A phishing website detection method based on YOLOv5 and Resnet-101

Abstract

The application discloses a phishing website detection method based on YOLOv5 and Resnet-101, constructs and trains a phishing website detection network model, and the phishing website detection network model comprises a target detection module and a similarity calculation module; the target detection module is combined with a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network; target information of a website to be detected is obtained through the target detection module, feature extraction and cosine similarity calculation are performed on a detection target Logo image and a legal Logo image by using the similarity calculation module, when the cosine similarity is higher than a set threshold value, it is judged that the detection target Logo image is correct, and the website to be detected is marked as a legal website. The application does not need any phishing data training, has the characteristics of small time consumption, high detection accuracy and strong expandability.

Description

Technical Field

[0001] The present invention belongs to network security technology, and specifically relates to a phishing website detection method based on YOLOv5 and Resnet-101. Background Art

[0002] In recent years, the number of phishing incidents has increased dramatically. To address this growing threat, phishing detection methods targeting URLs, HTML, and website screenshots have emerged. Targeted detection-based phishing detection methods aim to identify key webpage information, specifically legitimate brand logos, in website screenshots. These methods then combine the domain name extracted from the URL to generate binary phishing reports (legitimate and illegitimate) for users.

[0003] Common traditional object detection algorithms include HOG+SVM and DPM. These methods have several limitations in object detection tasks: feature extraction relies on manual design, sliding windows and candidate region generation are inefficient, detection accuracy is low, and they struggle with multi-object detection. Logos on web pages are generally small objects, so low detection accuracy can lead to a large number of missed and false positives.

[0004] With the development of deep learning, numerous object detection algorithms based on convolutional neural networks have emerged. These algorithms automatically learn features from data, eliminating the need for manual feature design and improving detection speed and accuracy. YOLO, as a representative algorithm, possesses significant characteristics and advantages, and has been continuously improved since its introduction. YOLOv5 inherits the fast and efficient features of the YOLO family and further optimizes them, making it not only more lightweight but also achieving a better balance between accuracy and speed. With its diverse model versions, ease of use, and strong community support, YOLOv5 has become one of the most widely used object detection algorithms, suitable for practical applications in a wide range of environments, from embedded devices to high-performance computing. Therefore, YOLOv5 was used to detect legitimate logos on web pages.

[0005] The original YOLOv5 model has low detection accuracy for small objects. To improve YOLOv5's detection accuracy for small objects, attention modules are embedded in YOLOv5's feature extraction network to enhance the model's ability to learn features for small objects. These modules dynamically adjust the weights of channels and spatial dimensions, allowing the model to focus more on key areas of small objects.

[0006] Thanks to YOLOv5's extremely fast detection speed, other methods can be used to verify the detection results after completion, thereby achieving higher detection accuracy. We used Resnet-101, trained on the large ImageNet dataset, to extract features from the improved YOLOv5 detection results and legitimate brand logo screenshots. We then calculated their cosine similarity. If the similarity exceeded a certain threshold, the detection was considered correct; otherwise, the detection failed. Summary of the Invention

[0007] Purpose of the invention: The purpose of the present invention is to address the deficiencies in the prior art and provide a phishing website detection method based on YOLOv5 and Resnet-101;

[0008] This paper addresses this issue by improving YOLOv5 to extract legitimate brand logos from web pages and using ResNet-101 to extract features from both target detection results and genuine brand logos. Ultimately, this method generates an interpretable phishing detection report for users. This interpretable report provides users with detailed information to help them decide whether to visit the target webpage.

[0009] Technical solution: The present invention provides a phishing website detection method based on YOLOv5 and Resnet-101, comprising the following steps:

[0010] Step S1: Obtain a legitimate logo and create an image dataset, which is split into a training set and a validation set for the YOLOv5s+SE target detection module. Obtain the URL address and corresponding webpage screenshots of the legitimate website, and then obtain the URL address and corresponding webpage screenshots of the phishing website. Merge and then divide the two types of data into a phishing detection dataset and a target detection dataset, respectively.

