Phishing detection method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of artificial intelligence, and discloses a phishing detection method and device, computer equipment and a storage medium. The phishing detection method comprises the following steps: acquiring network service data, and preprocessing the network service data to obtain network feature data; performing prediction processing on the network feature data through a preset phishing detection model to obtain a phishing detection result; the preset fishing detection model comprises optimized model parameters obtained after secretary bird algorithm optimization and back propagation iteration; and when it is confirmed that the fishing detection result is a fishing abnormal result, generating fishing early warning information according to the fishing detection result. According to the preset phishing detection model, the secretary bird optimization algorithm is introduced to optimize the model parameters, so that the model training efficiency and generalization ability are improved, the accuracy of phishing detection can be improved by utilizing the optimized model, the real-time performance of detection is ensured, the occurrence of false alarm and missing report can be reduced, and the phishing detection effect is ensured.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a phishing detection method, device, computer equipment, and storage medium. Background Art

[0002] In the digital age, networks underpin the daily operations and business development of all industries. Phishing attacks can have varying degrees of impact on people's lives and work. For example, phishing attacks disguise themselves as legitimate organizations through emails, text messages, or websites, tricking users into disclosing sensitive information, resulting in significant financial losses. In the financial sector, the security of customer information is directly linked to both their financial interests and the reputation of the company. As the core of financial services, the insurance industry involves numerous external communication channels, which present the risk of phishing attacks. Existing technologies primarily rely on signature matching and traffic analysis to detect and prevent phishing attacks. However, when new phishing attack forms emerge, updating signature libraries often requires significant time. This process can hinder timely identification of phishing attacks, reducing detection efficiency and leading to underreporting. This results in suboptimal phishing detection and limits its scope of application. Summary of the Invention

[0003] Based on this, it is necessary to provide a phishing detection method, device, computer equipment and storage medium to address the above technical problems, so as to solve the problems of low efficiency and poor effect of existing phishing detection methods.

[0004] A phishing detection method, comprising: Acquiring network service data, and preprocessing the network service data to obtain network feature data; Predicting and processing the network feature data using a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained after Secretary Bird algorithm optimization and back propagation iteration; When it is confirmed that the fishing detection result is an abnormal fishing result, fishing warning information is generated according to the fishing detection result.

[0005] A phishing detection device, comprising: A data processing module is used to obtain network service data, pre-process the network service data, and obtain network feature data; a model prediction module, configured to predict and process the network feature data using a preset fishing detection model to obtain fishing detection results; the preset fishing detection model includes optimized model parameters obtained through Secretary Bird algorithm optimization and back-propagation iteration; The warning generation module is used to generate fishing warning information according to the fishing detection result when it is confirmed that the fishing detection result is an abnormal fishing result.

[0006] A computer device includes a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the above-mentioned phishing detection method is implemented.

[0007] A computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors are caused to perform the above-mentioned phishing detection method.

[0008] The above-mentioned phishing detection method, device, computer equipment and storage medium, the phishing detection method obtains network service data, pre-processes the network service data, and obtains network feature data; predicts and processes the network feature data through a preset phishing detection model to obtain a phishing detection result; the preset phishing detection model includes optimized model parameters obtained after Secretary Bird algorithm optimization and back-propagation iteration; when the phishing detection result is confirmed to be an abnormal phishing result, phishing warning information is generated based on the phishing detection result. The preset phishing detection model of the present invention improves the model training efficiency and generalization ability of the neural network by introducing the Secretary Bird optimization algorithm to optimize the model parameters. The present invention uses the optimized model to more promptly identify phishing attacks, ensure the real-time detection, and reduce the occurrence of false positives and false negatives, thereby improving the accuracy of phishing detection and ensuring the effectiveness of phishing detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0010] Figure 1 is a schematic diagram of an application environment of a phishing detection method according to an embodiment of the present invention; Figure 2 is a flow chart of a phishing detection method according to an embodiment of the present invention; Figure 3 is a structural diagram of a phishing detection device according to an embodiment of the present invention; Figure 4 FIG. 1 is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0011] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0012] The phishing detection method provided in this embodiment can be applied to Figure 1 In an application environment, a client communicates with a server. Clients include, but are not limited to, various personal computers, laptops, smartphones, tablet computers, and portable wearable devices. The server can be implemented as a standalone server or a server cluster consisting of multiple servers. The present invention is described in detail below using specific embodiments.

[0013] In the financial sector, phishing attacks can directly disrupt the normal operation of functions such as online transactions, account inquiries, and customer service hotlines, impacting customer satisfaction and even leading to customer complaints and disputes. Users in the insurance industry place great importance on online services, and phishing attacks have a particularly significant impact on insurance customer service. The client refers to the medium or channel used by customer service personnel to communicate with users during insurance customer service, such as WeChat for Business and instant messaging (IM). The client presents the risk of phishing attacks. The server is responsible for capturing interaction data between customer service personnel and users during insurance customer service and analyzing whether there is phishing risk. When users receive customer service through the client, the server obtains the client's network service data, pre-processes it to obtain network feature data, and then predicts and processes this network feature data using a pre-set phishing detection model to generate phishing detection results. The pre-set phishing detection model includes optimized model parameters obtained through the Secretary Bird algorithm and back-propagation iterations. If the phishing detection result is confirmed to be an anomaly, a phishing warning is generated based on the result to prevent information leakage or financial losses caused by phishing attacks. The phishing detection method of the present invention enables automated detection, reducing the workload of customer service personnel and improving security. It also reduces the risk of data leakage and fraud during customer service for insurance companies, minimizing the economic losses to companies and users caused by phishing attacks. It also enhances the intelligent level of security control in the insurance industry, contributing to the stable and healthy development of the industry.

