Counterfeit website identification method and device based on flow data, medium and product

Abstract

The invention relates to a flow data-based counterfeit website identification method and device, a medium and a product, and the method comprises the steps: carrying out the feature extraction and summarization based on a known counterfeit website set, and determining a website template corresponding to an industry directional counterfeit website; then, website template feature analysis is carried out based on the website templates, traffic collision is carried out based on extensive rules and traffic data, and a suspicious website set is determined; and then multi-dimensional feature analysis is carried out based on the suspicious website set, counterfeit website identification is carried out based on a fine rule and the suspicious website set, and a counterfeit website set to be confirmed is determined. And finally, based on the operation instruction and the to-be-confirmed counterfeit website set, obtaining a confirmed counterfeit website. According to the method, two layers of counterfeit website screening and identification operations of setting extensive rules and fine rules are carried out, so that counterfeit website identification is more targeted and accurate, essential characteristics of counterfeit websites are more deeply mined, false alarms and missing alarms are reduced, and the accuracy of counterfeit website identification is improved.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to methods, devices, media and products for identifying counterfeit websites based on traffic data. Background Art

[0002] With the rapid development of Internet technology, the problem of online fraud and counterfeit websites has become increasingly serious, posing a serious threat to the property and information security of Internet users. Counterfeit websites imitate the appearance and domain names of regular websites to trick users into entering personal sensitive information, such as bank card numbers, passwords, ID numbers, etc., in order to carry out fraudulent activities. These behaviors not only damage the economic interests of users, but also undermine the trust foundation of the network environment.

[0003] In order to improve the level of network security, related technologies usually use methods such as security certificate checking, domain name analysis, and IP address checking to identify counterfeit websites. However, although the counterfeit website identification methods in related technologies can play a role to a certain extent, when faced with frequently updated counterfeit websites, there is a problem of poor accuracy in counterfeit website identification.

[0004] Therefore, how to provide a highly accurate counterfeit website identification method is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0005] The purpose of this application is to provide a method, device, medium and product for identifying counterfeit websites based on traffic data, so as to solve at least one of the above technical problems.

[0006] The above invention objectives of the present application are achieved through the following technical solutions: In a first aspect, the present application provides a method for identifying counterfeit websites based on traffic data, which adopts the following technical solution: A method for identifying counterfeit websites based on traffic data, comprising: Acquire a set of known counterfeit websites, extract and summarize features based on the set of known counterfeit websites, and determine a website template corresponding to the industry-specific counterfeit website; Performing a website template feature analysis based on the website template, determining a rough rule, and acquiring traffic data, performing a traffic collision based on the rough rule and the traffic data, and determining a suspicious website set; Perform multi-dimensional feature analysis based on the suspicious website set to determine detailed rules, and perform counterfeit website identification based on the detailed rules and the suspicious website set to determine a counterfeit website set to be confirmed; The set of counterfeit websites to be confirmed is sent to a website confirmation terminal, an operation instruction sent by the website confirmation terminal is obtained, and a confirmed counterfeit website is obtained based on the operation instruction and the set of counterfeit websites to be confirmed.

[0007] By adopting the above technical solution, a known counterfeit website set is obtained, and feature extraction and aggregation are performed based on the known counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website. The website template is the common feature or pattern of the same type of counterfeit websites in the same industry. Then, the website template feature analysis is performed based on the website template to determine the rough rules, and the traffic collision is performed based on the rough rules and traffic data to determine the suspicious website set. The use of rough rules for traffic collision can quickly narrow the suspicious scope and quickly screen out suspicious websites. Then, multi-dimensional feature analysis is performed based on the suspicious website set to determine the fine rules, and counterfeit website identification is performed based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed. The use of fine rules for counterfeit website identification can capture the subtle differences of counterfeit websites to adapt to new counterfeit means and identification requirements. Finally, the counterfeit website set to be confirmed is sent to the website confirmation terminal, and the confirmed counterfeit website is obtained based on the operation instructions and the counterfeit website set to be confirmed. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites is significantly improved, and false positives and false negatives are effectively reduced. By setting up two levels of counterfeit website screening and identification operations, namely, extensive rules and detailed rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, thereby reducing false positives and missed positives and improving the accuracy of counterfeit website identification.

[0008] In a preferred example, the present application may be further configured as follows: extracting and summarizing features based on the known counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website includes: Extracting features based on a target known counterfeit website to determine a first feature set corresponding to the target known counterfeit website, wherein the target known counterfeit website is any known counterfeit website in the set of known counterfeit websites; Performing hash calculation based on the site icons in the first feature set to obtain icon hash values, and performing aggregation operations based on the icon hash values ​​corresponding to each of the target known counterfeit websites to obtain a hash value aggregation set, wherein the aggregation operation is used to reduce the complexity of data storage; The websites are grouped based on the hash value aggregation set to determine an industry-oriented counterfeit website set, and the website templates corresponding to the industry-oriented counterfeit websites are determined based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set.

[0009] In a preferred example, the present application may be further configured as follows: performing website template feature analysis based on the website template to determine rough rules includes: Perform short path feature analysis based on the website template to determine short path rough rules; Performing web page feature analysis based on the website template to determine rough rules for web page features; The short path coarse rule and the web page feature coarse rule are combined to obtain a coarse rule.

