Fraud investigation website intermediate page detection method and electronic device

Abstract

The present disclosure provides a method for detecting scam website middle pages and an electronic device, the method comprising: obtaining a webpage address and constructing a sample library based on the webpage address; extracting features of samples in the sample library to obtain target features; using the target features as training samples to iteratively train a convolutional neural network and obtain performance information of the neural network after each iteration; performing back propagation on the performance information of the neural network to update parameters of the convolutional neural network and save gradient values of the back propagation; wherein the performance information of the neural network is the accuracy of detecting scam website middle pages; in response to determining that the trained convolutional neural network meets a preset convergence condition, stopping updating the parameters of the convolutional neural network and outputting a model for detecting scam website middle pages. The present application can mark and detect that a user is diverted or jumped to a middle page of a scam website, thereby addressing the problem of network fraud under a complex network.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a method and electronic device for detecting intermediate pages of fraudulent websites. Background Technology

[0002] In recent years, with the popularization of the Internet and mobile communications, and the continuous development of network technology, people's daily lives have become closely connected with the Internet, and fraudsters' methods are also constantly being innovated and upgraded.

[0003] Among related technologies, online fraud is characterized by diverse methods, rapid spread, high concealment, and a wide range of victims. To increase the concealment of fraudulent platforms, scammers employ various intermediate redirect pages, navigation pages, and anti-blocking pages, making the detection and identification of these fraudulent websites more difficult. Intermediate pages are often deceptive and misleading, making them difficult for ordinary users to detect, thus posing challenges to network security monitoring. Summary of the Invention

[0004] This disclosure provides a method and electronic device for detecting intermediate pages of fraudulent websites, in order to at least solve the above-mentioned technical problems existing in the prior art.

[0005] According to a first aspect of this disclosure, a method for detecting intermediate pages on fraudulent websites is provided, the method comprising:

[0006] Obtain the webpage address, and construct a sample library based on the webpage address;

[0007] Feature extraction is performed on samples in the sample library to obtain target features;

[0008] The target features are used as training samples to iteratively train the convolutional neural network and obtain the performance information of the neural network after each iteration. The performance information of the neural network is backpropagated to update the parameters of the convolutional neural network and the gradient values ​​of the backpropagation are saved. The performance information of the neural network is the accuracy of detecting the intermediate page of the fraudulent website.

[0009] In response to the determination that the trained convolutional neural network meets the preset convergence condition, the parameters of the convolutional neural network are stopped from being updated, and the fraudulent website intermediate page detection model is output.

[0010] In one possible implementation, before the trained convolutional neural network satisfies a preset convergence condition, the method further includes:

[0011] In response to the determination that the number of saved gradient values ​​has reached a preset number, the saved gradient values ​​are uniformized, and the result of the uniformization is used as the gradient value for backpropagation in the current iteration operation to update the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model.

[0012] In one possible implementation, obtaining the webpage address includes:

[0013] Extract Uniform Resource Locator (URL) data from the Internet access log table;

[0014] The URL data is validated using regular expressions to remove irregular and erroneous URLs, resulting in the first URL data.

[0015] The first URL data is deduplicated to obtain the second URL data;

[0016] Extract the main domain name from the second URL data to obtain the third URL data;

[0017] The third URL data is filtered using a preset filing information database to remove URLs that are filed in the filing information database, thus obtaining the webpage address.

[0018] In one possible implementation, obtaining the sample library based on the webpage address includes:

[0019] Web page data is crawled based on the web page address; the web page data includes web page information and screenshot information;

[0020] Preset code is injected and executed into the webpage information to determine the dynamic information of clickable elements in the webpage information;

[0021] Identify the image in the dynamic information, perform text recognition on the image, and replace the recognized text with a button to obtain the source code to be processed;

[0022] The source code to be processed is preprocessed to obtain the source code;

[0023] By comparing the source code and screenshots, the navigation page, intermediate redirect pages, and anti-blocking pages of the fraudulent website can be identified based on the comparison results.

