Phishing website detection method based on YOLOv5 and Resnet-101

Abstract

The invention discloses a phishing website detection method based on YOLOv5 and Resnet-101, and the method comprises the steps: constructing and training a phishing website detection network model which comprises a target detection module and a similarity calculation module; the target detection module is combined with a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network; the target information of the website to be detected is obtained through the target detection module, the similarity calculation module is used for carrying out feature extraction and cosine similarity calculation on the detection target Logo image and the legal Logo image, and when the cosine similarity is higher than a set threshold value, it is judged that the detection target Logo image is correct, and the website to be detected is marked as a legal website. The method does not need any fishing data training, and has the characteristics of low time overhead, high detection accuracy and high expansibility.

Description

Technical Field

[0001] The present invention belongs to network security technology, and in particular relates to a phishing website detection method based on YOLOv5 and Resnet-101. Background Art

[0002] In recent years, the number of phishing incidents has increased dramatically. In order to cope with the increasingly severe phishing threat, phishing detection methods targeting URLs, HTML, and website screenshots have emerged. Among them, the target detection-based phishing detection method aims to identify key information of web pages, namely legitimate brand logos, in website screenshots. Then, combined with the domain name extracted from the URL, a binary phishing report (legitimate and illegal) is generated for the user.

[0003] Common traditional target detection algorithms include HOG+SVM, DPM, etc. These methods have some limitations in target detection tasks: feature extraction relies on manual design, the sliding window and candidate region generation efficiency is low, the detection accuracy is not high, and it is difficult to cope with multi-target detection. Logos on web pages are basically small targets, and low detection accuracy will lead to a large number of missed reports and false positives.

[0004] With the development of deep learning, many object detection algorithms based on convolutional neural networks have been born, which automatically learn features from data, eliminate the steps of manually designing features, and improve detection speed and accuracy. Among them, YOLO, as one of the representative algorithms, has significant characteristics and advantages, and YOLO has been improved since its appearance. YOLOv5 inherits the fast and efficient characteristics of the YOLO family, and further optimizes it on this basis, making it not only more lightweight, but also achieving a better balance between accuracy and speed. With its diverse model versions, easy-to-use features and strong community support, YOLOv5 has become one of the most widely used object detection algorithms, suitable for practical applications in various environments from embedded devices to high-performance computing. Therefore, YOLOv5 is used to detect legal logos in web pages.

[0005] The original YOLOv5 model has low detection accuracy for small objects. In order to improve the detection accuracy of YOLOv5 for small objects, attention modules are embedded in the feature extraction network of YOLOv5 to enhance the model's feature learning ability for small objects. These modules dynamically adjust the weights of channels and spatial dimensions to make the model pay more attention to the key areas of small objects.

[0006] Thanks to the extremely fast detection speed of YOLOv5, the detection results can be verified by other means after the detection is completed, thus making the detection accuracy higher. We use Resnet-101 trained on the large dataset ImageNet to extract the features of the improved YOLOv5 detection results and the legitimate brand logo screenshots, and calculate their cosine similarity. When the similarity is higher than a certain threshold, the detection is considered correct, otherwise the detection fails. Summary of the invention

[0007] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a phishing website detection method based on YOLOv5 and Resnet-101;

[0008] The present invention aims to solve the above problems by improving YOLOv5 to extract legitimate brand logos from web pages and using Resnet-101 to extract target detection results and features of real brand logos. Finally, an interpretable phishing detection report is generated for users. The interpretative report provides users with detailed information to help them decide whether to visit the target web page.

[0009] Technical solution: A phishing website detection method based on YOLOv5 and Resnet-101 of the present invention comprises the following steps:

[0010] Step S1, obtain the legal logo and make an image dataset, split it into a training set and a validation set for the YOLOv5s+SE target detection module; obtain the URL address of the legal website and the corresponding webpage screenshot, and then obtain the URL address of the phishing website and the corresponding webpage screenshot, merge the two types of data and then divide them into a phishing detection dataset and a target detection dataset respectively;

[0011] Step S1: first obtain the URL address of the legal website and the corresponding legal Logo image, then obtain the URL address of the phishing website and the corresponding webpage screenshot, then merge the two types of data as a phishing detection data set, and divide the target detection data set at the same time, the target detection data set includes the legal Logo image and the phishing webpage screenshot;

[0012] Step S2, constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module is combined with a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network;

[0013] Step S3, inputting the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtaining the target information of the website to be detected through the target detection module;

[0014] The target information includes category information and coordinate information. The legal Logo image and the corresponding URL domain name are obtained according to the category information. The target area is captured on the webpage screenshot according to the coordinate information, and the captured target area is scaled to a detection target Logo image that is highly consistent with the obtained legal Logo image.