[0010] In a preferred example, the present application may be further configured as follows: performing multi-dimensional feature analysis based on the suspicious website set to determine fine rules includes: Extracting features based on each suspicious website in the suspicious website set, and determining a second feature set corresponding to each suspicious website; A multi-dimensional feature analysis is performed based on each of the second feature sets to determine a refined rule, wherein the refined rule is used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites.

[0011] In a preferred example, the present application can be further configured as follows: the set of counterfeit websites to be confirmed includes: counterfeit identification successful websites and counterfeit identification failed websites, The step of obtaining confirmed counterfeit websites based on the operation instruction and the set of counterfeit websites to be confirmed includes: When the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the refined rule, the counterfeit website that failed to be identified is re-identified as a counterfeit website, until the counterfeit website that failed to be identified is updated to the counterfeit website that successfully identified; When the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identified successful websites in the counterfeit website set to be confirmed to obtain confirmed counterfeit websites.

[0012] In a preferred example, the present application may be further configured as follows: after obtaining the confirmed counterfeit website based on the operation instruction and the set of counterfeit websites to be confirmed, the method includes: The confirmed counterfeit website is added to a blocking list, wherein adding to the blocking list is used to prevent users from accessing the counterfeit website.

[0013] In a second aspect, the present application provides an electronic device, which adopts the following technical solution: at least one processor; Memory; At least one application, wherein the at least one application is stored in the memory and is configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned method for identifying counterfeit websites based on traffic data.

[0014] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the above-mentioned method for identifying counterfeit websites based on traffic data.

[0015] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the method for identifying counterfeit websites based on traffic data is implemented.

[0016] In summary, the present application includes at least one of the following beneficial technical effects: A known counterfeit website set is obtained, and feature extraction and aggregation are performed based on the known counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website. The website template is the common feature or pattern of similar counterfeit websites in the same industry. Then, the website template feature analysis is performed based on the website template to determine the rough rules, and the traffic collision is performed based on the rough rules and traffic data to determine the suspicious website set. The use of rough rules for traffic collision can quickly narrow the suspicious scope and quickly screen out suspicious websites. Then, multi-dimensional feature analysis is performed based on the suspicious website set to determine the fine rules, and counterfeit website identification is performed based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed. The use of fine rules for counterfeit website identification can capture the subtle differences of counterfeit websites to adapt to new counterfeit means and identification requirements. Finally, the counterfeit website set to be confirmed is sent to the website confirmation terminal, and the confirmed counterfeit website is obtained based on the operation instructions and the counterfeit website set to be confirmed. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites is significantly improved, and false positives and false negatives are effectively reduced. By setting up two levels of counterfeit website screening and identification operations, namely, extensive rules and detailed rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, thereby reducing false positives and missed positives and improving the accuracy of counterfeit website identification.

[0017] Based on the target known counterfeit website, feature extraction is performed to determine the first feature set corresponding to the target known counterfeit website. Then, hash calculation is performed based on the site icon in the first feature set to obtain the icon hash value, and aggregation operation is performed based on the icon hash value corresponding to each target known counterfeit website to obtain the hash value aggregation set, wherein the execution of the aggregation operation can reduce the redundancy and complexity of data storage. Furthermore, based on the hash value aggregation set, the website grouping is performed to determine the industry-oriented counterfeit website set, and based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set, feature aggregation is performed to determine the website template corresponding to the industry-oriented counterfeit website. By combining and deeply analyzing the known counterfeit website set, the common features of similar counterfeit websites in the same industry can be extracted, which helps to quickly identify the counterfeit websites that appear, reduce the risk of regular websites being misreported due to misjudgment, and also reduce the phenomenon of counterfeit website omissions due to incomplete identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of a method for identifying counterfeit websites based on traffic data according to one embodiment of the present application; Figure 2 This is a schematic diagram of the structure of a counterfeit website identification device based on traffic data in one embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device according to one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following combination Figures 1 to 3 This application is described in further detail.

[0020] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, a person skilled in the art may make non-creative modifications to the present embodiment as needed, but such modifications are protected by the patent law as long as they are within the scope of the present application.

[0021] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application. It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the data related to the object is involved in the embodiment of the present application, it needs to be obtained through the authorization and consent of the object, the authorization and consent of the relevant departments, and in accordance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiment, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained, and the embodiment also needs to be implemented with the authorization and consent of the object.

[0022] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0023] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0024] The embodiment of the present application provides a method for identifying counterfeit websites based on traffic data, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application. Figure 1 As shown, the method includes step S101, step S102, step S103 and step S104, wherein: Step S101: obtaining a set of known counterfeit websites, extracting and summarizing features based on the set of known counterfeit websites, and determining a website template corresponding to an industry-specific counterfeit website.

[0025] For the embodiments of the present application, counterfeit websites refer to those websites that are established for the purpose of deceiving users by imitating the appearance, URL address, domain name or other key features of regular websites. The main purpose of counterfeit websites is to trick users into providing personal information, financial information or performing other sensitive operations. A set of known counterfeit websites is pre-stored in the electronic device. The information in the set of known counterfeit websites is counterfeit website data obtained from multiple sources such as network security agencies, blacklist databases, public reporting forums, browsers and anti-virus software vendors using crawlers or API call tools. By obtaining a set of known counterfeit websites and conducting in-depth analysis, common features of counterfeit websites can be extracted, which helps to quickly identify the counterfeit websites that appear.

