legal web interface feature image data set B′, w old represents the old position of bat individual i in the search space of the website’s legal web interface feature image data set B′, and ε is an arbitrary number in the interval [-1,1];

[0125] S635, sort the fitness values ​​of all individuals in the bat population identified by the web page interface, and find the current best w * , that is, the searched data in the search space of the legitimate web page interface feature image data set B′ of the website is related to the visited website web page interface feature image data b n The most matching website legitimate web page interface feature image data b' m location;

[0126] S636, repeat S632 to S635, and when the maximum number of iterations K is met, output b n With b' m Perform feature image matching results of the website's web page interface;

[0127] S64, constructing the legitimacy analysis data R of the visited website web page interface according to the result of the web page interface feature image matching of the website in step S636;

[0128] When b n With b' m If the website's web page interface feature image matching is successful, it means that the newly registered website or the expired website's web page interface is in compliance with the legal web page interface, then the legality analysis data R of the visited website's web page interface is outputted, indicating that the visited website's web page interface is legal;

[0129] When b n With b' m If the characteristic image of the website's web page interface is not matched successfully, it means that the web page interface of the newly registered website or the expiring website does not meet the legal web page interface, then the legality analysis data R of the accessed website's web page interface is output as the accessed website's web page interface is illegal.

[0130] Through the cooperation between the website registration time and end time collection unit, the website access execution time collection unit, and the website registration time and end time measurement unit, the registration time point parameters of the website access, the end time point parameters of the financial institution website access, and the registration time period and end time period parameters of the website access are accurately obtained, so as to provide data support for the subsequent accurate analysis of the registration time type of the website access, and improve the scientificity and effectiveness of the financial institution website in identifying counterfeit websites; the website access registration time threshold and end time threshold storage unit cooperate with the website access registration time type analysis unit, and use the intelligent search algorithm to combine the website access registration time period parameters with the website access new registration time period threshold, the website access end time period parameters with the website access expiration end time period threshold for the website access. By comparing the numerical values ​​of time periods, it is possible to independently and accurately analyze the registration time type of the visited website, thereby improving the accuracy of the fraud risk analysis of the financial institution's website on counterfeit websites; the visited website web interface feature image acquisition unit and the visited website web interface legitimacy analysis unit cooperate with each other to obtain the visited website web interface feature image parameters online and combine the intelligent recognition algorithm with the preset website legal web interface feature image parameters to analyze and construct the visited website web interface legitimacy analysis results, thereby realizing intelligent legal evaluation of the web interface of newly registered or expiring visited websites, thereby improving the scientific nature of the financial institution's website's fraud risk assessment results on counterfeit websites; the visited website fraud risk assessment unit accurately generates the visited website fraud risk assessment parameters, thereby realizing standardized and efficient fraud risk assessment of visited websites, thereby improving the intelligence of the financial institution's website and the accuracy of risk identification.

[0131] For further information, see Figure 1 - Figure 2 , based on the legitimacy analysis result data of the domain name of the visited website, the registration time type analysis result data of the visited website, and the legitimacy analysis data of the web page interface of the visited website, the fraud risk assessment data of the visited website is performed, and the fraud risk assessment data of the visited website is generated; the fraud risk assessment data of the visited website is obtained and a user prompt operation is performed on the visited website with fraud risk; the network domain name data of the visited website corresponding to the visited website with fraud risk, the characteristic image data of the web page interface of the visited website, and the fraud risk assessment data of the visited website are pushed and fed back to the network security supervision platform. The operation steps are as follows:

[0132] S71. Analyze the results of the domain name legitimacy of the visited website A yuming , perform fraud risk assessment of the visited website based on the visit website registration time type analysis result data P and the visit website web page interface legitimacy analysis data R, and generate the visit website fraud risk assessment data G;

[0133] When accessing the website domain name legitimacy analysis result data Ayuming If it is illegal, the fraud risk assessment data G for visiting the website is outputted, indicating that there is a fraud risk in visiting the website;

[0134] When accessing the website domain name legitimacy analysis result data A yuming If the website is legitimate and the visit website registration time type analysis result data P is a normal website, the output visit website fraud risk assessment data G is that the visit website does not have a fraud risk;