[0014] In one embodiment, if Figure 2 As shown, a phishing detection method is provided, comprising the following steps S10-S30: S10: Acquire network service data, and pre-process the network service data to obtain network feature data.

[0015] Understandably, during customer service interactions between customer service personnel and users, the server can trigger the phishing detection method process in real time, performing data processing and predictive analysis on each piece of network service data. The server can also automatically trigger the phishing detection method process at a fixed interval, such as obtaining client network service data every 10 minutes and performing data processing and predictive analysis. Network service data refers to various communication interaction data and information generated during customer service, such as online chat logs, visited websites, transmitted data packets, and emails. Network service data may contain potential phishing attack information and can serve as a basis for determining whether to detect phishing attacks. Network service data, as the raw data for model prediction, requires preprocessing to facilitate subsequent data analysis. Preprocessing is the process of processing network service data to increase model readability. Network feature data is extracted from raw data to characterize network content. This feature data helps the model identify malicious content, such as phishing emails and malicious websites.

[0016] In one embodiment, in step S10, that is, preprocessing the network service data to obtain network feature data, includes: S101, performing denoising processing on the network service data to obtain denoised text data; S102: converting the denoised text data using a preset feature conversion model to obtain the network feature data.

[0017] Understandably, during the preprocessing process, the network service data must first be denoised to produce denoised text data. Denoising and filtering refers to the removal of irrelevant information or noise from the network service data, including the removal of repeated, meaningless characters or strings (such as spaces, line breaks, special symbols, etc.), as well as punctuation. Denoised text data refers to the text data remaining after the denoising process is completed on the network service data.

[0018] During the preprocessing process, the denoised text data also needs to be converted through a preset feature conversion model to obtain network feature data. Conversion processing is the process of converting non-numerical features into numerical form. The preset feature conversion model is a pre-trained tool model for converting natural language into vectors. In one embodiment, Word2Vec is used as the preset feature conversion model, which can convert each word in the denoised text data into a unique high-dimensional space vector, so that these word vectors can mathematically represent their semantic relationships. The output of the preset feature conversion model is a multidimensional feature vector, which is used to represent information in multiple dimensions such as URLs, the number of HTML tags, and user access frequency in the denoised text data. Network feature data is data that has undergone feature conversion processing. These are completely represented in vector form and can be directly used for training or prediction of machine learning models.

[0019] This embodiment first removes irrelevant information or noise from the original data through denoising processing, ensuring the purity and accuracy of the data, and then further converts the text data into network feature data suitable for machine learning model processing through a preset feature conversion model, which helps to improve the subsequent model prediction efficiency.

[0020] S20. Predictively process the network feature data using a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained through Secretary Bird algorithm optimization and back-propagation iteration.

[0021] The preset phishing detection model is a pre-trained machine learning model used to predict whether a phishing attack has occurred based on network service data. It is a BP neural network (BP) model optimized using the Secretary Bird optimization algorithm (SBOA). The preset phishing detection model includes optimized model parameters, which are obtained by applying the Secretary Bird algorithm to the BP neural network parameters and performing backpropagation iterations. The input of the preset phishing detection model is pre-processed network feature data, and the output is the probability of a phishing attack occurring in the network service data. The phishing detection result is a symbol, such as "0" or "1," used to indicate whether a phishing attack has occurred in the network service data. When the probability value output by the preset phishing detection model is less than a preset probability threshold, the phishing detection result is "0," indicating that a phishing attack has not occurred in the network service data. When the probability value output by the preset phishing detection model is greater than or equal to the preset probability threshold, the phishing detection result is "1," indicating that a phishing attack has occurred in the network service data. The preset probability threshold is a pre-set probability threshold, such as 70%, used to determine the presence of a phishing attack.

[0022] In one embodiment, step S20, that is, before predicting the network feature data using a preset phishing detection model, includes: S201: Acquire pre-collected historical network service data, perform sample preprocessing on the historical network service data, and obtain sample feature data; S202: Obtain the constructed initial fishing detection model, and iteratively process the initial weight parameters and initial threshold parameters in the initial fishing detection model using the Secretary Bird optimization algorithm to obtain initial optimized weight parameters and initial optimized threshold parameters; S203: updating the parameters of the initial fishing detection model according to the initial optimized weight parameters and the initial optimized threshold parameters to obtain an optimized fishing detection model; S204: Train the optimized fishing detection model according to the sample feature data to obtain the preset fishing detection model.