[0026] However, since different industries have different business characteristics and face different user groups, the characteristics or patterns of counterfeit websites will also be different. Therefore, in the process of extracting and summarizing the characteristics of the known counterfeit website collection, the common characteristics or patterns of the counterfeit websites corresponding to each industry are analyzed in a targeted manner to obtain the website templates corresponding to the targeted counterfeit websites of a certain industry. For example, feature extraction and summary are performed on known counterfeit websites in the financial industry to determine the website templates corresponding to the counterfeit websites in the financial industry; feature extraction and summary are performed on known counterfeit websites in the energy industry to determine the website templates corresponding to the counterfeit websites in the energy industry. As for the network template, it is not the template used to build the website architecture in the conventional sense, but the common characteristics or patterns of similar counterfeit websites in the same industry. The specific implementation process for the above-mentioned feature extraction and aggregation is as follows: feature extraction is performed based on the target known counterfeit website to determine the first feature set corresponding to the target known counterfeit website, wherein the target known counterfeit website is any known counterfeit website in the known counterfeit website set; hash calculation is performed based on the site icon in the first feature set to obtain the icon hash value, and aggregation operation is performed based on the icon hash value corresponding to each target known counterfeit website to obtain a hash value aggregation set, wherein the aggregation operation is used to reduce the complexity of data storage; website grouping is performed based on the hash value aggregation set to determine the industry-targeted counterfeit website set, and feature aggregation is performed based on the first feature set corresponding to each known counterfeit website in the industry-targeted counterfeit website set to determine the website template corresponding to the industry-targeted counterfeit website.

[0027] Step S102: Performing a website template feature analysis based on the website template, determining rough rules, and acquiring traffic data, performing traffic collision based on the rough rules and traffic data, and determining a suspicious website set.

[0028] For the embodiment of the present application, the website template feature analysis is performed based on the website template to determine the extensive rules, wherein the extensive rules are a series of relatively simple, intuitive and easy-to-implement judgment criteria. Preferably, in the embodiment of the present application, the extensive rules provide screening rules for screening suspicious websites from two aspects: short paths and web page features. The characteristics of the extensive rules are applicability and ease of operation, which can quickly narrow the suspicious scope and quickly screen out suspicious websites. Therefore, the flow data is obtained, and the flow data can be obtained through various channels, including but not limited to: massive website access flow data collected by means of Web server logs, web crawlers, third-party data analysis tools, etc. Then, the flow data is preprocessed, and the preprocessing includes but is not limited to: cleaning, deduplication, formatting, etc., to ensure the quality and consistency of the flow data, and lay the foundation for subsequent flow collision operations. Then, the preprocessed flow data is collided with the extensive rules, and for each flow record, it is determined whether it meets the conditions of any extensive rule, and the corresponding website of the flow record that meets the conditions in the extensive rules is recorded as a suspicious website and included in the suspicious website set; otherwise, the website is characterized as a regular website, and no subsequent processing operation is required.

[0029] Step S103: Perform multi-dimensional feature analysis based on the suspicious website set to determine detailed rules, and perform counterfeit website identification based on the detailed rules and the suspicious website set to determine the counterfeit website set to be confirmed.

[0030] For the embodiments of the present application, counterfeit websites often deceive users through subtle changes, such as changing a character in the domain name, etc. In order to improve the accuracy of counterfeit website identification and deal with a variety of counterfeiting methods, multi-dimensional feature analysis is performed based on the suspicious website set to determine fine rules. Fine rules can capture the subtle differences of counterfeit websites to adapt to new counterfeiting methods and identification requirements. Fine rules are used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites. The identification dimensions include but are not limited to: URL path, SSL certificate, domain name, IP address, return package, ASN number, etc., and corresponding counterfeit website identification rules are set for each identification dimension. Then, based on the refined rules and the suspicious website set, the counterfeit website identification is performed to determine the counterfeit website set to be confirmed. Since the counterfeit website identification has a large amount of data and consumes a lot of resources, there may be a situation where the counterfeit website identification fails. In the case of identification failure, the corresponding counterfeit website cannot be accurately judged as a counterfeit website or a regular website, and another counterfeit website identification operation is required. Therefore, according to whether the suspicious website successfully performs the identification operation, the counterfeit website set to be confirmed is divided into two categories: counterfeit identification successful websites and counterfeit identification failed websites. For counterfeit identification successful websites, there are also two situations, that is, the counterfeit website identification operation divides them into counterfeit websites or regular websites. However, the automatic counterfeit website identification operation may have omissions and false alarms. In order to ensure the accuracy of counterfeit website identification, a confirmation operation needs to be performed afterwards.

[0031] By setting up two levels of counterfeit website screening and identification operations, namely, extensive rules and detailed rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, thereby reducing false positives and missed positives and improving the accuracy of counterfeit website identification.

[0032] Step S104: sending the set of counterfeit websites to be confirmed to the website confirmation terminal, obtaining the operation instruction sent by the website confirmation terminal, and obtaining the confirmed counterfeit website based on the operation instruction and the set of counterfeit websites to be confirmed.