[0015] Step S4, using a similarity calculation module to perform feature extraction on the detection target Logo image and the legal Logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, it is determined that the detection target Logo image is correct;

[0016] Step S5: Combine the domain name in the URL address and the correct detection target Logo image to generate an explainable phishing detection report.

[0017] Furthermore, in step 1, the legal Logo image is randomly rotated and scaled, and different backgrounds are added; and invalid URL addresses in the data set are deleted.

[0018] Furthermore, the target detection module is based on the YOLOv5s network, and an attention module (CBAM attention module or SE attention module) is added before the spatial pyramid pooling fast module SPPF of the YOLOv5s network; while maintaining the ability to fuse multi-scale features, the calculation process of spatial pyramid pooling is accelerated, and ultimately the detection accuracy is improved.

[0019] According to the category information in the target information, the legal Domain database and the legal Logo image database are queried to obtain the legal Logo domain name and legal Logo image corresponding to the detection target.

[0020] Furthermore, the processing process of the similarity calculation module is as follows:

[0021] Step 4.1: First, resize the input image to a fixed size and normalize it, then scale the pixel values ​​to a specific range, and then input the resulting image into the ResNet-101 model, perform forward propagation through each layer of the ResNet-101 model, and obtain a feature vector with a dimension of 1x1x2048;

[0022] Step 4.2: Calculate the cosine similarity between the feature vector of step 4.1 and the feature of the legal logo image.

[0023] Furthermore, the specific method of generating an explainable phishing report in step S5 is:

[0024] Based on the correct Logo image in the webpage screenshot and its corresponding legitimate domain name list, combined with the domain name information extracted from the URL, four phishing detection reports are obtained:

[0025] (a) Legal websites;

[0026] (b) Phishing websites that use legitimate logos to deceive users;

[0027] (c) Phishing websites that use legitimate domain names to deceive users;

[0028] (d) Phishing websites that do not contain legitimate information.

[0029] Beneficial effects: The present invention does not require any fishing data training, and has the characteristics of low time cost, high detection accuracy and strong scalability. The target detection module of the present invention uses the spatial pyramid pooling fast module in YOLOv5s, which accelerates the calculation process of spatial pyramid pooling while maintaining the ability to fuse multi-scale features. Before feature fusion, an attention module is added in front of the spatial pyramid pooling fast module SPPF to improve detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of the overall process of the present invention;

[0031] Figure 2 It is a structural schematic diagram of the target detection module in the present invention;

[0032] Figure 3 Schematic diagram of target detection results in the embodiment;

[0033] Figure 4 It is a schematic diagram of the Resnet-101 structure in the embodiment;

[0034] Figure 5 Schematic diagram of the number of annotations of 16 categories in the target detection training set in the embodiment;

[0035] Figure 6 The performance of the 10 models in the embodiment under different cosine similarity values;

[0036] Figure 7 This is an explainable phishing detection report diagram of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0038] like Figure 1As shown, the phishing website detection method based on YOLOv5 and Resnet-101 of the present invention comprises the following steps:

[0039] Step S1, obtain the legal logo and make an image dataset, split it into a training set and a validation set for the YOLOv5s+SE target detection module; obtain the URL address of the legal website and the corresponding webpage screenshot, and then obtain the URL address of the phishing website and the corresponding webpage screenshot, merge the two types of data and then divide them into a phishing detection dataset and a target detection dataset respectively;

[0040] Step S2, constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module is combined with a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network;

[0041] Step S3, inputting the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtaining the target information of the website to be detected through the target detection module;

[0042] The target information includes category information and coordinate information. The legal Logo image and the corresponding URL domain name are obtained according to the category information. The target area is captured on the webpage screenshot according to the coordinate information, and the captured target area is scaled to a detection target Logo image that is highly consistent with the obtained legal Logo image.