[0023] Understandably, before predicting and processing the running feature data through the preset fishing detection model, it is necessary to first generate the preset fishing detection model through model training. In the preset fishing detection model, the optimization of the BP neural network by the Secretary Bird optimization algorithm is reflected in the optimization of the weight and threshold parameters. The BP neural network contains a multi-layer structure, each layer consists of multiple neurons, and the neurons are connected by "weight" and "threshold" parameters. Weights and thresholds are key parameters in the BP neural network, which determine how the model processes input data and generates outputs. In the existing technology, during the training process, the output error is calculated through forward propagation, and then the weights and thresholds are adjusted through a large number of back-propagation algorithms to reduce the error. The search process for weights and thresholds is complicated, so the Secretary Bird optimization algorithm is introduced to optimize the weight and threshold parameters.

[0024] First, obtain pre-collected historical network service data, perform sample preprocessing on the historical network service data, and obtain sample feature data. Historical network service data refers to the records of network customer service and corresponding phishing attacks within a specific historical time period, such as network service data in which phishing attacks occurred and network service data in which no phishing attacks occurred in the past month. As the raw data for model training, historical network service data also requires sample preprocessing to facilitate subsequent model training. Sample preprocessing is the process of processing historical network service data to increase model readability. In addition to data denoising and feature conversion, it also includes data labeling, which is the addition of status labels to characterize whether a phishing attack has occurred. After sample preprocessing, a training sample dataset is obtained. Each piece of sample feature data includes multi-dimensional feature data and the corresponding real phishing attack status label.

[0025] Secondly, the constructed BP neural network is determined as the initial fishing detection model, which includes initial weight parameters and initial threshold parameters. The initial weight parameters refer to the initial values ​​of the weight parameters that have not yet been optimized, and the initial threshold parameters refer to the initial values ​​of the threshold parameters that have not yet been optimized. Thirdly, the initial weight parameters and initial threshold parameters are iteratively optimized using the Secretary Bird optimization algorithm to obtain initial optimized weight parameters and optimized threshold parameters. The initial optimized weight parameters refer to the optimized values ​​of the weight parameters after the Secretary Bird optimization algorithm has been iterated, and the initial optimized threshold parameters refer to the optimized values ​​of the threshold parameters after the Secretary Bird optimization algorithm has been iterated. Thirdly, the parameters of the initial fishing detection model are updated based on the initial optimized weight parameters and initial optimized threshold parameters to obtain an optimized fishing detection model. The optimized fishing detection model refers to the model obtained by applying the initial optimized weight parameters and initial optimized threshold parameters to the BP neural network. Finally, the optimized fishing detection model is trained based on the sample feature data and the model parameters are further adjusted to obtain the preset fishing detection model.

[0026] This embodiment uses the BP neural network as the basic model to build a phishing detection model. The introduction of the Secretary Bird optimization algorithm can accelerate the iterative training of the model and obtain more accurate and appropriate weight and threshold parameters. The optimized weight and threshold settings can improve the generalization ability of the model, enabling the model to effectively identify phishing attacks in the network.

[0027] In one embodiment, in step S202, the iterative processing of the initial weight parameters and the initial threshold parameters by the Secretary Bird optimization algorithm to obtain the initial optimized weight parameters and the initial optimized threshold parameters includes: S2021. Perform an iterative optimization process on the initial weight parameter and the initial threshold parameter using the Secretary Bird optimization algorithm to obtain an updated weight parameter and an updated threshold parameter; S2022. Determine the mean square error of the initial fishing detection model as a fitness function in the Secretary Bird optimization algorithm, and determine a primary fitness value corresponding to the primary update weight parameter and the primary update threshold parameter based on the fitness function; S2023. When it is determined that the primary fitness value does not satisfy the preset fitness condition, performing a secondary iterative optimization process on the primary updated weight parameter and the primary updated threshold parameter using the Secretary Bird optimization algorithm to obtain a secondary updated weight parameter, a secondary updated threshold parameter, and a secondary fitness value, and recording the number of iterative optimization times. S2024. When the secondary fitness value satisfies a preset fitness condition and / or the number of iterative optimizations reaches a preset iteration threshold, the secondary updated weight parameter is determined as the initial optimization weight parameter, and the secondary updated threshold parameter is determined as the initial optimization threshold parameter.

[0028] Understandably, the Secretary Bird optimization algorithm requires an initialized population, where each individual in the population represents a set of weight parameters and threshold parameters of the BP neural network. The initialization formula for the Secretary Bird population is: .in, Indicates the The location of individual secretary birds; , represents the population size of secretary birds; Represents a random number in the range [0,1]; and They represent the upper and lower bounds of the j-th dimension of the optimization problem. When evaluating the fitness, the mean square error of the BP neural network is determined as the fitness function in the Secretary Bird optimization algorithm. The fitness function is .in, Indicates the The fitness function value of each secretary bird, that is, the objective function value; Indicates the number of training samples; Indicates the The true value of the samples; Indicates the The fitness function evaluates the contribution of each individual secretary bird's position to the optimization problem. In minimization problems, lower fitness function values ​​indicate that the secretary bird's position is closer to the optimal solution; in maximization problems, higher fitness function values ​​indicate that the secretary bird's position is closer to the optimal solution.