[0033] For the embodiment of the present application, the set of counterfeit websites to be confirmed is sent to the website confirmation terminal so that the auditor can view the automatic identification results of the counterfeit websites, and manually screen and confirm the set of counterfeit websites to be confirmed determined by the electronic device, and convert the manual operation behavior of the auditor into an operation instruction that can be executed by the electronic device. Then, the operation instruction sent by the website confirmation terminal is obtained, and the confirmed counterfeit website is obtained based on the operation instruction and the set of counterfeit websites to be confirmed, wherein the confirmed counterfeit website is a counterfeit website that is automatically identified and manually confirmed by the counterfeit website. The specific implementation of the method for manually confirming the counterfeit website is as follows: when the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the fine rules, the counterfeit website is re-identified for the counterfeit identification failure website, until the counterfeit identification failure website is updated to the counterfeit identification success website, which can avoid the inaccurate identification result caused by the failure of automatic identification of the counterfeit website; when the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, the counterfeit identification success website in the counterfeit website set to be confirmed is batch confirmed to obtain the confirmed counterfeit website. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites has been significantly improved, and false positives and missed positives have been effectively reduced.

[0034] It can be seen that in the embodiment of the present application, a known counterfeit website set is obtained, and feature extraction and aggregation are performed based on the known counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website. The website template is the common feature or pattern possessed by the same type of counterfeit websites in the same industry. Then, the website template feature analysis is performed based on the website template to determine the rough rules, and the traffic collision is performed based on the rough rules and traffic data to determine the suspicious website set. The use of rough rules for traffic collision can quickly narrow the suspicious scope and quickly screen out suspicious websites. Further, multi-dimensional feature analysis is performed based on the suspicious website set to determine the fine rules, and counterfeit website identification is performed based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed. The use of fine rules for counterfeit website identification can capture the subtle differences of counterfeit websites to adapt to new counterfeit means and identification requirements. Finally, the counterfeit website set to be confirmed is sent to the website confirmation terminal, and the confirmed counterfeit website is obtained based on the operation instructions and the counterfeit website set to be confirmed. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites is significantly improved, and false positives and false negatives are effectively reduced. By setting up two levels of counterfeit website screening and identification operations, namely, extensive rules and detailed rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, thereby reducing false positives and missed positives and improving the accuracy of counterfeit website identification.

[0035] Furthermore, in order to quickly identify the counterfeit websites that appear and reduce the risk of misreporting legitimate websites due to misjudgment, in the embodiment of the present application, feature extraction and aggregation are performed based on a set of known counterfeit websites to determine the website template corresponding to the industry-specific counterfeit website, including: Extract features based on the target known counterfeit website to determine a first feature set corresponding to the target known counterfeit website, wherein the target known counterfeit website is any known counterfeit website in the set of known counterfeit websites; Performing hash calculation based on the site icons in the first feature set to obtain icon hash values, and performing aggregation operations based on the icon hash values ​​corresponding to each target known counterfeit website to obtain a hash value aggregation set, wherein the aggregation operation is used to reduce the complexity of data storage; The websites are grouped based on the hash value aggregation set to determine the industry-oriented counterfeit website set, and the features are summarized based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website.

[0036] For the embodiment of the present application, a large number of known counterfeit websites are stored in the known counterfeit website set. In the process of feature extraction, feature extraction is performed for any target known counterfeit website in the known counterfeit website set to determine the first feature set corresponding to the target known counterfeit website, wherein the first feature set includes but is not limited to: site icon, URL path, SSL certificate, domain name, IP address, title, various jump links, HTML tags, CSS style, page size and other basic information, and of course also includes: the last modification time of the user access record log, access frequency and other user features. For the feature data included in the first feature set, the user can adjust it according to the actual situation, and the real-time example of the present application will no longer be limited.

[0037] Then, a hash calculation is performed based on the site icon in the first feature set to obtain an icon hash value. In the process of performing the hash calculation, a conventional hash function can be selected to generate a unique icon hash value for the site icon. However, when the conventional hash function is used for hash calculation, the operations such as loading, jumping, and obfuscation of image resources are incorrectly identified. Preferably, a dynamic hash algorithm is loaded, that is, a hash algorithm based on dynamic features is developed, and the dynamic hash algorithm is used for hash calculation, which can capture the changes of the site icon during the loading and jumping process, so as to facilitate the subsequent improvement of the accuracy of counterfeit website identification. Then, in order to reduce the redundancy and complexity of data storage, an aggregation operation is performed based on the icon hash value corresponding to each target known counterfeit website to obtain a hash value aggregation set, and an aggregation operation is performed to organize a large number of icon hash values ​​into a more compact and orderly form, so as to facilitate the subsequent grouping of similar image hash values ​​based on certain rules or algorithms, thereby reducing the possibility of misjudgment and missed judgment in counterfeit website identification. Then, the website grouping is performed based on the hash value aggregation set to determine the industry-oriented counterfeit website set. The website grouping is used to group the websites according to similarity so that similar counterfeit websites in the same industry are divided into one group. Specifically, the icon hash value is essentially a binary string of fixed length. In order to enable similar icon hash values ​​to be grouped together, a similarity metric is selected. For the similarity metric, a local sensitive hashing algorithm, a Jaccard similarity algorithm, etc. can be selected, and the similarity score between any two icon hash values ​​in the hash value aggregation set is calculated according to the selected similarity metric. At the same time, a similarity threshold for measuring similarity is pre-stored in the electronic device. When the similarity score between two counterfeit websites exceeds the similarity threshold, the above two counterfeit websites are divided into a group, that is, placed in the same industry-oriented counterfeit website set; the icon hash values ​​corresponding to all target known counterfeit websites are traversed until the website grouping operation is completed. After that, based on the first feature set corresponding to each known counterfeit website in the industry-targeted counterfeit website set corresponding to the same group, feature aggregation is performed to determine the website template corresponding to the industry-targeted counterfeit website, which is the common feature or pattern possessed by similar counterfeit websites in the same industry. Therefore, by obtaining the known counterfeit website set and conducting in-depth analysis, the common features of similar counterfeit websites in the same industry can be extracted, so that the website template corresponding to the industry-targeted counterfeit website has industry characteristics, which helps to quickly identify the counterfeit websites that appear, reduces the risk of misreporting of regular websites due to misjudgment, and also reduces the phenomenon of underreporting of counterfeit websites due to incomplete identification.