[0135] When accessing the website domain name legitimacy analysis result data A yuming If the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is a legal access website web page interface, then the output access website fraud risk assessment data G is that there is no fraud risk in the access website;

[0136] When accessing the website domain name legitimacy analysis result data A yuming If the access website is legal and the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk;

[0137] When accessing the website domain name legitimacy analysis result data A yuming If the access website is legal and the registration time type analysis result data P is an expiring website and the access website web page interface legitimacy analysis data R is that the access website web page interface is legal, then the output access website fraud risk assessment data G is that there is no fraud risk for the access website;

[0138] When accessing the website domain name legitimacy analysis result data A yuming If the access website is legal and the access website registration time type analysis result data P is an expiring website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk;

[0139] S72, obtaining the website visit fraud risk assessment data G;

[0140] S73. When the fraud risk assessment data G for visiting a website indicates that there is a fraud risk for visiting the website, the fraud risk assessment data G for visiting the website is pushed through the mobile communication network and the user is prompted; at the same time, the network domain name data I of the visited website, the characteristic image data set B of the visited website web page interface and the fraud risk assessment data G for visiting the website are pushed and fed back to the network security supervision platform through the mobile communication network.

[0141] Through the website fraud risk user prompt unit, the website with fraud risk is intelligently identified based on the website fraud risk assessment parameters and the user is promptly prompted, thereby improving the reliability and applicability of the financial institution's website and reducing the user's property loss; the website fraud risk feedback unit promptly feeds back the website with fraud risk to the network security supervision platform, realizes intelligent feedback of counterfeit websites with fraud risk, improves the security and reliability of the financial institution's website network environment, and improves the fraud risk identification effect and efficiency of the counterfeit website fraud risk management system of the financial institution's website.

[0142] The fake website fraud risk management system based on big data that implements the fake website fraud risk management method includes a visit website legitimacy identification management module, a visit website fraud risk analysis management module, and a visit website fraud risk feedback management module;

[0143] The access website legitimacy identification management module includes a access website network domain name collection unit, a website legal network domain name storage unit, and a access website domain name legitimacy analysis unit;

[0144] A visiting website network domain name collection unit is used to collect visiting website network domain name data through a data collector; a website legal network domain name storage unit is used to store the website legal network domain name data; a visiting website domain name legality analysis unit is used to use a data search algorithm to compare the visiting website network domain name data with the website legal network domain name data to perform the website network domain name data feature comparison, and construct the visiting website domain name legality analysis result data based on the website network domain name data feature comparison result;

[0145] The website access fraud risk analysis management module includes a website access registration time and use end time collection unit, a website access execution access time collection unit, a website access registration time and use end time measurement unit, a website access registration time threshold and use end time threshold storage unit, a website access registration time type analysis unit, a website access web page interface feature image collection unit, a website legal web page interface feature image storage unit, a website access web page interface legitimacy analysis unit, and a website access fraud risk assessment unit;

[0146] A unit for collecting website registration time and end-of-use time, which collects website registration time data and website end-of-use time data through a data collector; a website execution access time collection unit, which collects website access to financial institution website time data through a data collector; a website registration duration and end-of-use time measurement unit, which generates website registration time period data and website end-of-use time period data based on website registration time point data, website end-of-use time point data, and website access to financial institution website time point data combined with a time period calculation formula; a website registration duration threshold and end-of-use duration threshold storage unit, which is used to store a website new registration time period threshold and a website near-expiry end-of-use time period threshold; a website registration time type analysis unit, which uses a data search algorithm to respectively compare website registration time period data with website new registration time period threshold, website end-of-use time period data with website near-expiry end-of-use time period threshold The value is used to perform numerical analysis on the registration time period data and the end time period data of the visited website, and construct and generate the analysis result data of the registration time type of the visited website; the visited website web page interface feature image acquisition unit is used to collect the visited website web page interface feature image data; the website legal web page interface feature image storage unit is used to store the website legal web page interface feature image data; the visited website web page interface legitimacy analysis unit is used to collect the visited website web page interface feature image data, and use the data recognition algorithm to match the visited website web page interface feature image data with the website legal web page interface feature image data to the website, and construct the visited website web page interface legitimacy analysis data based on the website web page interface feature image matching result; the visited website fraud risk assessment unit is used to conduct the visited website fraud risk assessment based on the visited website domain name legitimacy analysis result data, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and generate the visited website fraud risk assessment data;