[0043] Step S4, using a similarity calculation module to perform feature extraction on the detection target Logo image and the legal Logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, it is determined that the detection target Logo image is correct;

[0044] Step S5: Combine the domain name in the URL address and the correct detection target Logo image to generate an explainable phishing detection report.

[0045] In step 1 of this embodiment, the legal Logo image is randomly rotated and scaled, and different backgrounds are added; and the invalid URL addresses in the data set are deleted.

[0046] For example, this embodiment first searches for 16 logos of 5 brands, such as Figure 5The images shown include: google, search, chrome, mail, map, play, chat, picture, meeting, amazon 1, amazon 2, alibaba, twitter1, twitter 2, facebook_1, facebook_2. Then the legal logo images are rotated, scaled and different backgrounds are added, and LabelMe is used to annotate the legal logos in the images to make training sets and validation sets for the target detection module. The training set of the target detection module contains 435 images, and the validation set of the target detection module contains 201 images.

[0047] At the same time, visit the Phishtank website to obtain phishing website URLs and their webpage screenshots since 2023, perform data cleaning, and delete invalid URLs. The phishing webpage images after data cleaning are divided into two parts: one part has only images, and the legal logo is annotated with LabelMe as the test set of the target detection module; the other part contains images and their URLs, which are used for the phishing detection test set. Manually collect 131 legal website URLs and corresponding webpage screenshots, and divide them into part of the test set of the target detection module and part of the phishing detection data set. The test set of the target detection module contains 2203 URLs and their website images, of which 2122 URLs are phishing websites and 81 URLs are legal websites. The phishing detection test set contains 1108 URL machine website images, of which 1058 URLs are phishing websites and 50 are legal websites.

[0048] The target detection module of this embodiment is based on the YOLOv5s network, and an attention module is added before the spatial pyramid pooling fast module SPPF of the YOLOv5s network; the legal domain database and the legal logo image database are queried according to the category information in the target information to obtain the legal logo domain name and legal logo image corresponding to the legal logo. The processing process of the similarity calculation module of this embodiment is as follows:

[0049] Step 4.1: First, resize the input image to a fixed size and normalize it, then scale the pixel values ​​to a specific range, and then input the resulting image into the ResNet-101 model, perform forward propagation through each layer of the ResNet-101 model, and obtain a feature vector with a dimension of 1x1x2048;

[0050] Step 4.2: Calculate the cosine similarity between the feature vector of step 4.1 and the feature of the legal logo image.

[0051] For example, take all the target screenshots obtained in the previous step as a data set, record it as Target, and record them in the csv file in the order in Target, with two values ​​per line, category and judgment value. The judgment value is only 0 or 1; the value of 1 represents correct, and the value of 0 represents wrong; select 10 models including Resnet-101, Resnet-50, EfficientNet-B0~B7; (c) perform the following steps for each model:

[0052] Take an image of the Target, and then query the legal logo image database according to the category of the corresponding row in the csv to obtain the legal logo; use the model to extract features of the two images respectively, and then use the cosine similarity formula to calculate the similarity. When it is higher than a certain threshold, it is 1, indicating that the two images are similar, otherwise it is 0, indicating that they are not similar; finally, compare it with the judgment value, and if they are equal, the judgment is considered correct.

[0053] Example

[0054] Use mAP, Accuracy, Precision, Recall, and F1-Score to evaluate the model’s metrics.

[0055] In the field of computer vision, average precision (AP) is often used to evaluate the performance of object detection and image classification models. AP measures the average accuracy of a model used to predict a specific type of object in a complete dataset. As shown in equation (1), the calculation of AP takes into account both precision and recall by forming a precision-recall curve (recall on the x-axis and precision on the y-axis), and the value of AP is obtained from the area under the curve.