[0024] A sample library was constructed based on the navigation pages, intermediate redirect pages, and anti-blocking pages of the fraudulent websites.

[0025] In one implementation, each sample includes URL data and source code; the step of extracting features from the samples in the sample library to obtain target features includes:

[0026] Extract the first preset number of characters from the URL data, map the preset number of characters to a vector of preset length, and obtain the character vector features;

[0027] The parser is used to analyze the structure of the source code to obtain multiple tag features;

[0028] The text content corresponding to the source code tag features is segmented into words, a vocabulary is constructed, and the words in the vocabulary are mapped to a high-dimensional vector space to obtain word vector features;

[0029] The character vector features, tag features, and word vector features are used as target features.

[0030] In one possible implementation, the preset convergence condition includes at least one of the following: the parameter update rate of the convolutional neural network is lower than a preset threshold, the performance information of the trained neural network meets a preset performance constraint, and the number of iterations performed reaches a preset number threshold.

[0031] In one possible implementation, it further includes:

[0032] New target features of fraudulent websites are extracted as input samples for the fraudulent website intermediate page detection model to update the parameters of the model and obtain an optimized model.

[0033] In one possible implementation, the step of segmenting the text content corresponding to the source code tag features includes:

[0034] Determine the number of words to be segmented under each tag;

[0035] Determine whether the number of words under each tag exceeds the preset number. If it does, discard the words that exceed the preset number; otherwise, fill the word count with spaces to make the word count reach the preset number.

[0036] In one possible implementation, the preprocessing of the source code to be processed to obtain the source code includes:

[0037] The source code to be processed is first cleaned using the pre-acquired invalid source code to remove invalid website source code;

[0038] The source code to be processed after the first cleaning is cleaned a second time using the pre-acquired normal website source code, in order to obtain the source code of the fraudulent website.

[0039] According to a second aspect of this disclosure, a device for detecting intermediate pages of fraudulent websites is provided, the device comprising:

[0040] The acquisition module is used to acquire web page addresses and construct a sample library based on the web page addresses.

[0041] The extraction module is used to extract features from samples in the sample library to obtain target features;

[0042] The training module is used to iteratively train the convolutional neural network using the target features as training samples and obtain the performance information of the neural network after each iteration. The performance information of the neural network is backpropagated to update the parameters of the convolutional neural network, and the gradient values ​​of the backpropagation are saved. The performance information of the neural network is the accuracy of detecting the intermediate pages of fraudulent websites.

[0043] The output module is used to stop updating the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model in response to determining that the trained convolutional neural network meets the preset convergence condition.

[0044] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0045] At least one processor; and

[0046] A memory communicatively connected to the at least one processor; wherein,

[0047] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the methods described in this disclosure.

[0048] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the methods described in this disclosure.

[0049] This disclosure discloses a method and electronic device for detecting intermediate pages on fraudulent websites. The application constructs a sample library using web page addresses, extracts target features, trains a convolutional neural network using these features, and optimizes the network parameters using backpropagation to obtain a model for detecting intermediate pages on fraudulent websites. By analyzing web page structure and content, it effectively identifies fraudulent URLs and their referral pages, anti-blocking pages, and redirect pages. Based on the identification results, it determines whether further in-depth analysis is needed. This improves the efficiency and speed of analysis while making the identification of fraudulent websites more accurate. This application can also mark and detect intermediate pages where users are redirected or redirected to fraudulent websites, thus addressing the problem of online fraud in complex networks. The technical solution provided by this application not only improves network security but also provides users with a more reliable network environment, offering strong support for combating online fraud crimes.

[0050] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0051] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0052] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0053] Figure 1 This illustration shows the implementation flow of the method for detecting intermediate pages of fraudulent websites according to an embodiment of this disclosure. Figure 1 ;

[0054] Figure 2 This illustration shows the implementation flow of the method for detecting intermediate pages of fraudulent websites according to an embodiment of this disclosure. Figure 2 ;

[0055] Figure 3 A schematic diagram of the structure of the fraudulent website intermediate page detection device according to an embodiment of this disclosure is shown;

[0056] Figure 4 A schematic diagram of the composition structure of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0057] To make the objectives, features, and advantages of this disclosure more apparent and understandable, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0058] The following describes, with reference to the accompanying drawings, the method and electronic device for detecting intermediate pages of fraudulent websites provided in this application.