[0011] Step S1: First, obtain the URL address of the legitimate website and the corresponding legitimate logo image, then obtain the URL address of the phishing website and the corresponding webpage screenshot. Then, combine the two types of data into a phishing detection dataset and divide them into a target detection dataset, which includes the legitimate logo image and the phishing webpage screenshot;

[0012] Step S2: constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module combines a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network;

[0013] Step S3: Input the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtain the target information of the website to be detected through the target detection module;

[0014] The target information includes category information and coordinate information. Based on the category information, a legitimate logo image and corresponding URL domain name are obtained. Based on the coordinate information, the target area is captured on the webpage screenshot and scaled to a detection target logo image that is highly consistent with the obtained legitimate logo image.

[0015] Step S4: Use a similarity calculation module to perform feature extraction on the detection target logo image and the legal logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, the detection target logo image is judged to be correct;

[0016] Step S5: Combine the domain name in the URL address and the correct detection target logo image to generate an interpretable phishing detection report.

[0017] Furthermore, in step 1, the legal logo image is randomly rotated and scaled, and different backgrounds are added; and invalid URL addresses in the data set are deleted.

[0018] Furthermore, the target detection module is based on the YOLOv5s network, and an attention module (CBAM attention module or SE attention module) is added before the spatial pyramid pooling fast module SPPF of the YOLOv5s network; while maintaining the ability to fuse multi-scale features, the calculation process of spatial pyramid pooling is accelerated, ultimately improving the detection accuracy.

[0019] According to the category information in the target information, the legal domain database and legal logo image database are queried to obtain the legal logo domain name and legal logo image corresponding to the detection target.

[0020] Furthermore, the processing process of the similarity calculation module is as follows:

[0021] Step 4.1: First, resize the input image to a fixed size and normalize it, scaling the pixel values ​​to a specific range. Then, feed the resulting image into the ResNet-101 model and perform forward propagation through the layers of the ResNet-101 model to obtain a feature vector of dimension 1x1x2048.

[0022] Calculate the cosine similarity between the feature vectors in steps 4.2 and 4.1 and the features of the legal logo image.

[0023] Furthermore, the specific method of generating an explainable phishing report in step S5 is:

[0024] Based on the correct logo image in the webpage screenshot and its corresponding legitimate domain name list, combined with the domain name information extracted from the URL, four phishing detection reports are obtained:

[0025] (a) Legal website;

[0026] (b) Phishing websites that use legitimate logos to deceive users;

[0027] (c) Phishing websites that use legitimate domain names to deceive users;

[0028] (d) Phishing websites that do not contain legitimate information.

[0029] Beneficial Effects: The present invention does not require any training on fishing data and has the advantages of low time overhead, high detection accuracy, and strong scalability. The target detection module of the present invention uses the spatial pyramid pooling fast module in YOLOv5s. While maintaining the ability to fuse multi-scale features, it accelerates the calculation process of spatial pyramid pooling. Before feature fusion, it also adds an attention module before the spatial pyramid pooling fast module SPPF to improve detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of the overall process of the present invention;

[0031] Figure 2 Schematic diagram of the structure of the target detection module in the present invention;

[0032] Figure 3 Schematic diagram of target detection results in the embodiment;

[0033] Figure 4 Schematic diagram of the Resnet-101 structure in the embodiment;

[0034] Figure 5 Schematic diagram of the number of annotations for 16 categories of the target detection training set in the embodiment;

[0035] Figure 6 The performance of the 10 models in the embodiment under different cosine similarity values;

[0036] Figure 7 This is an interpretable phishing detection report diagram of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0038] like Figure 1As shown, the phishing website detection method based on YOLOv5 and Resnet-101 of the present invention includes the following steps:

[0039] Step S1: Obtain a legitimate logo and create an image dataset, which is split into a training set and a validation set for the YOLOv5s+SE target detection module. Obtain the URL address and corresponding webpage screenshots of the legitimate website, and then obtain the URL address and corresponding webpage screenshots of the phishing website. Merge and then divide the two types of data into a phishing detection dataset and a target detection dataset, respectively.

[0040] Step S2: constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module combines a YOLOv5s network and an attention module, and the similarity calculation module is based on a Resnet-101 network;

[0041] Step S3: Input the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtain the target information of the website to be detected through the target detection module;

[0042] The target information includes category information and coordinate information. Based on the category information, a legitimate logo image and corresponding URL domain name are obtained. Based on the coordinate information, the target area is captured on the webpage screenshot and scaled to a detection target logo image that is highly consistent with the obtained legitimate logo image.