[0038] It can be seen that in the embodiment of the present application, feature extraction is performed based on the target known counterfeit website to determine the first feature set corresponding to the target known counterfeit website. Then, a hash calculation is performed based on the site icon in the first feature set to obtain the icon hash value, and an aggregation operation is performed based on the icon hash value corresponding to each target known counterfeit website to obtain a hash value aggregation set, wherein the execution of the aggregation operation can reduce the redundancy and complexity of data storage. Furthermore, based on the hash value aggregation set, the website grouping is performed to determine the industry-oriented counterfeit website set, and based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set, feature aggregation is performed to determine the website template corresponding to the industry-oriented counterfeit website. By combining and deeply analyzing the known counterfeit website set, the common features of similar counterfeit websites in the same industry can be extracted, which helps to quickly identify the counterfeit websites that appear, reduce the risk of regular websites being misreported due to misjudgment, and also reduce the phenomenon of counterfeit website omissions due to incomplete identification.

[0039] Furthermore, in order to quickly narrow down the suspicious scope and quickly screen out suspicious websites, in the embodiment of the present application, a website template feature analysis is performed based on the website template to determine rough rules, including: Analyze the short path characteristics based on the website template and determine the short path rough rules; Analyze web page features based on website templates and determine rough rules for web page features; The coarse rules of short paths and the coarse rules of web page features are combined to obtain the coarse rules.

[0040] For the embodiment of the present application, in the website structure, the short path generally refers to the shortest or most direct page jump sequence from the home page to the target page. In a regular website, in order to facilitate users to access the website, it is inclined to find the required information through the shortest path. However, in order to induce users to perform improper operations, counterfeit websites usually set long and complex paths to confuse users. Therefore, short path analysis based on website templates is helpful to identify whether there is an abnormal path on the website. In performing short path feature analysis, the short path features of regular websites are obtained, and rules are formulated based on the short path features of regular websites and the short path features corresponding to the website templates to determine the short path rough rules. For example, when the login page of most regular websites can be reached by a maximum of two clicks on the home page, and the website template requires more than two clicks to reach, then "the login page cannot be reached by more than two clicks" is used as a short path rough rule.

[0041] At the same time, web page feature analysis can also be performed based on the website template to determine the rough rules of web page features, wherein the features that affect the authenticity of the website are selected for analysis during the web page feature analysis, such as page layout, element arrangement, text content, image usage, script behavior, etc. Further, the web page features extracted from the website template are quantified and rough rules of web page features are formulated. There can be multiple specific contents of the rough rules of web page features, which are no longer limited in the embodiments of the present application. For example, the page layout of a regular website is usually more regular and contains information such as official logos and contact information, so "the page layout is chaotic and there is no official logo" is used as a rough rule of web page features. Finally, the rough rules of short path and the rough rules of web page features are combined to obtain the rough rules, which provide screening rules for screening suspicious websites from the two dimensions of short path and web page features. The characteristics of the rough rules are applicability and ease of operation, which can quickly narrow the suspicious scope and quickly screen out suspicious websites.

[0042] It can be seen that in the embodiment of the present application, short path feature analysis is performed based on the website template to determine the short path extensive rule. At the same time, web page feature analysis is performed based on the website template to determine the web page feature extensive rule. Finally, the short path extensive rule and the web page feature extensive rule are combined to obtain the extensive rule. The extensive rule provides screening rules for screening suspicious websites from the two dimensions of short path and web page features. The characteristics of the extensive rule are applicability and ease of operation, which can quickly narrow the suspicious scope and quickly screen out suspicious websites.

[0043] Furthermore, in order to more comprehensively reveal the characteristics of counterfeit websites and improve the accuracy of counterfeit website identification, in the embodiment of the present application, multi-dimensional feature analysis is performed based on a suspicious website set to determine fine rules, including: Extracting features based on each suspicious website in the suspicious website set, and determining a second feature set corresponding to each suspicious website; A multi-dimensional feature analysis is performed based on each second feature set to determine a refined rule, wherein the refined rule is used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites.

[0044] For the embodiment of the present application, the suspicious website set corresponds to the traffic collision using extensive rules and traffic data. In order to more comprehensively reveal the characteristics of counterfeit websites and thus improve the accuracy of counterfeit website identification, feature extraction can be performed based on the website set and multi-dimensional feature analysis can be performed to formulate more sophisticated counterfeit software identification rules, so that counterfeit websites can be quickly and accurately identified among a large number of websites.