[0059] like Figure 1 As shown in the embodiment of this application, a method for detecting intermediate pages of fraudulent websites is provided. The method includes:

[0060] S101, Obtain the webpage address, and construct a sample library based on the webpage address;

[0061] This application first obtains the webpage address: the Uniform Resource Locator (URL), also known as the webpage address, is the standard address of a resource on the Internet. Every file on the Internet has a unique URL, which contains information indicating the file's location and how the browser should handle it. Then, a sample library is built based on these webpage addresses.

[0062] S102, extract features from the samples in the sample library to obtain target features;

[0063] It is understandable that the sample library stores multiple samples, and then features are extracted from multiple samples to obtain target features, which are then used to train the neural network.

[0064] S103, the target features are used as training samples to iteratively train the convolutional neural network and obtain the performance information of the neural network after each iteration. The performance information of the neural network is backpropagated to update the parameters of the convolutional neural network, and the gradient value of the backpropagation is saved; wherein, the performance information of the neural network is the accuracy of detecting the intermediate page of the fraudulent website.

[0065] It should be noted that this application employs deep learning algorithms for model training, using a Convolutional Neural Network (CNN) to automatically discover features, deriving the hyperparameters of each hidden layer through backpropagation, using the ReLU activation function for convergence, and employing a 4x4 convolutional kernel. Understandably, this application uses a Convolutional Neural Network (CNN) to train the model, accelerating the judgment speed and improving accuracy. Figure 2 As shown, the CNN convolutional network provided in this application includes an input layer, a hidden layer, and an output layer.

[0066] S104, in response to determining that the trained convolutional neural network meets the preset convergence condition, stop updating the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model.

[0067] This application pre-sets a convergence condition. After the convolutional neural network reaches the convergence condition, the parameters of the convolutional neural network are stopped from being updated, thereby obtaining a detection model for intermediate pages of fraudulent websites.

[0068] The method for detecting fraudulent website intermediary pages provided in this application improves network security, provides users with a more reliable network environment, and offers strong support for combating online fraud crimes.

[0069] In some alternative embodiments, before the trained convolutional neural network satisfies a preset convergence condition, the method further includes:

[0070] In response to the determination that the number of saved gradient values ​​has reached a preset number, the saved gradient values ​​are uniformized, and the result of the uniformization is used as the gradient value for backpropagation in the current iteration operation to update the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model.

[0071] Understandably, this application employs deep learning algorithms for model training, uses convolutional neural networks (CNNs) to automatically discover features, and uses backpropagation algorithms to derive the hyperparameters of each hidden layer, making the resulting fraudulent website intermediate page detection model more accurate in identifying fraudulent websites.

[0072] In some optional embodiments, obtaining the webpage address includes:

[0073] Extract Uniform Resource Locator (URL) data from the Internet access log table;

[0074] The URL data is validated using regular expressions to remove irregular and erroneous URLs, resulting in the first URL data.

[0075] The first URL data is deduplicated to obtain the second URL data;

[0076] Extract the main domain name from the second URL data to obtain the third URL data;

[0077] The third URL data is filtered using a preset filing information database to remove URLs that are filed in the filing information database, thus obtaining the webpage address.

[0078] Specifically, this application first extracts the URL field from the user's internet browsing log table, then uses regular expressions to validate the URL data, removing irregular and erroneous URLs, and deduplicating the processed URLs. Next, the URLs are cleaned, the main domain name of the websites in question is extracted, and a whitelist is applied. Then, an ICP filing information database is used for matching, and the whitelist-filtered URLs are cleaned a second time to remove URLs with ICP filings, thus obtaining the webpage addresses. In summary, this application extracts the dynamic and static characteristics of webpages by cleaning and filtering the URL data from the original internet browsing logs.

