Method and computer equipment for detecting fake and fraudulent websites

Abstract

The embodiments of the present application relate to the field of counterfeit and fraudulent website detection, and specifically to a counterfeit and fraudulent website detection method and computer equipment. A specific implementation of the method includes: for each website entity name group in the website entity name group set, performing the following processing steps: generating a website entity matching information group according to the website entity name group and the website category entity information set; inputting the website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result; performing anomaly detection processing on the website link information corresponding to the website entity name group to generate an abnormal website identification result; determining whether the website corresponding to the website link information is a counterfeit and fraudulent website according to the website entity information anomaly detection result and the abnormal website identification result. This implementation improves the accuracy of the extracted website entity name, and by detecting the website link information, it can be determined whether the website is abnormal.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of counterfeit and fraudulent website detection, and specifically to a counterfeit and fraudulent website detection method and computer equipment. Background Art

[0002] With the rapid development of information technology, the number of Internet users is increasing year by year. However, for most Internet users who lack security awareness, fraudulent websites that infringe on people's property safety are a serious problem. Fraudulent websites can be highly imitating real websites to deceive users into entering their account passwords, or they can be websites that contain fraudulent information such as winning prizes and false advertisements that endanger people's property safety. In order to prevent users from being deceived by fraudulent websites, the detection of fraudulent websites becomes particularly important. At present, the detection of fraudulent websites is usually carried out by using blacklist filtering technology, collecting fraudulent websites as a database, and then using it to match the similarity of new web pages to determine whether it is a fraudulent website. However, when using the above method to detect fraudulent websites, the following technical problems often exist: the detection angle is single, and there is a lack of detection of website entity information, resulting in low detection efficiency and low detection accuracy. Summary of the invention

[0003] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0004] Some embodiments of the present application propose a method for detecting a phishing and fraudulent website, a computer device, and a computer-readable storage medium to solve one or more of the technical problems mentioned in the above background technology section.

[0005] In a first aspect, some embodiments of the present application provide a method for detecting counterfeit and fraudulent websites, the method comprising: in response to receiving a counterfeit and fraudulent website identification request information sent by a monitoring server, obtaining a website link information set to be detected from the above-mentioned monitoring server; performing entity recognition on each website link information in the above-mentioned website link information set according to a website category entity information set corresponding to a pre-constructed website entity relationship graph to generate a website entity name group and obtain a website entity name group set; for each website entity name group in the above-mentioned website entity name group set, performing the following processing steps: generating a website entity matching information group according to the above-mentioned website entity name group and the above-mentioned website category entity information set; inputting the above-mentioned website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result; performing anomaly detection processing on the website link information corresponding to the above-mentioned website entity name group to generate an abnormal website identification result; and determining whether the website corresponding to the above-mentioned website link information is a counterfeit and fraudulent website according to the above-mentioned website entity information anomaly detection result and the above-mentioned abnormal website identification result.

[0006] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0007] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0008] The above-mentioned various embodiments of the present application have the following beneficial effects: through the counterfeit and fraudulent website detection method of some embodiments of the present application, the accuracy of the extracted website entity name is improved, and then, whether the website entity name is abnormal can be detected. In addition, by detecting the website link information, it can be further determined whether the website is abnormal. First, in response to receiving the counterfeit and fraudulent website identification request information sent by the monitoring server, the website link information set to be detected is obtained from the above-mentioned monitoring server. Then, according to the website category entity information set corresponding to the pre-constructed website entity relationship graph, each website link information in the above-mentioned website link information set is entity recognized to generate a website entity name group and obtain a website entity name group set. Thus, the website category entity information set can be used as a vocabulary to perform entity recognition on the website link information. Then, for each website entity name group in the above website entity name group set, the following processing steps are performed: based on the above website entity name group and the above website category entity information set, a website entity matching information group is generated; the above website entity matching information group is input into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result; the website link information corresponding to the above website entity name group is subjected to anomaly detection processing to generate an abnormal website identification result; based on the above website entity information anomaly detection result and the above abnormal website identification result, it is determined whether the website corresponding to the above website link information is a counterfeit fraud website. Thus, the abnormal entity in the website link information can be accurately identified by the trained website entity information anomaly detection model. By detecting the website link information, it can be determined whether there is an abnormal access to the website. Thus, the accuracy of the extracted website entity name is improved, and then, it can be detected whether the website entity name is abnormal. In addition, by detecting the website link information, it can be further determined whether the website is abnormal. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0010] Figure 1 is a flow chart of some embodiments of the method for detecting a phishing and fraudulent website according to the present application;