[0029] The Secretary Bird optimization algorithm performs a single iterative optimization on the initial weight parameters and initial threshold parameters, obtaining the single-updated weight parameters and the single-updated threshold parameters. The single-updated weight parameters refer to the optimal weight parameters corresponding to the Secretary Bird individual after the first iteration, and the single-updated threshold parameters refer to the optimal threshold parameters corresponding to the Secretary Bird individual after the first iteration. The mean squared error of the initial fishing detection model is used as the fitness function in the Secretary Bird optimization algorithm. Based on this fitness function, the single-updated fitness value corresponding to the single-updated weight parameters and the single-updated threshold parameters is determined, and the number of iterations is recorded. In this case, the number of iterations is 1. The single-updated fitness value refers to the objective function value of the Secretary Bird individual after the first iteration. The preset fitness condition is a pre-set critical condition for determining whether to terminate the iteration based on the objective function value. Specifically, it is the error rate threshold (minimum error rate threshold) between the objective function values ​​of two consecutive iterations. If the single-updated fitness value is determined to not meet the preset fitness condition, the Secretary Bird optimization algorithm performs a second iterative optimization on the single-updated weight parameters and the single-updated threshold parameters, obtaining the second-updated weight parameters, the second-updated threshold parameters, and the second-updated fitness value. The number of iterations is recorded. In this case, the number of iterations is 2.

[0030] When the quadratic fitness value meets the preset fitness condition and / or the number of iterative optimizations reaches the preset iteration threshold, the secondary update weight parameter is determined as the initial optimization weight parameter, and the secondary update threshold parameter is determined as the initial optimization threshold parameter. The preset iteration threshold is a pre-set critical condition for measuring whether it is necessary to stop the iteration from the dimension of the number of iterations. During the iterative process of the Secretary Bird algorithm, the iteration can be terminated if at least one of the preset fitness condition and the preset iteration threshold is met. For example, when the error rate between the objective function value of the second iteration and the objective function value of the first iteration is less than or equal to the error rate threshold, the iteration can be terminated regardless of whether the maximum number of iterations is reached.

[0031] In one embodiment, the population size of the secretary bird optimization algorithm is set to 50, that is, there are 50 secretary bird individuals in the search space for iterative search, and the preset iteration threshold (maximum iteration number) is set to 200 to ensure that the algorithm has enough time to find the global optimal solution.

[0032] This embodiment utilizes the Secretary Bird optimization algorithm to iteratively optimize the weight and threshold parameters of the BP neural network until the iteration termination condition is reached, thereby minimizing the network's mean squared error and facilitating rapid model iteration. This embodiment combines the powerful search capabilities of swarm intelligence algorithms with the robust learning capabilities of neural networks, improving model training efficiency and ensuring the accuracy of subsequent phishing detection.

[0033] In one embodiment, in step S2021, performing an iterative optimization process on the initial weight parameter and the initial threshold parameter using the Secretary Bird optimization algorithm to obtain an updated weight parameter and an updated threshold parameter includes: S20211. Obtain a first-iteration exploration parameter and a first-iteration development parameter of the Secretary Bird optimization algorithm, determine a Secretary Bird first-iteration model based on the first-iteration exploration parameter and the first-iteration development parameter, and perform a first-iteration optimization process on the initial weight parameter and the initial threshold parameter using the Secretary Bird first-iteration model to obtain a first-iteration weight parameter and a first-iteration threshold parameter; In step S2023, the first-update weight parameter and the first-update threshold parameter are subjected to a second-iterative optimization process by the Secretary Bird optimization algorithm to obtain a second-update weight parameter, a second-update threshold parameter and a second-fitness value, including: S20231. Update the first-iteration exploration parameters to second-iteration exploration parameters according to preset iteration rules, and update the first-iteration development parameters to second-iteration development parameters, determine the Secretary Bird second-iteration model according to the second-iteration exploration parameters and the second-iteration development parameters, and perform second-iteration optimization processing on the first-update weight parameters and the first-update threshold parameters through the Secretary Bird second-iteration model to obtain second-update weight parameters and second-update threshold parameters, and determine the second-iteration fitness values ​​corresponding to the second-update weight parameters and second-update threshold parameters according to the fitness function.

[0034] Understandably, in each iteration, the optimization process of the initial weight parameters and initial threshold parameters by the Secretary Bird optimization algorithm is divided into two stages. The first stage is the exploration stage, in which the Secretary Bird first determines the location of the prey and then moves to the area where the location is. The mathematical formula for the Secretary Bird to approach the prey is .in, Indicates the first Secretary bird individuals in the The position at the iteration; Indicates the first Secretary bird individuals in the The position at the iteration; Iterative exploration parameters representing the exploration phase; Represents a random number in the range [0,1]; Represents the current optimal solution position of the secretary bird. If the objective function value is improved, the position of the secretary bird is updated, and the formula is .in, Indicates the exploration phase The new position of the secretary bird individual, the values ​​of the group weight parameter and the threshold parameter; Indicates the first The fitness function value of the new position of the secretary bird individual, Indicates the The fitness function value of each secretary bird. The second stage is the development stage. When the secretary bird encounters danger, it will adopt various escape strategies to protect itself or its prey. The formula for the secretary bird's escape strategy is .in, represents the iterative development parameter in the development phase. The fitness function after updating in the development phase is .in, After one iteration, The new position of each secretary bird, that is, one update of the weight parameter and one update of the threshold parameter; After one iteration, The fitness function value of each secretary bird is the fitness value corresponding to one updated weight parameter and one updated threshold parameter.