[0043] Step S4: Use a similarity calculation module to perform feature extraction on the detection target logo image and the legal logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, the detection target logo image is judged to be correct;

[0044] Step S5: Combine the domain name in the URL address and the correct detection target logo image to generate an interpretable phishing detection report.

[0045] In step 1 of this embodiment, the legitimate logo image is randomly rotated and scaled, and different backgrounds are added; and invalid URL addresses in the data set are deleted.

[0046] For example, this embodiment first searches for 16 logos of 5 brands, such as Figure 5The images shown include: google, search, chrome, mail, map, play, chat, picture, meeting, amazon 1, amazon 2, alibaba, twitter1, twitter 2, facebook_1, facebook_2. The legitimate logo images were then rotated, scaled, and different backgrounds were added. LabelMe was used to annotate the legitimate logos in the images to create the training and validation sets for the object detection module. The training set for the object detection module contains 435 images, and the validation set for the object detection module contains 201 images.

[0047] We also accessed the Phishtank website to obtain phishing website URLs and screenshots from 2023, performed data cleansing, and deleted invalid URLs. The cleaned phishing web page images were divided into two parts: one part contained only images, annotated with legitimate logos using LabelMe, and served as the test set for the target detection module; the other part contained images and their URLs, which served as the phishing detection test set. We manually collected 131 legitimate website URLs and corresponding web page screenshots and divided them into the test set for the target detection module and the phishing detection dataset. The target detection module's test set contained 2203 URLs and their website images, of which 2122 were phishing websites and 81 were legitimate websites. The phishing detection test set contained 1108 URLs and website images, of which 1058 were phishing websites and 50 were legitimate websites.

[0048] The object detection module in this embodiment is based on the YOLOv5s network, and an attention module is added before the spatial pyramid pooling (SPPF) module in the YOLOv5s network. Based on the category information in the target information, the legal domain database and legal logo image database are queried to obtain the legal logo domain name and legal logo image corresponding to the legal logo. The similarity calculation module in this embodiment processes as follows:

[0049] Step 4.1: First, resize the input image to a fixed size and normalize it, scaling the pixel values ​​to a specific range. Then, feed the resulting image into the ResNet-101 model and perform forward propagation through the layers of the ResNet-101 model to obtain a feature vector of dimension 1x1x2048.

[0050] Calculate the cosine similarity between the feature vectors in steps 4.2 and 4.1 and the features of the legal logo image.

[0051] For example, consider all the target screenshots obtained in the previous step as a dataset, labeled Target. Record them in the CSV file in the order specified in Target, with two values ​​per line: the category and the judgment value. The judgment value can only be 0 or 1; a value of 1 indicates a correct answer, and a value of 0 indicates an error. Ten models, including Resnet-101, Resnet-50, and EfficientNet-B0 to B7, are selected. (c) For each model, perform the following steps:

[0052] Take an image of the target, and then query the legal logo image database according to the category of the corresponding row in the CSV file to obtain the legal logo; use the model to extract features from the two images respectively, and then use the cosine similarity formula to calculate the similarity. When it is above a certain threshold, the result is 1, indicating that the two images are similar, otherwise it is 0, indicating that they are not similar; finally, compare it with the judgment value, and if they are equal, the judgment is considered correct.

[0053] Example

[0054] Use mAP, Accuracy, Precision, Recall, and F1-Score to evaluate the model's metrics.

[0055] In the field of computer vision, average precision (AP) is commonly used to evaluate the performance of object detection and image classification models. AP measures the average accuracy of a model used to predict a specific type of object in a complete dataset. As shown in equation (1), the calculation of AP takes into account both precision and recall by forming a precision-recall curve (recall on the x-axis and precision on the y-axis), and the AP value is obtained from the area under the curve.

[0056]

[0057] For multi-category object detection tasks, the AP value of a single category cannot fully measure the effectiveness of the detection model. Therefore, it is necessary to average the AP values ​​of all categories of objects in the dataset. As shown in Equation (2), the average AP (mAP) accurately reflects the overall performance of the detection model.

[0058]

[0059] Table 1 mAP of eight target detection models

[0060]

[0061] Table 2 Performance of five YOLOv5 models.