[0011] Figure 2 is a schematic diagram of a computer device suitable for implementing some embodiments of the present application;

[0012] Figure 3 It is a structural schematic diagram of an initial website identification comparison model and an initial website identification channel comparison model according to the counterfeit and fraud website detection method of the present application;

[0013] Figure 4 It is a structural diagram of an initial fraudulent website identification model and an initial website identification channel learning model according to the counterfeit fraud website detection method of the present application. DETAILED DESCRIPTION

[0014] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0015] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0016] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0020] Figure 1 The flowchart 100 of some embodiments of the method for detecting a phishing fraud website according to the present application is shown. The method for detecting a phishing fraud website comprises the following steps:

[0021] Step 101, in response to receiving counterfeit and fraudulent website identification request information sent by a monitoring server, obtaining a website link information set to be detected from the monitoring server.

[0022] In some embodiments, the execution subject (e.g., computer device) of the counterfeit and fraudulent website detection method may obtain a set of website link information to be detected from the above-mentioned monitoring server in response to receiving counterfeit and fraudulent website identification request information sent by the monitoring server. The monitoring server may refer to a monitoring server that monitors various websites and collects website information. Counterfeit and fraudulent website identification request information may refer to request information for identifying and detecting various suspected counterfeit and fraudulent websites. Website link information may refer to information including the website link address of the website to be detected. Website link information may include: protocol, subdomain, domain name, port number, path, query parameter, anchor point. Among them, website link information may also include: page views, number of visitors, number of new visitors, new visitor ratio, bounce rate, average visit duration, and average number of visited pages.

[0023] Step 102, according to the website category entity information set corresponding to the pre-constructed website entity relationship graph, entity recognition is performed on each website link information in the above website link information set to generate a website entity name group and obtain a website entity name group set.

[0024] In some embodiments, the execution subject may perform entity recognition on each website link information in the website link information set according to the website category entity information set corresponding to the pre-constructed website entity relationship graph, so as to generate a website entity name group and obtain a website entity name group set. For example, the website category may include but is not limited to: knowledge category, video category, entertainment category, etc. For another example, the website category may also be: private website, private enterprise website category, public website category, etc. Website categories can be divided according to needs. Each website category corresponds to each website entity name, which represents that the entity corresponding to each website entity name belongs to the website category. The website category entity information may be a summary mapping of entity names belonging to the same website category obtained after entity relationship extraction when constructing the website entity relationship graph. The website category entity information may include each website entity name, and may also include a website category name corresponding to the website category. The website category name may be a pre-set category name, abbreviation or abbreviation. The website category entity information set may be all website category entity information corresponding to the construction of the website entity relationship graph. For example, the execution subject may use all names corresponding to the website category entity information set as a vocabulary, match the website entity name in the website link information through the entity recognition algorithm, and obtain a website entity name group. For example, the entity recognition algorithm may be the Aho–Corasick algorithm (AC automaton).

[0025] The above website entity relationship graph can be constructed through the following steps:

[0026] The first step is to obtain the original website entity data corresponding to the website detection business. The original website entity data can be stored in a database. The original website entity data can be the original data used to construct a website entity relationship graph, which can include the entity name of each website entity to be extracted and the entity relationship information between the website entities.