[0056]

[0057] For multi-category object detection tasks, the AP value of a single category cannot fully measure the effectiveness of the detection model. Therefore, it is necessary to average the AP values ​​of all categories of objects in the dataset. As shown in equation (2), the average AP (mAP) accurately reflects the overall performance of the detection model.

[0058]

[0059] Table 1 mAP of eight target detection models

[0060]

[0061] Table 2 Performance of five YOLOv5 models.

[0062]

[0063] Table 1 gives the experimental results of eight object detection models. In this table, mAP_Train and mAP_Test represent the mAP values ​​in the training and test phases, respectively. Time is the average time cost of detecting an image, and DetectedNum is the number of detected logos. The experimental results listed in Table 1 show that the eight models have high mAP values ​​in the test phase of object detection. However, the YOLOv 8 models (YOLOv 8s, YOLOv 8m, and YOLOv 8l) are not selected for the following two reasons. (1) The YOLOv8 series models identify many background elements as objects. The object detection test set has only 201 annotated logos. However, as shown in the fifth column of Table 1, both YOLOV 8m and YOLOv 8l recognize more than 800 logos. Therefore, the YOLOv 8 model produces too many false positives. (2) The YOLOv 8 model incurs a high time cost. As shown in the 4th column of Table 1, the minimum detection time of the YOLOv8 series models is higher than that of the YOLOv5 series models.

[0064] In order to determine the most effective object detection model, the object detection experimental results of the remaining five models (YOLOv5s, YOLOv5m, YOLOv5l, YOLOv5s+CBAM of the present invention, and YOLOv5s+SE of the present invention) are first compared with the real labeled data in the object detection validation set. Then, the values ​​of the evaluation indicators, namely Precision, Accuracy, Recall and F1-Score, are calculated, as shown in Figure 6 shown.

[0065] The results are shown in Table 2. It can be seen that adding the CBAM and SE attention modules to YOLOv 5s significantly improves the values ​​of the four indicators compared to the method using YOLOv 5s alone. In addition, the performance of YOLOv 5s+CBM and YOLOv 5s+SE is better than that of the more complex YOLOv 5m and YOLOv 5l models. Therefore, adding an attention mechanism to YOLOv 5s is an effective method. The experimental results in Table 2 also show that the Precision of YOLOv 5s+SE is 20.2% higher than that of YOLOv 5s. This means that YOLOv 5s+SE produces very small false positives in object prediction and reduces the error of identifying background elements as logos. The largest F1-Score shows that the overall performance of YOLOv 5s+SE is the best.

[0066] The similarity calculation module of the present invention obtains the corresponding legal logo image from the legal logo image library based on the logo and category detected by the target detection module in the webpage screenshot. The feature extraction module is used to obtain the features of the detected logo and the corresponding legal logo image. The cosine similarity between the two images is calculated.

[0067] In order to verify the performance of the feature extraction module of the technical solution of the present invention, this embodiment selected 10 different models, namely Resnet-50, Resnet-101 and EfficientNet-B0~B7, for extracting features from the Logo image. From the experimental results, the effect of the present invention is the best.

[0068] After obtaining the target logo image to be detected, the cosine similarity between the feature vectors of the target logo image and the legitimate logo image is calculated. The cosine similarity evaluates the similarity between the two vectors by calculating the cosine value of the angle between them. Specifically, if the angle between the two vectors is closer to 0, that is, their cosine value is closer to 1, this indicates that the two vectors are more similar. On the contrary, if the angle is closer to 180 degrees and the cosine value is closer to -1, it means that the two vectors are not very similar. The range of cosine similarity is [-1, 1], where 1 represents two completely similar vectors, -1 represents two completely opposite vectors, and 0 represents two orthogonal or independent vectors.