[0079] In some optional embodiments, obtaining the sample library based on the webpage address includes:

[0080] Web page data is crawled based on the web page address; the web page data includes web page information and screenshot information;

[0081] Preset code is injected and executed into the webpage information to determine the dynamic information of clickable elements in the webpage information;

[0082] Identify the image in the dynamic information, perform text recognition on the image, and replace the recognized text with a button to obtain the source code to be processed;

[0083] The source code to be processed is preprocessed to obtain the source code;

[0084] By comparing the source code and screenshots, the navigation page, intermediate redirect pages, and anti-blocking pages of the fraudulent website can be identified based on the comparison results.

[0085] A sample library was constructed based on the navigation pages, intermediate redirect pages, and anti-blocking pages of the fraudulent websites.

[0086] In some optional embodiments, the preprocessing of the source code to be processed to obtain the source code includes:

[0087] The source code to be processed is first cleaned using the pre-acquired invalid source code to remove invalid website source code;

[0088] The source code to be processed after the first cleaning is cleaned a second time using the pre-acquired normal website source code, in order to obtain the source code of the fraudulent website.

[0089] Specifically, this application uses an automated program to call a browser to crawl website data, saving static information such as URLs and screenshots. Then, it injects and executes JavaScript code into the webpage, saving dynamic information such as the number of clickable elements, the position and size of each element on the page. It identifies images or canvas tags in the dynamic information. For images or canvas tags used in the URL, it uses the open-source Python pytesseract library for OCR recognition. For OCR-recognized text, it replaces the text with a button and backfills the OCR-recognized text into the tag, obtaining the initial source code to be processed. The crawled source code is then cleaned to obtain the final source code. Finally, the source code and screenshot information are manually analyzed, and navigation pages, intermediate redirect pages, and anti-blocking pages of fraudulent websites are used as a sample library for feature extraction.

[0090] In this application, the source code to be processed is preprocessed, specifically by using historically accumulated invalid source code samples to clean up invalid website source code, and using historically accumulated normal website source code samples to further clean the website source code.

[0091] In some optional embodiments, each sample includes URL data and source code; the step of extracting features from the samples in the sample library to obtain target features includes:

[0092] Extract the first preset number of characters from the URL data, map the preset number of characters to a vector of preset length, and obtain the character vector features;

[0093] The parser is used to analyze the structure of the source code to obtain multiple tag features;

[0094] The text content corresponding to the source code tag features is segmented into words, a vocabulary is constructed, and the words in the vocabulary are mapped to a high-dimensional vector space to obtain word vector features;

[0095] The character vector features, tag features, and word vector features are used as target features.

[0096] In some optional embodiments, the step of segmenting the text content corresponding to the source code tag features includes:

[0097] Determine the number of words to be segmented under each tag;

[0098] Determine whether the number of words under each tag exceeds the preset number. If it does, discard the words that exceed the preset number; otherwise, fill the word count with spaces to make the word count reach the preset number.

[0099] Specifically, this application targets three features: First, the first 150 characters of the URL are extracted, and One-Hot encoding is used to map each character of the URL into a fixed-length vector, where only one element is 1 and the rest are 0. For characters shorter than 150, a vector of all zeros is used. Second, an HTML parser (such as BeautifulSoup) is used to parse the DOM tree structure of the webpage. Then, structured information such as the number of tags of each type, tag nesting depth, tag position, and tag size can be extracted as features. Third, this application uses the open-source library Stanford CoreNLP to segment the text content, constructing a vocabulary where each word corresponds to a unique index. The Word2Vec word embedding model is used to map the words into a high-dimensional vector space. The text in each tag of the webpage is segmented, and the portion of a single tag with more than 8 words is discarded. The vectors of the first 50 words in the page are taken as features, and blanks are used to pad the remaining vectors.

[0100] In some optional embodiments, the preset convergence condition includes at least one of the following: the parameter update rate of the convolutional neural network is lower than a preset threshold, the performance information of the trained neural network meets the preset performance constraints, and the number of iterations performed reaches a preset number threshold.