[0027] In the second step, the original website entity data is subjected to website entity relationship extraction processing to obtain a website category entity information set and a website entity relationship information set. Among them, the website category entity information in the website category entity information set corresponds to each website entity belonging to the same website category. The website category entity information includes the name of each website entity. The website category entity information corresponds to a website category alias corresponding to each included name. The names included in the website category entity information are different. For example, the execution subject may first perform entity extraction processing on the original website entity data to obtain a website entity node name set. Then, the execution subject may determine the website category to which each website entity node name in the website entity node name set belongs, and fill the website entity node name into the initial website category entity information corresponding to the website category to which it belongs. Secondly, the initial website category entity information after filling may be determined as a website category entity information set. Then, the original website entity data may be subjected to relationship extraction processing according to the website entity node name set to obtain a website entity relationship information set. Each website entity relationship information may be represented in the form of a triple.

[0028] The third step is to construct a website entity relationship graph based on the website category entity information set and the website entity relationship information set. For example, the execution subject can use graph construction technology to construct a website entity relationship graph based on the website category entity information set and the website entity relationship information set.

[0029] In an actual application scenario, the execution entity may perform entity identification on each website link information in the website link information set by following the steps below:

[0030] The first step is to generate a website category entity information tree corresponding to the website category entity information set. The website category entity information tree includes: a category entity node information set. For example, a website category entity information tree corresponding to the website category entity information set can be generated by a preset structure tree generation algorithm. The structure tree generation algorithm can be a hash tree algorithm or a prefix tree algorithm.

[0031] The second step is to perform word segmentation on the website link information to obtain a website information character sequence. For example, the website link information can be segmented using a preset word segmentation algorithm to obtain a website information character sequence. The preset word segmentation algorithm can be a hidden Markov model algorithm, a conditional random field algorithm, or an LSTM (Long short-term memory) model algorithm.

[0032] In the third step, for each website information character in the website information character sequence, the following processing steps are performed:

[0033] First, in response to determining that the website category entity information tree includes category entity node information that matches the website information character, the website information character is added to the website entity name sequence, wherein the website entity name sequence is initially empty.

[0034] Second, in response to determining that the category entity node information matching the website information characters satisfies the preset node condition, each category entity node information corresponding to the category entity node information matching the website information characters in the category entity node information set is determined as a category entity child node information set. The preset node condition may be: the next website category entity node identifier set included in the website category entity node information matching the website information characters is not empty.

[0035] Third, based on the above-mentioned category entity subnode information set, the following matching processing steps are performed on the next website information character of the above-mentioned website information character:

[0036] 1. Match the category entity subnode information set with the next website information character of the website information character to obtain a matching result. For example, in response to determining that there is a category entity character identical to the next website information character of the website information character among the category entity characters included in each category entity subnode information in the above category entity subnode information set, the successfully matched information is determined as the matching result.

[0037] 2. In response to determining that the matching result satisfies a preset matching condition, adding the next website information character of the website information character to the website entity name sequence.

[0038] 3. Determine the category entity subnode information that matches the next website information character of the website information character as the target category entity subnode information.

[0039] 4. In response to determining that the target category entity sub-node information meets a preset sub-node condition, the website entity name sequence is determined as a website entity name group.

[0040] Step 103: for each website entity name group in the above website entity name group set, perform the following processing steps:

[0041] Step 1031: Generate a website entity matching information group according to the website entity name group and the website category entity information set.

[0042] In some embodiments, the execution entity may generate a website entity matching information group according to the website entity name group and the website category entity information set.

[0043] For example, for each website entity name in the above website entity name group, first, the website category entity information to which the above website entity name belongs in the above website category entity information set can be determined. The website category entity information to which the website entity name belongs can be the website category entity information that includes the website entity name in the website category entity information set. Then, the above website entity name and the determined website category entity information can be determined as website entity matching information corresponding to the website entity name.