[0069] For example, given two vectors a and b, the a vector represents the features of the detected logo image after Resnet-101 extraction, and the b vector represents the features of the legal logo image after Resnet-101 extraction. Their cosine similarity can be calculated by the following formula:

[0070]

[0071] exist Figure 6 From the experimental results shown, it can be seen that when the cosine similarity threshold is set between 0.5 and 0.6, the recall rates of the Resnet-50 and Resnet-101 models are close to 1, and the precision values ​​of Resnet-101 are both higher than 0.85. Figure 6 As shown in (a) in the figure; In addition, the Accuracy and F1-Score of Resnet-101 are the best among the 10 models, as shown in Figure 6As shown in (b) and (c). Experimental results show that the present invention can distinguish two different images by combining the feature extraction capability of the Resnet-101 model with the cosine similarity calculation. When the cosine similarity threshold reaches 0.6, Resnet-101 obtains the highest F1-Score (0.926). Since F1-Score is a comprehensive evaluation indicator that reflects the overall performance of the model, we set the similarity to 0.6. In other words, when the similarity detection result is greater than or equal to the threshold, the object detection result is considered correct.

[0072] In step S4 of this embodiment, four types of interpretable phishing reports are generated, such as Figure 7 As shown:

[0073] (a) Legal website. A website is considered legal only when the domain name extracted from the URL can be successfully matched with the legal domain name corresponding to the correct logo image. For example, the report is: "Legal / / Domain:di Logo li", where di is the domain name and li is the correct logo image category.

[0074] (b) Phishing websites that use legal logos to deceive users. The object detection and similarity calculation modules determine that the logo image on the target web page is authentic. However, the input URL does not contain the domain name to which the logo belongs. In this case, the content of the report is: "Phish / / No domain. Deceive the User with Legal Logos".

[0075] (c) Phishing websites that use legal domain names to deceive users. The domain name contained in the input URL is consistent with the legal domain name in the legal domain name database. However, the logo image on the screenshot determined by the object detection and similarity calculation module is not real. In this case, the content of the detection report is: "Phish / / Fake Logos.Deceive User withLegal Domain".

[0076] (d) Phishing website with no legal information. There is no logo image in the webpage screenshot, and there is no legal domain name in the URL. In this case, the content of the detection report is: "Phish / / No Legal Information".

Claims

1. A phishing website detection method based on YOLOv5 and Resnet-101, characterized in that: The following steps are involved: Step S1, obtain the legal logo and create an image dataset, split it into a training set and a validation set for the target detection module; obtain the URL address of the legal website and the corresponding webpage screenshot, and then obtain the URL address of the phishing website and the corresponding webpage screenshot, merge the two types of data and then divide them into a phishing detection dataset and a target detection dataset respectively; Step S2, constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module is combined with a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network; Step S3, inputting the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtaining the target information of the website to be detected through the target detection module; The target information includes category information and coordinate information. The legal Logo image and the corresponding URL domain name are obtained according to the category information. The target area is captured on the webpage screenshot according to the coordinate information, and the captured target area is scaled to a detection target Logo image that is highly consistent with the obtained legal Logo image. Step S4, using a similarity calculation module to perform feature extraction on the detection target Logo image and the legal Logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, it is determined that the detection target Logo image is correct; Step S5: Combine the domain name in the URL address and the correct detection target Logo image to generate an explainable phishing detection report.

2. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: In step 1, the legal Logo image is randomly rotated and scaled, and different backgrounds are added; and invalid URL addresses in the data set are deleted.

3. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: The target detection module is based on the YOLOv5s network, and an attention module is added before the spatial pyramid pooling fast module SPPF of the YOLOv5s network; According to the category information in the target information, the legal Domain database and the legal Logo image database are queried to obtain the legal Logo domain name and legal Logo image corresponding to the detection target.

4. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: The processing process of the similarity calculation module is as follows: Step 4.1: First, resize the input image to a fixed size and normalize it, then scale the pixel values ​​to a specific range, and then input the resulting image into the ResNet-101 model, perform forward propagation through each layer of the ResNet-101 model, and obtain a feature vector with a dimension of 1x1x2048; Step 4.2: Calculate the cosine similarity between the feature vector of step 4.1 and the feature of the legal logo image.

5. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: The specific method of generating an explainable phishing report in step S5 is: Based on the correct Logo image in the webpage screenshot and its corresponding legitimate domain name list, combined with the domain name information extracted from the URL, four phishing detection reports are obtained: (a) Legal websites; (b) Phishing websites that use legitimate logos to deceive users; (c) Phishing websites that use legitimate domain names to deceive users; (d) Phishing websites that do not contain legitimate information.

Images