[0147] The website fraud risk feedback management module includes a website fraud risk assessment result acquisition unit, a website fraud risk user prompt unit, and a website fraud risk feedback unit;

[0148] The access website fraud risk assessment result acquisition unit is used to obtain the access website fraud risk assessment data; the access website fraud risk user prompt unit performs user prompt operations for access websites with fraud risks based on the access website fraud risk assessment data; the access website fraud risk feedback unit pushes the access website network domain name data, access website web page interface feature image data and access website fraud risk assessment data corresponding to the access website with fraud risks to the network security supervision platform.

[0149] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for managing the risk of fraudulent websites, characterized in that: The method comprises the following steps: S1. Collect domain name data of visited websites; S2, using a data search algorithm to compare the network domain name data characteristics of the visited website with the legitimate network domain name data of the website, and constructing the legitimacy analysis result data of the visited website domain name based on the comparison result of the network domain name data characteristics of the website; S3. When the legitimacy analysis result data of the visited website domain name is legal, collect the registration time data of the visited website, the end time data of the visited website, and the time data of the visited website visiting the website of the financial institution; S4, generating website registration time period data and website usage end time period data based on the website registration time data, website usage end time data, and website access financial institution website access time data in combination with a time period calculation formula; S5, using a data search algorithm to perform numerical analysis on the registration time period data and the end-of-use time period data of the visited website, respectively, by comparing the visited website registration time period data with the visited website new registration time period threshold, the visited website use end time period data with the visited website near-expiry use end time period threshold, and construct and generate the visited website registration time type analysis result data; S6. When the visited website registration time type analysis result data is a newly registered website or an expired website, collect the visited website web page interface feature image data, use a data recognition algorithm to match the visited website web page interface feature image data with the website's legitimate web page interface feature image data, and construct the visited website web page interface legitimacy analysis data based on the website's web page interface feature image matching result; S7. Perform fraud risk assessment on the visited website based on the visited website domain name legitimacy analysis result data, the visited website registration time type analysis result data and the visited website web page interface legitimacy analysis data, and generate visited website fraud risk assessment data; obtain the visited website fraud risk assessment data and perform user prompt operations on visited websites with fraud risks; push the visited website network domain name data, the visited website web page interface feature image data and the visited website fraud risk assessment data corresponding to the visited website with fraud risks to the network security supervision platform.

2. The method for managing fake website fraud risk according to claim 1, characterized in that: The S1 comprises the following steps: S11. The website of the financial institution collects the network domain names of the visited websites online through a data collector and generates the network domain name data I of the visited websites. The data collector includes any one of an API interface and a log file.

3. The method for managing fake website fraud risk according to claim 2, characterized in that: The S2 comprises the following steps: S21. Establish a data set of legal domain names for websites where a m Represents the legitimate domain name data of the mth website, Indicates the maximum number of legal domain name data of the website; S22, using a bidirectional search algorithm to compare the visited website network domain name data I with the website legal network domain name data a in the website legal network domain name data set A. m Compare the characteristics of the website's network domain name data to construct the legitimacy analysis result data A of the visited website domain name yuming ; When the network domain name data feature comparison between I and A is successful, it means that the visited website has been legally registered and filed, and the legality analysis result data of the visited website domain name A is output yuming To be legal; When the domain name data feature comparison between I and A fails, it means that the accessed website has not been legally registered and filed, and the domain name legitimacy analysis result data A of the accessed website is output. yuming Is illegal.

4. The method for managing the risk of counterfeit website fraud according to claim 3, characterized in that: The S3 comprises the following steps: S31, when the domain name of the visited website is legitimate, the result data A yuming When it is legal, the website of the financial institution is used to collect the registration time of the website through the data collector online and generate the registration time data of the website. zhuce , where the time point is mainly composed of year, month and day, and the access website registration time point data represents the time point when the access website is registered on the legal server operator platform; The end time point of the use of the visited website is collected online through the website of the financial institution through the data collector, and the end time point data of the use of the visited website is generated. jieshu , the access website use end time point data indicates the time point when the access website ends use after registration on the legal server operator platform; The time point of the visit website to the financial institution website is collected online through the data collector through the financial institution website, and the time point data of the visit website to the financial institution website is generated. fangwen The data of the time point when the website visits the website of the financial institution indicates the time point when the website visits the website of the financial institution.