[0044] In an actual application scenario, the above execution entity can generate a website entity matching information group through the following steps:

[0045] In the first step, for each website entity name in the above website entity name group, the following processing steps are performed:

[0046] 1. Determine the position mark information of the website entity name corresponding to the website link information. The position mark information may indicate the position of the website entity name in the website link information. The position mark information may include two arrangement numbers of the first character and the last character corresponding to the website entity name in the website link information. The position mark information may also include the arrangement numbers of the first character to the last character corresponding to the website entity name in the website link information.

[0047] 2. Determine the website category entity information corresponding to the above website entity name in the above website category entity information set.

[0048] 3. Determine the website entity name, the location mark information and the website category entity information as website entity matching information.

[0049] The second step is to determine each determined website entity matching information as a website entity matching information group.

[0050] Step 1032: input the above website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result.

[0051] In some embodiments, the execution subject may input the website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result. The website entity information anomaly detection model may be a pre-trained anomaly detection model that takes the website entity matching information group as input and takes the website entity information anomaly detection result as output. For example, the website entity information anomaly detection model may be a supervised model, a semi-supervised model, or an unsupervised model. Supervised model: If there is labeled data, a supervised learning method may be used for anomaly detection. Common classification models such as logistic regression, support vector machine (SVM), etc. may be used for this purpose. However, the supervised model faces the problem of imbalance between positive and negative classes, and special attention should be paid to the processing of unbalanced data. Semi-supervised model: distance-based method: such as K-means clustering algorithm. This method first uses clean data without abnormal points for clustering, and then judges the test set based on the clustering results. If a point is more than the maximum distance from the nearest cluster center in the training set, it is judged as an abnormal point. The advantage is that the clustering converges quickly, but the disadvantage is that the initialization of the clustering algorithm and the selection of K will affect the results. Methods based on linear models: such as OCSVM (One-Class SVM). This method classifies areas with higher data density as positive classes and areas with lower data density as negative classes (abnormal samples). Suitable for anomaly detection of high-dimensional data, but not suitable for massive data. Unsupervised models: Statistical and probability models: This method assumes the distribution of the data and identifies anomalies by calculating the probability of predicted features. For example, using the Z-Score method, data with a predicted probability less than a given threshold is considered an anomaly. Suitable for large data volumes, but only for studying a single dimension. Density-based models: such as LOF (Local Outlier Factor). This method identifies anomalies by calculating local density deviations and is suitable for discovering local anomalies. Models based on random decision trees: such as Isolation Forest. This method identifies abnormal data points by randomly splitting data and is suitable for high-dimensional data and large-scale data sets. The results of website entity information anomaly detection can indicate whether each website entity in the corresponding website link information is abnormal.

[0052] The website entity information anomaly detection model can be trained through the following steps:

[0053] The first step is to obtain a sample set of website entity matching information.

[0054] The second step is to determine the network structure of the initial website entity information anomaly detection model. For example, the network structure of the initial website entity information anomaly detection model may include: fully connected layer (FCN), convolutional layer (CNN). It may also include: recurrent neural network (RNN) and long short-term memory network (LSTM).

[0055] The third step is to select a website entity matching information sample from the above website entity matching information sample set as the target website entity matching information sample.

[0056] The fourth step is to input the target website entity matching information sample into the initial website entity information anomaly detection model to obtain the initial website entity information anomaly detection result.

[0057] Step 5: Determine the information loss value between the above-mentioned initial website entity information anomaly detection result and the corresponding sample label. For example, the information loss value between the above-mentioned initial website entity information anomaly detection result and the corresponding sample label can be determined by a preset loss function. The preset loss function can be a hinge loss function or a cross entropy loss function.

[0058] In a sixth step, in response to the information loss value being less than or equal to the preset information loss value, the initial website entity information anomaly detection model is determined as the trained website entity information anomaly detection model.

[0059] Step 1033: Perform anomaly detection processing on the website link information corresponding to the above website entity name group to generate an abnormal website identification result.