[0045] Therefore, feature extraction is performed based on each suspicious website in the suspicious website set to determine the second feature set corresponding to each suspicious website, wherein the first feature set includes but is not limited to: site icon, URL path, SSL certificate, domain name, IP address, title, various jump links, HTML tags, CSS style, Header information, page size and other basic information, and of course also includes: the last modification time of the user access record log, access frequency and other user features. Then, multi-dimensional feature analysis is performed based on each second feature set to determine the refined rules, wherein specific identification rules are set for each identification dimension in the refined rules, and which feature combinations or behavior patterns clearly define which feature combinations or behavior patterns characterize the website as a counterfeit website. Refined rules include, but are not limited to: URL rules, SSL certificate rules, domain name rules, IP rules, website code rules, Header information rules, ASN rules, etc., among which URL rules are used to check whether the URL contains common counterfeit words, spelling errors or abnormal structures; SSL certificate rules are used to verify the validity of the certificate, the credibility of the issuing authority, the integrity of the certificate chain, etc.; domain name rules are used to analyze the registration information of the domain name, historical change records, similarity with well-known brands, etc.; IP rules are used to check whether the geographical location of the IP address is abnormal and whether it has been used for malicious behavior; website code rules are used to analyze whether the website source code contains malicious scripts, phishing links or dark links; Header information rules are used to check whether there are abnormal fields or values ​​in the Header of the HTTP request / response packet; ASN rules are used to judge the suspiciousness of the website based on the ASN. Of course, there can be other refined rules, which are no longer limited in the embodiments of this application. It can be seen that in the embodiment of the present application, in order to more comprehensively reveal the characteristics of counterfeit websites and thus improve the accuracy of counterfeit website identification, feature extraction is performed based on each suspicious website in the suspicious website set, and a second feature set corresponding to each suspicious website is determined. Then, multi-dimensional feature analysis is performed based on each second feature set to determine fine rules, wherein the fine rules are used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites, so as to be able to quickly and accurately identify counterfeit websites among a large number of websites.

[0046] Furthermore, in order to ensure that counterfeit websites are identified and blocked in a timely manner and to improve the accuracy of counterfeit website identification, in the embodiment of the present application, the counterfeit website set to be confirmed includes: counterfeit identification successful websites and counterfeit identification failed websites. Based on the operation instructions and the set of counterfeit websites to be confirmed, the confirmed counterfeit websites are obtained, including: When the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the refined rules, a second counterfeit website identification is performed on the counterfeit website that failed to be identified, until the counterfeit website that failed to be identified is updated to a counterfeit website that succeeded in being identified; When the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identification successful websites in the counterfeit website set to be confirmed to obtain confirmed counterfeit websites.

[0047] For the embodiments of the present application, the process of counterfeit website identification involves the processing of massive amounts of data, including network domain name information, web page content, user access behavior and other aspects of analysis. Due to the huge amount of data, the requirements for computing resources, storage resources and network resources are extremely high. When the system resources are insufficient to support the real-time processing of all data, counterfeit website identification failure may occur, and such suspicious websites are determined as counterfeit identification failure websites; the remaining websites are determined as counterfeit identification success websites. After the confirmed counterfeit website set is sent to the website confirmation terminal, the auditor can view the automatic identification results of the counterfeit website and give operation instructions based on professional knowledge and operation requirements, that is, a secondary identification operation will be performed for the counterfeit identification failure website; and a counterfeit confirmation operation will be performed for the counterfeit identification success website. Through the secondary identification and batch confirmation operations of fine rules, it can be ensured that counterfeit websites are identified and blocked in a timely manner to improve the accuracy of counterfeit website identification.

[0048] Specifically, when the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the refined rules, the counterfeit website that failed to be identified is re-identified as a counterfeit website, until the counterfeit identification failed website is updated to a counterfeit identification successful website, wherein the first website information is the counterfeit identification failed website that needs to be re-identified selected by the auditor at the website confirmation terminal. When the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identification successful websites in the counterfeit website set to be confirmed, to obtain confirmed counterfeit websites, wherein the second website information is the counterfeit identification successful website that is manually confirmed as a counterfeit website selected by the auditor at the website confirmation terminal.

[0049] It can be seen that in the embodiment of the present application, when the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the fine rules, the counterfeit website that failed to be identified is re-identified as a counterfeit website, until the counterfeit identification failed website is updated to a counterfeit identification successful website. At the same time, when the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identification successful websites in the counterfeit website set to be confirmed, and confirmed counterfeit websites are obtained. Through the secondary identification and batch confirmation operation of the fine rules, it can be ensured that the counterfeit website is identified and blocked in a timely manner, so as to improve the accuracy of counterfeit website identification.

[0050] Furthermore, in order to maintain the health, stability and security of the network environment, in the embodiment of the present application, based on the operation instruction and the set of counterfeit websites to be confirmed, after obtaining the confirmed counterfeit websites, the following steps are included: Add the confirmed phishing website to the block list, where adding to the block list is used to prevent users from accessing the phishing website.

[0051] For the embodiment of the present application, the confirmed counterfeit website is a counterfeit website that is automatically identified and manually confirmed by the counterfeit website. In order to maintain the health, stability and security of the network environment, the confirmed counterfeit website is added to the blocking list to prevent users from accessing the counterfeit website. A blocking list is pre-set in the electronic device to store all confirmed counterfeit website information. The blocking list can be a table in a database, a file, or a data structure in memory. When adding a confirmed counterfeit website to the blocking list, you can choose which specific information of the confirmed counterfeit website to store according to your own needs, such as storing only the URL, or storing the domain name and IP address at the same time. At the same time, a blocking strategy is also formulated to prevent users from accessing counterfeit websites.