[0062]

[0063] Table 1 shows the experimental results of eight object detection models. In this table, mAP_Train and mAP_Test represent the mAP values ​​in the training and testing phases, respectively. Time is the average time cost of detecting an image, and DetectedNum is the number of detected logos. The experimental results listed in Table 1 show that the eight models have high mAP values ​​in the testing phase of object detection. However, the YOLOv8 model (YOLOv8s, YOLOv8m, and YOLOv8l) is not selected for the following two reasons. (1) The YOLOv8 series models identify many background elements as objects. The object detection test set has only 201 annotated logos. However, as shown in the fifth column of Table 1, both YOLOV8m and YOLOv8l recognize more than 800 logos. Therefore, the YOLOv8 model produces too many false positives. (2) The YOLOv8 model incurs a high time cost. As shown in the 4th column of Table 1, the minimum detection time of the YOLOv8 series models is higher than that of the YOLOv5 series models.

[0064] In order to determine the most effective object detection model, the object detection experimental results of the remaining five models (YOLOv5s, YOLOv5m, YOLOv5l, YOLOv5s+CBAM of the present invention, and YOLOv5s+SE of the present invention) are first compared with the real labeled data in the object detection validation set. Then, the values ​​of the evaluation indicators, namely Precision, Accuracy, Recall and F1-Score, are calculated as follows: Figure 6 shown.

[0065] The results are shown in Table 2. Adding the CBAM and SE attention modules to YOLOv5s significantly improves the values ​​of all four metrics compared to methods using YOLOv5s alone. Furthermore, YOLOv5s+CBM and YOLOv5s+SE outperform the more complex YOLOv5m and YOLOv5l models. Therefore, adding the attention mechanism to YOLOv5s is an effective approach. The experimental results in Table 2 also show that YOLOv5s+SE achieves 20.2% higher precision than YOLOv5s. This means that YOLOv5s+SE produces fewer false positives in object prediction and reduces the error of misidentifying background elements as logos. The highest F1-Score indicates that YOLOv5s+SE achieves the best overall performance.

[0066] The similarity calculation module of the present invention obtains a corresponding legal logo image from a library of legal logo images based on the logo and category detected by the object detection module in the webpage screenshot. A feature extraction module is used to extract features from the detected logo and the corresponding legal logo image. The cosine similarity between the two images is calculated.

[0067] To verify the performance of the feature extraction module of the present invention, this example selected 10 different models, namely ResNet-50, ResNet-101, and EfficientNet-B0 to B7, to extract features from logo images. The experimental results show that the present invention performs best.

[0068] After obtaining the target logo image for detection, the cosine similarity between its feature vectors and the legitimate logo image is calculated. Cosine similarity evaluates the similarity between two vectors by calculating the cosine value of the angle between them. Specifically, if the angle between two vectors is closer to 0, that is, their cosine value is closer to 1, this indicates that the two vectors are more similar. On the contrary, if the angle is closer to 180 degrees and the cosine value is closer to -1, it means that the two vectors are less similar. The range of cosine similarity is [-1, 1], where 1 represents two completely similar vectors, -1 represents two completely opposite vectors, and 0 represents two orthogonal or independent vectors.

[0069] For example, given two vectors a and b, where a represents the features of the detected logo image after Resnet-101 extraction, and b represents the features of the legal logo image after Resnet-101 extraction, their cosine similarity can be calculated using the following formula:

[0070]

[0071] exist Figure 6 From the experimental results shown, it can be seen that when the cosine similarity threshold is set between 0.5 and 0.6, the recall rates of the Resnet-50 and Resnet-101 models are close to 1, and the precision values ​​of Resnet-101 are both higher than 0.85. Figure 6 As shown in (a); In addition, the Accuracy and F1-Score of Resnet-101 are the best among the 10 models, as shown in Figure 6As shown in (b) and (c). Experimental results show that the present invention can distinguish two different images by combining the feature extraction capabilities of the Resnet-101 model with cosine similarity calculation. When the cosine similarity threshold reaches 0.6, Resnet-101 achieves the highest F1-Score (0.926). Since F1-Score is a comprehensive evaluation indicator reflecting the overall performance of the model, we set the similarity to 0.6. In other words, when the similarity detection result is greater than or equal to the threshold, the object detection result is considered correct.