[0060] In some embodiments, the above-mentioned execution subject may perform anomaly detection processing on the website link information corresponding to the above-mentioned website entity name group to generate an abnormal website identification result. For example, the website link information corresponding to the above-mentioned website entity name group may be subjected to anomaly detection processing through Google webmaster tools, Tiger sitemap generator, and site instruction query to generate an abnormal website identification result. The abnormal website identification result may indicate whether the website corresponding to the website link information is a fake website or a fraudulent website. Google webmaster tools: This tool is very powerful and can accurately detect dead links in a website. After using it for a period of time, Google will list the links that cannot be captured, most of which are dead links. Tiger sitemap generator: This tool is mainly used to generate website maps, and can also automatically detect dead links in a website. In the process of generating website maps, it will find all dead links. Use site instruction query: This method is suitable for small websites with fewer collections. Inaccessible links can be detected through site instruction query, but it is not suitable for large websites with more collections.

[0061] In an actual application scenario, the execution subject can perform anomaly detection processing on the website link information corresponding to the website entity name group through the following steps:

[0062] The first step is to perform enhanced preprocessing on the above-mentioned website link information to generate website link enhanced information. For example, first, each website data feature information in the website data feature information set included in the website link information is normalized to generate a website data feature normalization value, and obtain a website data feature normalization value set. Secondly, determine the feature correlation coefficient value corresponding to every two website data feature normalization values ​​in the above-mentioned website data feature normalization value set to generate a feature correlation coefficient value group, and obtain a feature correlation coefficient value group set. Afterwards, for each website data feature normalization value in the above-mentioned website data feature normalization value set, perform the following screening steps: Step 1, determine the mean of each feature correlation coefficient value in the feature correlation coefficient value group corresponding to the above-mentioned silo feature normalization value as the correlation coefficient mean. Step 2, in response to determining that the above-mentioned correlation coefficient mean is within a preset interval, determine the website data feature information corresponding to the above-mentioned website data feature normalization value as the website data enhanced feature information. Finally, merge the enhanced feature information of each website data into the website link enhanced information.

[0063] In the second step, the website link enhancement information is input into a pre-trained fraudulent website identification model to obtain an abnormal website identification result. The fraudulent website identification model can be a pre-trained neural network model that takes the website link enhancement information as input and the abnormal website identification result as output. Among them, the abnormal website identification result can indicate whether the website corresponding to the website link enhancement information is a fraudulent website. For example, the fraudulent website identification model can include: logistic regression model, random forest model, gradient boosting machine (GBM), support vector machine (SVM), deep learning model, etc.

[0064] The fraud website identification model can be trained by the following steps:

[0065] The first step is to obtain a sample set of fraudulent website link information. The sample of fraudulent website link information includes: a website data feature information set. For example, the website data feature information set may include: traffic quantity indicators, traffic quality indicators, traffic conversion indicators, user behavior indicators, and website performance indicators. Traffic quantity indicators may include: page views, number of visitors, number of visits, number of new visitors, and new visitor ratio. Traffic quality indicators may include: bounce rate, average visit duration, and average number of pages visited. Traffic conversion indicators may include: number of conversions and conversion rate. User behavior indicators may include: landing page, specific interest segmentation, and interest-similar categories. Website performance indicators: loading time, first byte time, number of requests, DCL, first content drawing, page size, round-trip time, and rendering blocking time.

[0066] In the second step, a fraudulent website link information sample is selected from the above fraudulent website link information sample set as an initial fraudulent website link information sample.

[0067] The third step is to normalize each website data feature information included in the initial fraudulent website link information sample to generate a website data feature normalization value and obtain a website data feature normalization value set. In particular, each website data feature information can be normalized by a preset normalization algorithm to generate a website data feature normalization value and obtain a website data feature normalization value set. The preset normalization algorithm can be a maximum-minimum normalization algorithm.