[0052] It can be seen that in the embodiment of the present application, in order to maintain the health, stability and security of the network environment, after obtaining the confirmed counterfeit website, the confirmed counterfeit website is added to the blocking list to prevent users from accessing the counterfeit website.

[0053] The above embodiment introduces a method for identifying counterfeit websites based on traffic data from the perspective of method flow. The following embodiment introduces a device for identifying counterfeit websites based on traffic data from the perspective of a virtual module or a virtual unit. Please refer to the following embodiment for details.

[0054] The present application embodiment provides a counterfeit website identification device based on traffic data, such as Figure 2 As shown, the counterfeit website identification device based on traffic data may specifically include: The feature extraction and aggregation module 210 is used to obtain a set of known counterfeit websites, extract and aggregate features based on the set of known counterfeit websites, and determine a website template corresponding to the industry-specific counterfeit website; The extensive rule formulation module 220 is used to analyze the website template characteristics based on the website template, determine the extensive rules, obtain the flow data, perform flow collision based on the extensive rules and the flow data, and determine the suspicious website set; A fine rule formulation module 230 is used to perform multi-dimensional feature analysis based on the suspicious website set, determine fine rules, and identify counterfeit websites based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed; The counterfeit website determination module 240 is used to send the counterfeit website set to be confirmed to the website confirmation terminal, obtain the operation instruction sent by the website confirmation terminal, and obtain the confirmed counterfeit website based on the operation instruction and the counterfeit website set to be confirmed.

[0055] For the embodiment of the present application, a known counterfeit website set is obtained, and feature extraction and aggregation are performed based on the known counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website. The website template is the common feature or pattern possessed by the same type of counterfeit websites in the same industry. Then, the website template feature analysis is performed based on the website template to determine the rough rules, and the traffic collision is performed based on the rough rules and traffic data to determine the suspicious website set. The use of rough rules for traffic collision can quickly narrow the suspicious scope and quickly screen out suspicious websites. Further, multi-dimensional feature analysis is performed based on the suspicious website set to determine the fine rules, and counterfeit website identification is performed based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed. The use of fine rules for counterfeit website identification can capture the subtle differences of counterfeit websites to adapt to new counterfeit means and identification requirements. Finally, the counterfeit website set to be confirmed is sent to the website confirmation terminal, and the confirmed counterfeit website is obtained based on the operation instructions and the counterfeit website set to be confirmed. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites is significantly improved, and false positives and false negatives are effectively reduced. By setting up two levels of counterfeit website screening and identification operations, namely, extensive rules and detailed rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, thereby reducing false positives and missed positives and improving the accuracy of counterfeit website identification.

[0056] In a possible implementation of the embodiment of the present application, when the feature extraction and aggregation module 210 extracts and aggregates features based on a set of known counterfeit websites to determine a website template corresponding to an industry-specific counterfeit website, it is used to: Extract features based on the target known counterfeit website to determine a first feature set corresponding to the target known counterfeit website, wherein the target known counterfeit website is any known counterfeit website in the set of known counterfeit websites; Performing hash calculation based on the site icons in the first feature set to obtain icon hash values, and performing aggregation operations based on the icon hash values ​​corresponding to each target known counterfeit website to obtain a hash value aggregation set, wherein the aggregation operation is used to reduce the complexity of data storage; The websites are grouped based on the hash value aggregation set to determine the industry-oriented counterfeit website set, and the features are summarized based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set to determine the website template corresponding to the industry-oriented counterfeit website.

[0057] In a possible implementation of the embodiment of the present application, the extensive rule formulation module 220 is used to: Analyze the short path characteristics based on the website template and determine the short path rough rules; Analyze web page features based on website templates and determine rough rules for web page features; The coarse rules of short paths and the coarse rules of web page features are combined to obtain the coarse rules.

[0058] In a possible implementation of the embodiment of the present application, the fine rule formulation module 230 is used to: Extracting features based on each suspicious website in the suspicious website set, and determining a second feature set corresponding to each suspicious website; A multi-dimensional feature analysis is performed based on each second feature set to determine a refined rule, wherein the refined rule is used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites.

[0059] In a possible implementation of the embodiment of the present application, the set of counterfeit websites to be confirmed includes: counterfeit identification successful websites and counterfeit identification failed websites. When executing the operation instruction and the set of counterfeit websites to be confirmed to obtain the confirmed counterfeit websites, the counterfeit website determination module 240 is used to: When the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the refined rules, a second counterfeit website identification is performed on the counterfeit website that failed to be identified, until the counterfeit website that failed to be identified is updated to a counterfeit website that succeeded in being identified; When the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identification successful websites in the counterfeit website set to be confirmed to obtain confirmed counterfeit websites.

[0060] In a possible implementation of the embodiment of the present application, the counterfeit website identification device based on traffic data further includes: The website blocking module is used to add confirmed counterfeit websites to a blocking list, wherein adding to the blocking list is used to prevent users from accessing the counterfeit websites.