[0035] The Secretary Bird single iteration model is a mathematical model that applies the single iteration exploration parameters and the single iteration development parameters to the exploration phase formula and the development phase formula. The Secretary Bird double iteration model is a mathematical model that applies the double iteration exploration parameters and the double iteration development parameters to the exploration phase formula and the development phase formula. In each iteration, the exploration phase's iterative exploration parameters are and iterative development parameters during the development phase The preset iteration rules are the mathematical operation rules for updating the iterative exploration parameters and iterative development parameters. That is, one iteration corresponds to one iterative exploration parameter and one iterative development parameter, and two iterations correspond to two iterative exploration parameters and two iterative development parameters. In the exploration phase, we hope that the algorithm can cover a larger search space, and the iterative exploration parameters The initial value of should be relatively large. Specifically, a value between 0.5 and 2 can be selected. As the iteration progresses, the importance of exploration gradually decreases, so it can be gradually reduced. The value of , the corresponding preset iteration rule formula is .in, Iterative exploration parameter representing the current number of iterations, represents the initial value of the iterative exploration parameter, Indicates the current iteration number, Indicates the maximum number of iterations. During the development phase, we hope that the algorithm can finely search the space near the currently known optimal solution and iteratively develop parameters The initial value of should be relatively small, specifically a value between 0.1 and 0.5, depending on the complexity of the problem and the characteristics of the search space. As the iteration proceeds, the importance of development gradually increases, so the iterative development parameter can be gradually increased. The value of , the corresponding preset iteration rule formula is .in, Iterative development parameter indicating the current number of iterations, Indicates the initial value of the iterative development parameter, Indicates the current iteration number, Indicates the maximum number of iterations.

[0036] In the iterative process of this embodiment, the iterative model of the Secretary Bird is adjusted by updating the iterative exploration parameters and the iterative development parameters. The adjusted exploration phase and development phase have a higher degree of coordination, which can improve the efficiency of the search iteration.

[0037] In one embodiment, the optimized model parameters include optimized weight parameters and optimized threshold parameters; in step S204, training the optimized fishing detection model based on the sample feature data to obtain the preset fishing detection model includes: S2041: Input the sample feature data into the optimized fishing detection model to obtain a sample prediction value output by the optimized fishing detection model; S2042. Obtain a true sample value corresponding to the sample feature data, and determine a sample error based on the sample prediction value and the true sample value; S2043: performing back propagation training on the optimized fishing detection model based on the sample error, and stopping the training when the sample error reaches a preset accuracy threshold, to obtain optimized weight parameters and optimized threshold parameters; S2044. Update the initial optimized weight parameters in the optimized fishing detection model to the optimized weight parameters, and update the initial optimized threshold parameters in the optimized fishing detection model to the optimized threshold parameters to obtain the preset fishing detection model.

[0038] It is understandable that after applying the initial optimized weight parameters and initial optimized threshold parameters to the BP neural network, if the resulting optimized phishing detection model is directly determined as the preset phishing detection model, prediction errors may occur. Therefore, the optimized phishing detection model can be further parameterized as needed. Sample feature data is input into the optimized phishing detection model to obtain a sample prediction value, i.e., a predicted probability value of a phishing attack, output by the optimized phishing detection model. The true sample value corresponding to the sample feature data is obtained, and the sample error, i.e., the loss function value, is determined based on the sample prediction value and the true sample value. Backpropagation training is performed on the optimized phishing detection model based on the sample error, and training is terminated when the sample error reaches a preset accuracy threshold, resulting in optimized weight parameters and optimized threshold parameters. The preset accuracy threshold is a pre-set error threshold for terminating backpropagation; for example, training is terminated when the sample error is less than the preset accuracy threshold. The optimized weight parameters refer to the weight parameter values ​​after the backpropagation algorithm iterations, and the optimized threshold parameters refer to the threshold parameter values ​​after the backpropagation algorithm iterations. The optimized weight parameters and optimized threshold parameters are applied to the optimized phishing detection model for parameter update, resulting in the preset phishing detection model.

[0039] This embodiment uses the Secretary Bird optimization algorithm to optimize the BP neural network, and obtains a fully trained and optimized model through back propagation. Back propagation continuously adjusts the parameters of the model to reduce errors, which helps to improve the detection accuracy of the preset fishing detection model.

[0040] S30. When it is confirmed that the fishing detection result is an abnormal fishing result, generate fishing warning information according to the fishing detection result.