[0068] The fourth step is to determine the feature correlation coefficient corresponding to every two normalized values ​​of the website data features in the above-mentioned website data feature normalized value set to generate a feature correlation array and obtain a feature correlation array set. For example, the feature correlation coefficient corresponding to every two normalized values ​​of the website data features in the above-mentioned website data feature normalized value set can be determined by a preset similarity formula to generate a feature correlation array and obtain a feature correlation array set. The preset similarity formula can be a Spearman correlation coefficient formula.

[0069] Step 5: For each normalized value of the website data feature in the above normalized value set of website data features, perform the following processing steps:

[0070] 1. Determine the mean of each feature correlation coefficient in the feature correlation array corresponding to the normalized value of the website data feature as the mean of the website data correlation coefficient.

[0071] 2. In response to determining that the mean value of the website data correlation coefficient is within a preset coefficient range, the website data characteristic information corresponding to the normalized value of the website data characteristic is determined as the target website data characteristic information.

[0072] The sixth step is to determine the data characteristic information of each target website as a target fraudulent website link information sample.

[0073] In the seventh step, the initial fraudulent website identification model is trained based on the target fraudulent website link information sample to obtain a trained fraudulent website identification model.

[0074] The seventh step may include the following sub-steps:

[0075] In the first sub-step, the target fraudulent website link information sample is input into the initial website identification comparison model to obtain the first website data feature information and the first website identification information. The first website identification information may include but is not limited to: a feature value sequence corresponding to the target website data feature information. The first website identification information may indicate whether the target fraudulent website link information sample is abnormal.

[0076] In the second sub-step, the first website data feature information is input into the initial website identification channel comparison model to obtain the first website data feature encoding information and the first website data feature decoding information.

[0077] As an example, Figure 3 As shown, Teacher network represents the above initial website recognition comparison model. LSTM represents Long Short-Term Memory layer. BN represents BatchNormalization layer. ELU represents Exponential Linear Unit layer. GRU represents Gate Recurrent Unit layer. FC represents Fully Connected layer. Indicates the first website data characteristic information. Represents the first website identification information. Label represents the sample label included in the target fraudulent website link information sample. Teacher Loss represents the loss function used to adjust the initial website identification comparison model. Teacher channel represents the initial website identification channel comparison model. LeakyReLu represents the (rectified linear unit) activation function. Conv1d represents a one-dimensional convolutional neural network. Stride represents the step size. Indicates the first website data characteristic coding information. Represents the first website data feature decoding information. Channel Loss represents the loss function used to adjust the initial website recognition channel comparison model.

[0078] In the third sub-step, the target fraudulent website link information sample is input into the initial fraudulent website identification model to obtain the second website data feature information and the second website identification information. The second website identification information may include but is not limited to: a feature value sequence corresponding to the target website data feature information. The second website identification information may indicate whether the target fraudulent website link information sample is abnormal.

[0079] The fourth sub-step is to input the second website data feature information into the initial website identification channel learning model to obtain the website data channel feature information.

[0080] For example, the specific structures of the above initial fraudulent website identification model and the above initial website identification channel learning model can be referred to Figure 4 The structural diagram is shown in FIG. Figure 4 As shown, the Student network represents the above initial fraud website identification model. Indicates the second website data characteristic information. Indicates the second website identification information. Represents the characteristic information of the website data channel.

[0081] The fifth sub-step is to determine the contrast loss value, the first channel loss value, the learning loss value and the second channel loss value based on the first website data feature information, the first website identification information, the first website data feature encoding information, the first website data feature decoding information, the second website identification information, the website data channel feature information and the corresponding sample label. For example, the contrast loss value between the first website identification information and the corresponding sample label is determined by a first preset loss function. The first channel loss value between the first website data feature information and the corresponding first website data feature decoding information can be determined by a second preset loss function. The learning loss value between the first website data feature encoding information and the corresponding website data channel feature information can be determined by a third preset loss function. The second channel loss value between the second website identification information and the corresponding sample label can be determined by a fourth preset loss function. For example, the loss function can be a hinge loss function or a cross entropy loss function.