[0072] In this embodiment, step S4 generates four types of interpretable phishing reports, such as Figure 7 As shown:

[0073] (a) Legitimate websites. A website is considered legitimate only if the domain name extracted from the URL successfully matches the legal domain name corresponding to the correct logo image. For example, the report would be: "Legal / / Domain:di Logo li", where di is the domain name and li is the correct logo image category.

[0074] (b) Phishing websites that use legitimate logos to deceive users. The object detection and similarity calculation modules determine that the logo image on the target webpage is authentic. However, the input URL does not contain the domain name to which the logo belongs. In this case, the report content is: "Phish / / No domain. Deceive the user with legal logos."

[0075] (c) Phishing websites that use legitimate domain names to deceive users. The domain name contained in the input URL matches a legitimate domain name in the legal domain name database. However, the object detection and similarity calculation modules determine that the logo image on the screenshot is not authentic. In this case, the detection report will read: "Phish / / Fake Logos. Deceive User with Legal Domain."

[0076] (d) Phishing websites without legal information. The webpage screenshot does not contain any logo images, and the URL does not contain a legal domain name. In this case, the detection report will read: "Phish / / No Legal Information."

Claims

1. A phishing website detection method based on YOLOv5 and Resnet-101, characterized in that: The following steps are involved: Step S1: Obtain legitimate logos and create an image dataset, which is then split into a training set and a validation set for the target detection module. Obtain the URL address and corresponding webpage screenshots of legitimate websites, then obtain the URL address and corresponding webpage screenshots of phishing websites, merge the two types of data, and then divide them into a phishing detection dataset and a target detection dataset, respectively. Step S2: constructing and training a phishing website detection network model, wherein the phishing website detection network model includes a target detection module and a similarity calculation module; the target detection module combines a YOLOv5s network and an attention module, and the similarity calculation module includes a Resnet-101 network; Step S3: Input the URL address of the website to be detected and the corresponding webpage screenshot into the trained phishing website detection network model, and obtain the target information of the website to be detected through the target detection module; The target information includes category information and coordinate information. Based on the category information, a legitimate logo image and corresponding URL domain name are obtained. Based on the coordinate information, the target area is captured on the webpage screenshot and scaled to a detection target logo image that is highly consistent with the obtained legitimate logo image. Step S4: Use a similarity calculation module to perform feature extraction on the detection target logo image and the legal logo image obtained in step S3, and then calculate the cosine similarity value. When the obtained cosine similarity value is higher than a set threshold, the detection target logo image is judged to be correct; Compare the URL domain name corresponding to the legal logo image obtained in step S3 based on the category information with the URL domain name of the website to be detected. If the two are consistent, the URL domain name of the website to be detected is determined to be legal; Step S5: combining the domain name detection result and the logo image detection result to generate an interpretable phishing detection report; To generate an explainable phishing report: Based on the correct logo image in the webpage screenshot and its corresponding legitimate domain name list, combined with the domain name information extracted from the URL, four phishing detection reports are obtained: (a) Legal website; (b) Phishing websites that use legitimate logos to deceive users; (c) Phishing websites that use legitimate domain names to deceive users; (d) Phishing websites that do not contain legitimate information.

2. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: In step S1, the legal logo image is randomly rotated and scaled, and different backgrounds are added; and invalid URL addresses in the data set are deleted.

3. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: The target detection module is based on the YOLOv5s network, and an attention module is added before the spatial pyramid pooling fast module SPPF of the YOLOv5s network; According to the category information in the target information, the legal domain database and legal logo image database are queried to obtain the legal logo domain name and legal logo image corresponding to the detection target.

4. The phishing website detection method based on YOLOv5 and Resnet-101 according to claim 1, characterized in that: The processing process of the similarity calculation module is as follows: Step S4.1: First, resize the input image to a fixed size and normalize it, scaling the pixel values ​​to a specific range. Then, input the resulting image into the ResNet-101 model and perform forward propagation through the layers of the ResNet-101 model to obtain a feature vector of dimension 1x1x2048. Step S4.2: Calculate the cosine similarity between the feature vector obtained in step S4.1 and the features of the legal logo image.

Images