5. The method for managing fake website fraud risk according to claim 4, characterized in that: The S4 comprises the following steps: S41, obtaining the registration time point data t of the visited website zhuce , the end time point data of the visited website jieshu , the time point data of the visited website visiting the website of the financial institution t fangwen ; S42, according to the website access registration time point data t zhuce and the time point data of the website visited to the website of the financial institution t fangwen Combined with the time interval calculation formula, the registration time period data Δt of the visited website is calculated. zhuce =t fangwen -t zhuce , Δt zhuce The unit is day; According to the data of the end time point of the visited website use t jieshu , the time point data of the visited website visiting the website of the financial institution t fangwen Combined with the time interval calculation formula, the end time period data Δt of the visited website is calculated. jieshu =t fangwen -t jieshu , Δt jieshu The unit is day.

6. The method for managing fake website fraud risk according to claim 5, characterized in that: The S5 comprises the following steps: S51. Establish a threshold value S for a new registration time period for visiting a website zhuce , the threshold value of the newly registered time period for visiting a website represents the maximum value of the newly registered time period for visiting a website to visit a financial institution platform; Establish a threshold S for the time period when the website is about to expire jieshu The threshold of the time period for the website to be used immediately before expiration indicates the maximum value of the time period for the website to be used immediately before expiration when the website visits the financial institution platform, and the website to be used immediately before expiration indicates that the time period for the website to be used immediately before expiration is not greater than the threshold of the time period for the website to be used immediately before expiration; S52, using a bidirectional search algorithm to respectively search the website visit registration time period data Δt zhuce The threshold value S for the new registration period for visiting the website zhuce , the access website uses the end time period data Δt jieshu The threshold value S of the time period when the access website is about to expire jieshu Perform numerical analysis on the registration time period data and the end time period data of the website access, and construct and generate the website access registration time type analysis result data P; When Δt zhuce >S zhuce And Δt jieshu >S jieshu , indicating that the visited website is neither a newly registered website nor an expired website, then the output visited website registration time type analysis result data P is a normal website; When Δt zhuce ≤S zhuce , indicating that the visited website is a newly registered website, then the output visit website registration time type analysis result data P is a newly registered website; When Δt jieshu ≤S jieshu , indicating that the visited website is a expiring website, then the output visited website registration time type analysis result data P is an expiring website.

