Phishing page recognition method based on ensemble learning and active learning

Abstract

The present invention discloses a phishing page identification method based on ensemble learning and active learning, comprising: collecting web pages and processing them into an initial data set; clustering the initial data set to construct a cluster set; training a single-class width learning system for clusters in the cluster set, assigning weights to construct a first ensemble learning model; setting up a buffer to temporarily store unrecognizable pages, clustering and identifying the type, then training the single-class width learning system to join the first ensemble learning model to form a second ensemble learning model; designing a weight adjustment mechanism to adapt to changes in phishing pages; using the second ensemble learning model to identify the page, and if it fails, sending it to the buffer; if it succeeds, calculating a confidence score and selecting the data label with the highest score to determine whether the page is a phishing page. The present invention can reduce the involvement of professionals in the phishing page identification process and maintain an excellent recognition success rate, providing an effective solution for the field of network security.

Images