[0061] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device for identifying counterfeit websites based on traffic data can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0062] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0063] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0064] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0065] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0066] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0067] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0068] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0069] The embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method in any of the above embodiments is implemented. Compared with the related art, the embodiment of the present application obtains a known counterfeit website set, extracts and summarizes features based on the known counterfeit website set, and determines the website template corresponding to the industry-oriented counterfeit website. The website template is a common feature or pattern possessed by similar counterfeit websites in the same industry. Then, the website template feature analysis is performed based on the website template to determine the rough rules, and the traffic collision is performed based on the rough rules and traffic data to determine the suspicious website set. The use of rough rules for traffic collision can quickly narrow the suspicious range and quickly screen out suspicious websites. Furthermore, multi-dimensional feature analysis is performed based on the suspicious website set to determine the fine rules, and counterfeit website identification is performed based on the fine rules and the suspicious website set to determine the counterfeit website set to be confirmed. The use of fine rules for counterfeit website identification can capture the subtle differences of counterfeit websites to adapt to new counterfeiting methods and identification needs. Finally, the set of counterfeit websites to be confirmed is sent to the website confirmation terminal, and the confirmed counterfeit websites are obtained based on the operation instructions and the set of counterfeit websites to be confirmed. By combining the two links of automatic identification and manual confirmation of counterfeit websites, the accuracy of identifying counterfeit websites is significantly improved, and false positives and false negatives are effectively reduced. By setting up two layers of counterfeit website screening and identification operations, namely, extensive rules and fine rules, counterfeit website identification is made more targeted and accurate, and the essential characteristics of counterfeit websites are more deeply explored, false positives and false negatives are reduced, and the accuracy of counterfeit website identification is improved.

[0070] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0071] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for identifying counterfeit websites based on traffic data, characterized in that: include: Acquire a set of known counterfeit websites, extract and summarize features based on the set of known counterfeit websites, and determine a website template corresponding to the industry-specific counterfeit website; Performing a website template feature analysis based on the website template, determining a rough rule, and acquiring traffic data, performing a traffic collision based on the rough rule and the traffic data, and determining a suspicious website set; Perform multi-dimensional feature analysis based on the suspicious website set to determine detailed rules, and perform counterfeit website identification based on the detailed rules and the suspicious website set to determine a counterfeit website set to be confirmed; The set of counterfeit websites to be confirmed is sent to a website confirmation terminal, an operation instruction sent by the website confirmation terminal is obtained, and a confirmed counterfeit website is obtained based on the operation instruction and the set of counterfeit websites to be confirmed.

2. The method for identifying counterfeit websites based on traffic data according to claim 1, characterized in that: The extracting and summarizing features based on the known counterfeit website set to determine the website template corresponding to the industry-specific counterfeit website includes: Extracting features based on a target known counterfeit website to determine a first feature set corresponding to the target known counterfeit website, wherein the target known counterfeit website is any known counterfeit website in the set of known counterfeit websites; Performing hash calculation based on the site icons in the first feature set to obtain icon hash values, and performing aggregation operations based on the icon hash values ​​corresponding to each of the target known counterfeit websites to obtain a hash value aggregation set, wherein the aggregation operation is used to reduce the complexity of data storage; The websites are grouped based on the hash value aggregation set to determine an industry-oriented counterfeit website set, and the website templates corresponding to the industry-oriented counterfeit websites are determined based on the first feature set corresponding to each known counterfeit website in the industry-oriented counterfeit website set.

3. The method for identifying counterfeit websites based on traffic data according to claim 1, characterized in that: The performing of website template feature analysis based on the website template to determine rough rules includes: Perform short path feature analysis based on the website template to determine short path rough rules; Performing web page feature analysis based on the website template to determine rough rules for web page features; The short path coarse rule and the web page feature coarse rule are combined to obtain a coarse rule.

4. The method for identifying counterfeit websites based on traffic data according to claim 1, characterized in that: The multi-dimensional feature analysis based on the suspicious website set is performed to determine the refined rules, including: Extracting features based on each suspicious website in the suspicious website set, and determining a second feature set corresponding to each suspicious website; A multi-dimensional feature analysis is performed based on each of the second feature sets to determine a refined rule, wherein the refined rule is used to define rules for counterfeit websites from multiple identification dimensions of suspicious websites.

5. The method for identifying counterfeit websites based on traffic data according to claim 1, characterized in that: The counterfeit website set to be confirmed includes: counterfeit identification successful websites and counterfeit identification failed websites. The step of obtaining confirmed counterfeit websites based on the operation instruction and the set of counterfeit websites to be confirmed includes: When the operation instruction is a re-identification instruction carrying the first website information, based on the first website information and the refined rule, the counterfeit website that failed to be identified is re-identified as a counterfeit website, until the counterfeit website that failed to be identified is updated to the counterfeit website that successfully identified; When the operation instruction is a batch confirmation instruction carrying the second website information, based on the second website information, a batch confirmation operation is performed on the counterfeit identified successful websites in the counterfeit website set to be confirmed to obtain confirmed counterfeit websites.

6. The method for identifying counterfeit websites based on traffic data according to claim 1, characterized in that: After obtaining the confirmed counterfeit website based on the operation instruction and the set of counterfeit websites to be confirmed, the method includes: The confirmed counterfeit website is added to a blocking list, wherein adding to the blocking list is used to prevent users from accessing the counterfeit website.

7. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the method for identifying counterfeit websites based on traffic data according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the counterfeit website identification method based on traffic data as claimed in any one of claims 1 to 6.

9. A computer program product, characterized in that The method comprises a computer program, wherein the computer program is executed by a processor to implement the method for identifying counterfeit websites based on traffic data as claimed in any one of claims 1 to 6.

Images