[0041] It can be understood that phishing detection results include normal phishing results and abnormal phishing results. A phishing detection result of "0" is a normal phishing result, indicating that there is no phishing attack in the network service data (the probability of a phishing attack is low). A phishing detection result of "1" is an abnormal phishing result, indicating that there is a phishing attack in the network service data (the probability of a phishing attack is high). If the phishing detection result is a normal phishing result, there is no need to generate a phishing warning message. If the phishing detection result is an abnormal phishing result, a phishing warning message must be generated and sent to the pre-set notification recipients. The phishing warning message is used to alert the client's customer service personnel of the existence of a phishing attack on the network. Pre-set notification recipients include, on the one hand, the client corresponding to the source of the network service data, such as a phishing risk notification in the customer service chat window; on the other hand, it also includes the terminals of network security operations and maintenance personnel, so that network security operations and maintenance personnel can take appropriate measures to eliminate the risk, such as blocking suspicious URLs, contacting users to confirm their identities, and initiating emergency response plans.

[0042] This embodiment obtains network service data and pre-processes the network service data to obtain network feature data; the network feature data is predictively processed using a preset phishing detection model to obtain a phishing detection result; the preset phishing detection model includes optimized model parameters obtained through Secretary Bird algorithm optimization and back-propagation iteration; when the phishing detection result is confirmed to be an abnormal phishing result, phishing warning information is generated based on the phishing detection result. The preset phishing detection model of this embodiment improves the model training efficiency and generalization ability of the neural network by introducing the Secretary Bird optimization algorithm. This embodiment utilizes the optimized model to more promptly identify phishing attacks, ensure real-time detection, reduce false positives and false negatives, improve the accuracy of phishing detection, and ensure the effectiveness of phishing detection.

[0043] In one embodiment, step S30, i.e., after generating phishing warning information according to the phishing detection result, includes: S301, acquiring newly added historical network service data according to a preset time period, and determining updated sample feature data according to the newly added historical network service data; S302: Perform back propagation training on the preset fishing detection model according to the updated sample feature data to obtain an updated preset fishing detection model.

[0044] Understandably, after generating phishing warning information, in order to continuously improve the accuracy and efficiency of phishing detection, it is necessary to continuously introduce new network service data to update the preset phishing detection model. The preset time period refers to the period of time used to regularly collect network service data for model updates, such as daily, weekly, or monthly. The server automatically collects new network service data according to the preset time period. New network service data refers to new network service data generated during the preset time period since the last model update. This new historical network service data is pre-processed to extract feature data and true state labels corresponding to phishing attacks, thereby obtaining a new training sample dataset, namely, updated sample feature data. Updated sample feature data refers to sample data used to update and train the existing preset phishing detection model. The updated sample feature data is input into the preset phishing detection model, and the backpropagation algorithm is iterated to calculate the error between the model output and the true result. This error is then used to update the model's weight and threshold parameters, resulting in an updated preset phishing detection model. The updated preset phishing detection model can be applied to real-time network services to detect and warn of potential phishing attacks.

[0045] This embodiment regularly obtains new historical network service data and performs back-propagation training on the preset phishing detection model to obtain an updated model, thereby ensuring the timeliness of the preset phishing detection model and continuously improving its accuracy and efficiency in phishing detection.

[0046] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0047] In one embodiment, a phishing detection device is provided, which corresponds one-to-one to the phishing detection method in the above embodiment. Figure 3 As shown, the phishing detection device includes a data processing module 10, a model prediction module 20, and an early warning generation module 30. The functional modules are described in detail as follows: The data processing module 10 is used to obtain network service data and pre-process the network service data to obtain network feature data; a model prediction module 20 for predicting and processing the network feature data using a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained through Secretary Bird algorithm optimization and back propagation iteration; The warning generation module 30 is configured to generate fishing warning information according to the fishing detection result when the fishing detection result is confirmed to be an abnormal fishing result.

[0048] In one embodiment, the data processing module 10 includes: A denoising processing unit, configured to perform denoising processing on the network service data to obtain denoised text data; The conversion processing unit is used to convert the denoised text data through a preset feature conversion model to obtain the network feature data.

[0049] In one embodiment, the model prediction module 20 includes: A sample preprocessing unit, configured to obtain pre-collected historical network service data, perform sample preprocessing on the historical network service data, and obtain sample feature data; an initial optimization unit, configured to obtain a constructed initial fishing detection model, and iteratively process initial weight parameters and initial threshold parameters in the initial fishing detection model using a Secretary Bird optimization algorithm to obtain initial optimized weight parameters and initial optimized threshold parameters; a parameter updating unit, configured to update the parameters of the initial fishing detection model according to the initial optimized weight parameter and the initial optimized threshold parameter to obtain an optimized fishing detection model; A training optimization unit is used to train the optimized fishing detection model according to the sample feature data to obtain the preset fishing detection model.