[0101] In some optional embodiments, the method for detecting intermediate pages of fraudulent websites provided in this application further includes:

[0102] New target features of fraudulent websites are extracted as input samples for the fraudulent website intermediate page detection model to update the parameters of the model and obtain an optimized model.

[0103] This application employs deep learning algorithms for model training, using a Convolutional Neural Network (CNN) to automatically discover features. Backpropagation is used to derive the hyperparameters of each hidden layer, and ReLU activation is used for convergence. The CNN provided in this application uses a 4x4 convolutional kernel. The application first sets the training parameters; for example, the error is set to 1% for each iteration, and the learning rate is set to 0.001, ultimately obtaining a model for detecting intermediate pages of fraudulent websites.

[0104] It should be noted that with the iteration and advancement of technology, fraudsters' methods and means are constantly evolving, and the styles of fraudulent websites are also changing rapidly. Therefore, this application targets novel fraudulent web pages that cannot be identified, extracts page features, adds samples, retrains the model, and increases the model's recognition ability. Based on the performance of the fraudulent website intermediate page detection model in practical applications, the extracted web page features can be optimized, and the model can be improved. The optimization method in this application can optimize the model's activation function, convolution kernel, iteration error, etc., thereby enhancing the model's recognition ability.

[0105] As a specific embodiment, the process for identifying intermediate pages of fraudulent websites in this application is as follows:

[0106] (1) For the URLs that need to be detected and identified, use a crawler module to obtain static information such as webpage source code, images, and screenshots.

[0107] (2) Use JS injection to obtain dynamic information on the number of clickable elements on the webpage, as well as the position and size of each element on the page.

[0108] (3) Use OCR to recognize images and canvas elements. For cases where OCR recognizes text, replace it with a button and fill in the text recognized by OCR into the label.

[0109] (4) Extract feature data from the webpage to build the input data for the model. Use blanks to fill in when the URL length and number of words are insufficient, and discard directly when there are too many.

[0110] (5) Based on the model's output, identify whether the URL is an intermediate page, a referral page, or an anti-blocking page for fraudulent URLs.

[0111] The method for detecting intermediate pages of fraudulent websites provided in this application cleanses and filters URL data from raw internet browsing logs, extracts dynamic and static features of web pages, and trains a model using a convolutional neural network (CNN). This application extracts and analyzes the dynamic and static features of web pages, representing them as feature vectors, which are then input into the CNN model for training. The trained CNN model is used to determine whether a web page is a referral page, intermediate redirect page, or anti-blocking page of a fraudulent website. Using a CNN model significantly improves the speed and accuracy of the assessment. First, the CNN model can effectively learn the feature patterns of different types of web pages from massive amounts of web page data, thus identifying fraudulent websites more quickly. Second, the CNN model can automatically extract and learn web page features without requiring manual rule definition, reducing the cost and time of manual intervention. Furthermore, because the CNN model has high generalization ability, it can adapt to different types and styles of web pages to a certain extent, improving the accuracy and robustness of the assessment.

[0112] In summary, this application effectively improves the speed and accuracy of identifying fraudulent websites by cleaning and filtering URL data from raw internet browsing logs, extracting dynamic and static features of web pages, and training a model using a CNN convolutional neural network. This application not only helps identify more fraudulent websites but also reduces false positives and enhances the ability to prevent malicious websites.

[0113] like Figure 3 As shown, this application provides a device for detecting intermediate pages of fraudulent websites, the device comprising:

[0114] The acquisition module 301 is used to acquire web page addresses and construct a sample library based on the web page addresses.

[0115] Extraction module 302 is used to extract features from samples in the sample library to obtain target features;

[0116] The training module 303 is used to iteratively train the convolutional neural network using the target features as training samples and obtain the performance information of the neural network after each iteration, perform backpropagation on the performance information of the neural network to update the parameters of the convolutional neural network, and save the gradient values ​​of backpropagation; wherein, the performance information of the neural network is the accuracy of detecting the intermediate page of the fraudulent website.

[0117] The output module 304 is used to stop updating the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model in response to determining that the trained convolutional neural network meets the preset convergence condition.