[0082] The sixth sub-step, in response to determining that the contrast loss value, the first channel loss value, the learning loss value and the second channel loss value are all less than the corresponding preset loss values, determines the initial fraudulent website identification model as the trained fraudulent website identification model.

[0083] Therefore, by training a complex network model and comparing its output with the true label, a smaller lightweight network (fraudulent website identification model) is trained. By building a combination of student, teacher channels and derivative modules, a lightweight design of the model is achieved, reducing the number of parameters and storage space, while improving detection performance.

[0084] Step 1034: Determine whether the website corresponding to the website link information is a counterfeit or fraudulent website based on the website entity information anomaly detection result and the abnormal website identification result.

[0085] In some embodiments, the execution entity may determine whether the website corresponding to the website link information is a counterfeit and fraudulent website based on the website entity information anomaly detection result and the abnormal website identification result. For example, if both the website entity information anomaly detection result and the abnormal website identification result indicate anomalies, then the website corresponding to the website link information is determined to be a counterfeit and fraudulent website. For another example, if the website entity information anomaly detection result indicates normal and the abnormal website identification result indicates abnormal, then the website corresponding to the website link information is determined to be suspected to be a counterfeit and fraudulent website.

[0086] The present application also provides a computer device 200. Figure 2 As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0087] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0088] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0089] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0090] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned counterfeit and fraudulent website detection method. That is, the memory 203 stores instructions for executing the aforementioned counterfeit and fraudulent website detection method.

[0091] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0092] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned counterfeit and fraud website detection method.

[0093] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned counterfeit and fraud website detection method.

[0094] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting a phishing fraud website, comprising: In response to receiving the counterfeit and fraudulent website identification request information sent by the monitoring server, obtaining a website link information set to be detected from the monitoring server; According to the website category entity information set corresponding to the pre-constructed website entity relationship graph, entity recognition is performed on each website link information in the website link information set to generate a website entity name group, thereby obtaining a website entity name group set; For each website entity name group in the website entity name group set, the following processing steps are performed: Generate a website entity matching information group according to the website entity name group and the website category entity information set; Inputting the website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result; Performing anomaly detection processing on the website link information corresponding to the website entity name group to generate an abnormal website identification result; According to the website entity information anomaly detection result and the abnormal website identification result, it is determined whether the website corresponding to the website link information is a counterfeit and fraudulent website.

2. The method for detecting a phishing and fraudulent website according to claim 1, wherein: The step of generating a website entity matching information group according to the website entity name group and the website category entity information set includes: For each website entity name in the website entity name group, the following processing steps are performed: Determine the location mark information of the website entity name corresponding to the website link information; Determine the website category entity information corresponding to the website entity name in the website category entity information set; Determine the website entity name, the location mark information and the website category entity information as website entity matching information; The determined pieces of website entity matching information are determined as a website entity matching information group.

3. The method for detecting a phishing and fraudulent website according to claim 1, wherein: Before inputting the website entity matching information group into a pre-trained website entity information anomaly detection model to obtain a website entity information anomaly detection result, the method further includes: Obtain a sample set of website entity matching information; Determine the network structure of the initial website entity information anomaly detection model; Selecting a website entity matching information sample from the website entity matching information sample set as a target website entity matching information sample; Inputting the target website entity matching information sample into the initial website entity information anomaly detection model to obtain the initial website entity information anomaly detection result; Determine an information loss value between the initial website entity information anomaly detection result and the corresponding sample label; In response to the information loss value being less than or equal to the preset information loss value, the initial website entity information anomaly detection model is determined as the trained website entity information anomaly detection model.

4. The method for detecting a phishing and fraudulent website according to claim 1, wherein: The performing abnormality detection processing on the website link information corresponding to the website entity name group to generate an abnormal website identification result includes: Performing enhancement preprocessing on the website link information to generate website link enhancement information; The website link enhancement information is input into a pre-trained fraudulent website identification model to obtain an abnormal website identification result.

5. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images