[0050] In one embodiment, the model prediction module 20 further includes: a primary iterative optimization unit, configured to perform a primary iterative optimization process on the initial weight parameter and the initial threshold parameter using a Secretary Bird optimization algorithm to obtain a primary updated weight parameter and a primary updated threshold parameter; a primary fitness value determining unit, configured to determine the mean square error of the initial fishing detection model as a fitness function in the Secretary Bird optimization algorithm, and determine a primary fitness value corresponding to the primary update weight parameter and the primary update threshold parameter according to the fitness function; a secondary iterative optimization unit, configured to, when it is determined that the primary fitness value does not satisfy a preset fitness condition, perform secondary iterative optimization processing on the primary updated weight parameter and the primary updated threshold parameter using a secretary bird optimization algorithm to obtain a secondary updated weight parameter, a secondary updated threshold parameter, and a secondary fitness value, and record the number of iterative optimizations; An iteration end unit is used to determine the secondary updated weight parameter as the initial optimization weight parameter and the secondary updated threshold parameter as the initial optimization threshold parameter when the secondary fitness value meets the preset fitness condition and / or the number of iterative optimizations reaches a preset iteration threshold.

[0051] In one embodiment, the model prediction module 20 further includes: a parameter primary updating unit, configured to obtain a primary exploration parameter and a primary development parameter of the Secretary Bird optimization algorithm, determine a Secretary Bird primary iteration model according to the primary exploration parameter and the primary development parameter, and perform a primary iteration optimization process on the initial weight parameter and the initial threshold parameter using the Secretary Bird primary iteration model to obtain a primary updated weight parameter and a primary updated threshold parameter; A parameter secondary update unit is used to update the first-iteration exploration parameters to second-iteration exploration parameters according to preset iteration rules, and to update the first-iteration development parameters to second-iteration development parameters, determine the secretary bird secondary iteration model according to the second-iteration exploration parameters and the second-iteration development parameters, and perform secondary iteration optimization processing on the first-update weight parameters and the first-update threshold parameters through the secretary bird secondary iteration model to obtain secondary update weight parameters and secondary update threshold parameters, and determine the secondary fitness values ​​corresponding to the secondary update weight parameters and the secondary update threshold parameters according to the fitness function.

[0052] In one embodiment, the model prediction module 20 further includes: a sample prediction value determination unit, configured to input the sample feature data into the optimized fishing detection model to obtain a sample prediction value output by the optimized fishing detection model; a sample error determination unit, configured to obtain a sample true value corresponding to the sample feature data, and determine a sample error based on the sample predicted value and the sample true value; a back propagation training unit, configured to perform back propagation training on the optimized fishing detection model based on the sample error, and stop training when the sample error reaches a preset accuracy threshold, thereby obtaining an optimized weight parameter and an optimized threshold parameter; The preset fishing detection model generation unit is used to update the initial optimized weight parameters in the optimized fishing detection model to the optimized weight parameters, and to update the initial optimized threshold parameters in the optimized fishing detection model to the optimized threshold parameters to obtain the preset fishing detection model.

[0053] In one embodiment, the warning generation module 30 includes: A sample updating unit, configured to obtain newly added historical network service data according to a preset time period, and determine updated sample feature data according to the newly added historical network service data; A model updating unit is used to perform back-propagation training on the preset fishing detection model according to the updated sample feature data to obtain an updated preset fishing detection model.

[0054] The specific definition of the phishing detection device can be found in the definition of the phishing detection method above and will not be repeated here. Each module in the aforementioned phishing detection device may be implemented in whole or in part through software, hardware, or a combination thereof. Each of the aforementioned modules may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0055] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium and an internal memory. The readable storage medium stores an operating system, computer-readable instructions and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the readable storage medium. The database of the computer device is used to store data involved in the phishing detection method. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer-readable instructions are executed by the processor, a phishing detection method is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0056] In one embodiment, a computer device is provided, comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the following steps are implemented: Acquiring network service data, and preprocessing the network service data to obtain network feature data; Predicting and processing the network feature data using a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained after Secretary Bird algorithm optimization and back propagation iteration; When it is confirmed that the fishing detection result is an abnormal fishing result, fishing warning information is generated according to the fishing detection result.

[0057] In one embodiment, one or more computer-readable storage media storing computer-readable instructions are provided. The computer-readable storage media provided in this embodiment include non-volatile computer-readable storage media and volatile computer-readable storage media. The computer-readable storage media store computer-readable instructions that, when executed by one or more processors, implement the following steps: Acquiring network service data, and preprocessing the network service data to obtain network feature data; Predicting and processing the network feature data using a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained after Secretary Bird algorithm optimization and back propagation iteration; When it is confirmed that the fishing detection result is an abnormal fishing result, fishing warning information is generated according to the fishing detection result.

[0058] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through computer-readable instructions. The computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, the computer-readable instructions can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0059] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0060] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A phishing detection method, characterized in that: include: Acquire network service data, pre-process the network service data, and obtain network characteristic data; The network feature data is predicted and processed by a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained after secretary bird algorithm optimization and back propagation iteration; When it is confirmed that the fishing detection result is an abnormal fishing result, fishing warning information is generated according to the fishing detection result.

2. The phishing detection method according to claim 1, characterized in that: The preprocessing of the network service data to obtain network feature data includes: Performing denoising processing on the network service data to obtain denoised text data; The denoised text data is converted using a preset feature conversion model to obtain the network feature data.