[0118] In some alternative embodiments, it also includes:

[0119] An update module is used to perform a uniformization process on the saved gradient values ​​in response to determining that the number of saved gradient values ​​has reached a preset number. The result of the uniformization process is used as the gradient value for backpropagation in the current iteration operation to update the parameters of the convolutional neural network and output the fraudulent website intermediate page detection model.

[0120] In some optional embodiments, the acquisition module includes:

[0121] The first extraction unit is used to extract Uniform Resource Locator (URL) data from the Internet access log record table.

[0122] The first elimination unit is used to validate the URL data using regular expressions to eliminate irregular URLs and erroneous URLs in the URL data, thereby obtaining the first URL data;

[0123] The deduplication unit is used to deduplicatize the first URL data to obtain the second URL data.

[0124] The second extraction unit is used to extract the main domain name from the second URL data to obtain the third URL data;

[0125] The second filtering unit is used to filter the third URL data using a preset filing information database, and remove URL data that are filed in the filing information database from the third URL data to obtain the web page address.

[0126] In some optional embodiments, the acquisition module further includes:

[0127] A crawling unit is used to crawl web page data based on the web page address; the web page data includes web page information and screenshot information.

[0128] An execution unit is used to inject and execute preset code into the web page information to determine the dynamic information of clickable elements in the web page information;

[0129] The recognition unit is used to identify the image in the dynamic information, perform text recognition on the image, and replace the recognized text with a button to obtain the source code to be processed.

[0130] The preprocessing unit is used to preprocess the source code to be processed to obtain the source code.

[0131] The comparison unit is used to compare the source code and screenshot information, and determine the navigation page, intermediate redirect page and anti-blocking page of the fraudulent website based on the comparison results;

[0132] The construction unit is used to build a sample library based on the navigation page, intermediate redirect page, and anti-blocking page of the fraudulent website.

[0133] In some alternative embodiments, the extraction module includes:

[0134] The truncation unit is used to truncate the first preset number of characters in the URL data, map the preset number of characters into a vector of preset length, and obtain character vector features;

[0135] The parsing unit is used to parse the structure of the source code using the parser to obtain multiple tag features;

[0136] The word segmentation unit is used to segment the text content corresponding to the source code tag features, construct a vocabulary, and map the words in the vocabulary to a high-dimensional vector space to obtain word vector features.

[0137] The character vector features, tag features, and word vector features are used as target features.

[0138] In some optional embodiments, the preset convergence condition includes at least one of the following: the parameter update rate of the convolutional neural network is lower than a preset threshold, the performance information of the trained neural network meets the preset performance constraints, and the number of iterations performed reaches a preset number threshold.

[0139] In some alternative embodiments, it also includes:

[0140] New target features of fraudulent websites are extracted as input samples for the fraudulent website intermediate page detection model to update the parameters of the model and obtain an optimized model.

[0141] In some optional embodiments, the step of segmenting the text content corresponding to the source code tag features includes:

[0142] Determine the number of words to be segmented under each tag;

[0143] Determine whether the number of words under each tag exceeds the preset number. If it does, discard the words that exceed the preset number; otherwise, fill the word count with spaces to make the word count reach the preset number.

[0144] In some alternative embodiments, the preprocessing unit includes:

[0145] The first cleaning subunit is used to perform the first cleaning of the source code to be processed using the pre-acquired invalid source code, so as to remove invalid website source code.

[0146] The second cleaning subunit is used to perform a second cleaning on the source code to be processed after the first cleaning using the pre-acquired normal website source code, so as to obtain the source code of the fraudulent website.

[0147] According to embodiments of this disclosure, this disclosure also provides an electronic device and a readable storage medium.

[0148] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0149] like Figure 4 As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 402 or a computer program loaded from storage unit 408 into random access memory (RAM) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0150] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0151] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as the method for detecting intermediate pages of fraudulent websites. For example, in some embodiments, the method for detecting intermediate pages of fraudulent websites can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the method for detecting intermediate pages of fraudulent websites described above can be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform a method for detecting fraudulent website intermediary pages by any other suitable means (e.g., by means of firmware).