7. The method for managing the risk of counterfeit website fraud according to claim 6, characterized in that: The S6 comprises the following steps: S61. When the visited website registration time type analysis result data P is a newly registered website or a nearly expired website, the visited website network domain name data I is input into the website search platform to enter the website interface of the visited website, intercept and collect the web page interface feature image of the visited website and establish the visited website web page interface feature image data set B = (b1, ..., b n ,…,b θ ), n=1,2,3,…,θ; where b n represents the collection of the nth characteristic image data of the web page interface of the visited website, θ represents the maximum value of the number of characteristic image data of the web page interface of the visited website, and the website search platform includes any one of the Baidu search platform, the Google search platform, the 360 ​​search platform, and the Sogou search platform; S62. Establishing the website's legal web page interface feature image data where b' m Indicates the website's legal domain name data a m The characteristic image data of the legitimate web page interface of the corresponding website; S63, using a data recognition algorithm to identify the visited website web page interface feature image data set B. n The legitimate web page interface feature image data b' of the website in the legitimate web page interface feature image data set B' m The specific steps of performing feature image matching on the web page interface of the website and the data recognition algorithm for performing feature image matching on the web page interface are as follows: S631, Parameter initialization: Identify bat population size on web interface Maximum number of iterations K, objective function f(X), web interface to identify the position of bat individual i and speed α i , sound wave frequency β i , sound wave loudness χ i Sum frequency δ i ; S632, find out the optimal web page interface recognition bat position w in the current web page interface recognition bat population * , that is, the web page interface recognizes the bat population and searches for the characteristic image data b of the visited website web page interface in the search space of the legal website web page interface characteristic image data set B′ n The most matching website legitimate web page interface feature image data b' m The position of and updates the speed and position; S633, generate a random number rand1, rand1 is a random number in the interval [0,1], when rand1>δ i , select an optimal web page interface identification bat individual from the optimal web page interface identification bat individual, that is, search for the web page interface feature image data b of the visited website in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m , update the web page interface to identify the bat position, that is, update the searched feature image data b of the visited website web page interface in the search space of the website legal web page interface feature image data set B′ n The most matching website legitimate web page interface feature image data b' m location; S634, generate another random number rand2, rand2 is a random number on [0,1]; when rand2<χ i , and the fitness of the objective function f(X) is better than the new solution in S633, that is, the solution found in the search space of the website legal web page interface feature image data set B′ that is consistent with the visited website web page interface feature image data b n Matching website legitimate web page interface feature image data b' m The fitness is better than the website legal web page interface feature image data b' matched in S633 m , then accept the website's legal web page interface feature image data b' m Search the location of the space in the website's legal web page interface feature image data set B' and update the location; S635, sort the fitness values ​​of all individuals in the bat population identified by the web page interface, and find the current best w * , that is, the searched data in the search space of the legitimate web page interface feature image data set B′ of the website is related to the visited website web page interface feature image data b n The most matching website legitimate web page interface feature image data b' m location; S636, repeat S632 to S635, and when the maximum number of iterations K is met, output b n With b' m Perform feature image matching results of the website's web page interface; S64, constructing the legitimacy analysis data R of the visited website web page interface according to the result of the web page interface feature image matching of the website in step S636; When b n With b' m If the website's web page interface feature image matching is successful, it means that the newly registered website or the expired website's web page interface is in compliance with the legal web page interface, then the legality analysis data R of the visited website's web page interface is outputted, indicating that the visited website's web page interface is legal; When b n With b' m If the characteristic image of the website's web page interface is not matched successfully, it means that the web page interface of the newly registered website or the expiring website does not meet the legal web page interface, then the legality analysis data R of the accessed website's web page interface is output as the accessed website's web page interface is illegal.

8. The method for managing fake website fraud risk according to claim 7, characterized in that: The S7 comprises the following steps: S71, based on the legitimacy analysis result data A of the visited website domain name yuming , performing fraud risk assessment of the visited website based on the visited website registration time type analysis result data P and the visited website webpage interface legitimacy analysis data R, and generating visited website fraud risk assessment data G; When the domain name legitimacy analysis result data A of the visited website yuming If it is illegal, the fraud risk assessment data G for visiting the website is outputted, indicating that there is a fraud risk in visiting the website; When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legitimate and the access website registration time type analysis result data P is a normal website, the output access website fraud risk assessment data G is that the access website does not have a fraud risk; When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is that the access website web page interface is legal, then the output access website fraud risk assessment data G is that the access website does not have a fraud risk; When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is a newly registered website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk; When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is an expired website and the access website web page interface legitimacy analysis data R is that the access website web page interface is legal, then the output access website fraud risk assessment data G is that the access website does not have a fraud risk; When the domain name legitimacy analysis result data A of the visited website yuming If the access website is legal and the access website registration time type analysis result data P is an expired website and the access website web page interface legitimacy analysis data R is that the access website web page interface is illegal, then the output access website fraud risk assessment data G is that the access website has a fraud risk; S72, obtaining the website visit fraud risk assessment data G; S73. When the visited website fraud risk assessment data G indicates that the visited website has a fraud risk, the visited website fraud risk assessment data G is pushed through the mobile communication network and the user is prompted; at the same time, the visited website network domain name data I, the visited website web page interface feature image data set B and the visited website fraud risk assessment data G are pushed and fed back to the network security supervision platform through the mobile communication network.

9. A big data-based counterfeit website fraud risk management system that implements the counterfeit website fraud risk management method as described in any one of claims 1 to 8, characterized in that: The system comprises a website visit legitimacy identification management module, a website visit fraud risk analysis management module, and a website visit fraud risk feedback management module.

Images