3. The phishing detection method according to claim 1, wherein: Before predicting and processing the network feature data by using a preset phishing detection model, the method includes: Acquire pre-collected historical network service data, perform sample preprocessing on the historical network service data, and obtain sample feature data; Obtaining the constructed initial fishing detection model, and iteratively processing the initial weight parameters and initial threshold parameters in the initial fishing detection model by using the Secretary Bird optimization algorithm to obtain initial optimized weight parameters and initial optimized threshold parameters; Update the parameters of the initial fishing detection model according to the initial optimization weight parameter and the initial optimization threshold parameter to obtain an optimized fishing detection model; The optimized fishing detection model is trained according to the sample feature data to obtain the preset fishing detection model.

4. The phishing detection method according to claim 3, characterized in that: The iterative processing of the initial weight parameter and the initial threshold parameter by the Secretary Bird optimization algorithm to obtain the initial optimized weight parameter and the initial optimized threshold parameter includes: Performing an iterative optimization process on the initial weight parameter and the initial threshold parameter by using the Secretary Bird optimization algorithm to obtain an updated weight parameter and an updated threshold parameter; Determine the mean square error of the initial fishing detection model as a fitness function in the secretary bird optimization algorithm, and determine a primary fitness value corresponding to the primary update weight parameter and the primary update threshold parameter according to the fitness function; When it is confirmed that the primary fitness value does not meet the preset fitness condition, the primary update weight parameter and the primary update threshold parameter are subjected to secondary iterative optimization processing by the secretary bird optimization algorithm to obtain a secondary update weight parameter, a secondary update threshold parameter and a secondary fitness value, and the number of iterative optimization times is recorded; When the secondary fitness value satisfies a preset fitness condition and / or the iterative optimization times reaches a preset iteration times threshold, the secondary updated weight parameter is determined as the initial optimization weight parameter, and the secondary updated threshold parameter is determined as the initial optimization threshold parameter.

5. The phishing detection method according to claim 4, characterized in that: The method of performing an iterative optimization process on the initial weight parameter and the initial threshold parameter by using the Secretary Bird optimization algorithm to obtain an updated weight parameter and an updated threshold parameter includes: Obtaining a first iteration exploration parameter and a first iteration development parameter of the Secretary Bird optimization algorithm, determining a Secretary Bird first iteration model according to the first iteration exploration parameter and the first iteration development parameter, and performing a first iteration optimization process on the initial weight parameter and the initial threshold parameter through the Secretary Bird first iteration model to obtain a first update weight parameter and a first update threshold parameter; The second iteration optimization process of the first update weight parameter and the first update threshold parameter by the secretary bird optimization algorithm to obtain the second update weight parameter, the second update threshold parameter and the second fitness value includes: According to preset iteration rules, the first iteration exploration parameters are updated to second iteration exploration parameters, and the first iteration development parameters are updated to second iteration development parameters. The secretary bird second iteration model is determined according to the second iteration exploration parameters and the second iteration development parameters. The first update weight parameters and the first update threshold parameters are subjected to second iteration optimization processing through the secretary bird second iteration model to obtain second update weight parameters and second update threshold parameters. According to the fitness function, the second fitness values ​​corresponding to the second update weight parameters and the second update threshold parameters are determined.

6. The phishing detection method according to claim 3, characterized in that: The optimization model parameters include optimization weight parameters and optimization threshold parameters; The step of training the optimized fishing detection model according to the sample feature data to obtain the preset fishing detection model includes: Inputting the sample feature data into the optimized fishing detection model to obtain a sample prediction value output by the optimized fishing detection model; Obtaining a sample true value corresponding to the sample feature data, and determining a sample error according to the sample predicted value and the sample true value; Performing back propagation training on the optimized fishing detection model based on the sample error, and stopping the training when the sample error reaches a preset accuracy threshold, to obtain an optimized weight parameter and an optimized threshold parameter; The initial optimized weight parameters in the optimized fishing detection model are updated to optimized weight parameters, and the initial optimized threshold parameters in the optimized fishing detection model are updated to optimized threshold parameters to obtain the preset fishing detection model.

7. The phishing detection method according to claim 1, wherein: After generating the fishing warning information according to the fishing detection result, the method includes: Acquire newly added historical network service data according to a preset time period, and determine updated sample feature data according to the newly added historical network service data; The preset fishing detection model is back-propagated and trained according to the updated sample feature data to obtain an updated preset fishing detection model.

8. A phishing detection device, characterized in that: include: A data processing module, used to obtain network service data, pre-process the network service data, and obtain network feature data; A model prediction module, used to predict and process the network feature data through a preset fishing detection model to obtain a fishing detection result; the preset fishing detection model includes optimized model parameters obtained after secretary bird algorithm optimization and back propagation iteration; The warning generation module is used to generate fishing warning information according to the fishing detection result when it is confirmed that the fishing detection result is an abnormal fishing result.

9. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that: When the processor executes the computer-readable instructions, the phishing detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by one or more processors, the one or more processors are caused to perform the phishing detection method according to any one of claims 1 to 7.

Images