[0152] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0153] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0154] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0155] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0156] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0157] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0158] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0159] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise explicitly specified.

[0160] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A method for detecting a scam website middle page, characterized in that, The method comprises: obtaining a webpage address and obtaining a sample library based on the webpage address; extracting features of samples in the sample library to obtain target features; using the target features as training samples to iteratively train a convolutional neural network and obtain performance information of the neural network after each iteration, performing back propagation on the performance information of the neural network to update parameters of the convolutional neural network, and saving gradient values of the back propagation; wherein the performance information of the neural network is the accuracy of intermediate page detection of a fraudulent website; in response to determining that the trained convolutional neural network meets a preset convergence condition, stopping updating the parameters of the convolutional neural network and outputting an intermediate page detection model of a fraudulent website; the sample library based on the webpage address comprises: based on the webpage address, crawling webpage data; the webpage data comprises webpage information and screenshot information; injecting and executing a preset code in the webpage information to determine dynamic information of clickable elements in the webpage information; determining pictures in the dynamic information, performing text recognition on the pictures, and replacing the recognized text with buttons to obtain a source code to be processed; preprocessing the source code to be processed to obtain a source code; comparing the source code and the screenshot information, and determining a navigation page, an intermediate jump page and an anti-blocking page of a fraudulent website according to the comparison result; constructing a sample library based on the navigation page, the intermediate jump page and the anti-blocking page of the fraudulent website; each sample comprises URL data and a source code; the feature extraction of the samples in the sample library to obtain target features comprises: extracting the first preset number of characters in the URL data, mapping the preset number of characters to a vector of a preset length to obtain a character vector feature; using a parser to parse the structure of the source code to obtain a plurality of label features; performing word segmentation on the text content corresponding to the label features, constructing a vocabulary table, mapping the words in the vocabulary table to a high-dimensional vector space to obtain a word vector feature; the character vector feature, the label feature and the word vector feature are used as target features; the word segmentation on the text content corresponding to the label features of the source code comprises: determining the number of word segmentation under each label; judging whether the number of word segmentation under each label exceeds a preset number, if it exceeds, discarding the word segmentation exceeding the preset number; otherwise, filling the word segmentation with blanks to make the number of word segmentation reach the preset number; the preprocessing of the source code to be processed to obtain a source code comprises: using pre-acquired invalid source code to perform first cleaning on the source code to be processed to remove invalid website source code; using pre-acquired normal website source code to perform second cleaning on the source code to be processed after the first cleaning to obtain the source code of the fraudulent website.

2. The method of claim 1, wherein, before the trained convolutional neural network meets the preset convergence condition, further comprising: in response to determining that the number of saved gradient values reaches a preset number, performing uniformization processing on the saved gradient values, using the result of the uniformization processing as the gradient value of the back propagation in the current iteration operation to update the parameters of the convolutional neural network and output an intermediate page detection model of a fraudulent website.

3. The method of claim 1, wherein, The acquisition webpage address comprises: Extracting uniform resource locator (URL) data from the online log record table; Using regular check to eliminate irregular URLs and error URLs in the URL data to obtain first URL data; De-duplicating the first URL data to obtain second URL data; Extracting the main domain name from the second URL data to obtain third URL data; Filtering the third URL data using a pre-device information library to eliminate the URL data recorded in the pre-device information library to obtain the webpage address.

4. The method of claim 1, wherein the preset convergence condition comprises at least one of a parameter update rate of the convolutional neural network being lower than a preset threshold, performance information of the trained neural network reaching a preset performance constraint condition, and a number of executed iteration operations reaching a preset number threshold. Further comprising:

5. The method of claim 1, wherein, Extracting target features of the new fraud website as input samples of the fraud website intermediate page detection model to update parameters of the fraud website intermediate page detection model to obtain an optimized fraud website intermediate page detection model. Comprise:

6. An electronic device, comprising: At least one processor; And The memory is in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-5. ​

Images