A phishing webpage detection method fusing URL character and HTML content semantics

Abstract

The application discloses a phishing webpage detection method fusing URL characters and HTML content semantics, fine extraction of URL character-level local features based on a multi-scale convolution strategy, parallel processing of URL strings by using CNNs with different size convolution kernels, extraction of features with different granularities, comprehensive capture of multi-level information of data, enhancement of sensitivity of a model to potential threats of URL, extraction of HTML text word-level features based on a cascaded dense connection CNN architecture, extraction of deeper and finer semantic features by stacking multiple convolution layers and establishing dense connections between convolution blocks, fusion of URL feature characters and HTML features by a full connection layer, and calculation of corresponding probabilities to determine whether the URL is a phishing webpage or not. The application fully utilizes advantages of a deep learning algorithm, integrates features of URL characters and HTML contents of a phishing webpage, forms more comprehensive semantic representation, and greatly improves the recognition rate of phishing webpage detection.

Description

Technical Field

[0001] The present invention relates to network security and computer information security technology, and in particular to a phishing webpage detection method that integrates URL characters and HTML content semantics. Background Art

[0002] Phishing is a social engineering-based attack that tricks users into entering sensitive information by disguising itself as a legitimate website. Currently, phishing poses a significant threat to cybersecurity. According to a report by the Anti-Phishing Working Group (APWG), 1,007,501 phishing attacks were observed in the fourth quarter of 2023, bringing the annual total to nearly 5 million. 42.8% of these attacks targeted social media platforms. Faced with this growing threat, effective detection and prevention methods are urgently needed to protect users' network and information security.

[0003] At present, in addition to improving the ability of Internet users to identify phishing attacks through training, many automatic phishing detection technologies and methods can be mainly divided into four categories: blacklist technology, heuristic rules, traditional machine learning methods and deep learning technology.

[0004] (1) Blacklist-based detection technology

[0005] Blacklist-based phishing detection methods identify and block phishing attacks by maintaining a list of known malicious addresses. While this method can prevent users from accessing known phishing sites, it has significant drawbacks: it only addresses known threats and is ineffective against emerging attacks, and it is costly to maintain. False positives can also disrupt normal business operations, and attackers can evade detection by changing domain names or using dynamic IP addresses. Therefore, blacklist technology needs to be combined with other detection methods to enhance protection effectiveness.

[0006] (2) Visual similarity check

[0007] Visual similarity checking is a method for detecting phishing attacks by analyzing the visual characteristics of web pages. It compares visual elements of the target webpage with known legitimate webpages, such as layout, color, and icons, to identify potentially malicious websites. This method can detect phishing websites attempting to mimic legitimate websites, even if the domain name or other textual information differs. However, visual similarity checking can sometimes be affected by dynamic page changes, resulting in false positives or false negatives. Therefore, it must be combined with other detection methods to ensure comprehensive security protection.

[0008] (3) Detection methods based on machine learning

[0009] Machine learning-based detection methods automatically identify phishing attack patterns by analyzing large amounts of data. By training models, the system can identify potential phishing attacks from a variety of inputs, including email content, URL features, and web page content. This approach not only detects known threats but also new and variant attacks. While machine learning detection methods offer advantages in efficiency and accuracy, their effectiveness relies on the quality of feature extraction. Manual feature extraction is time-consuming and error-prone, and often struggles to adapt to evolving attack methods.

[0010] (4) Detection methods based on deep learning

[0011] Deep learning-based detection methods automatically identify phishing attack patterns through a multi-layer neural network. The system autonomously learns features from a rich data source, including email text, URL features, and web page content, without requiring human intervention. This approach possesses powerful nonlinear modeling capabilities, capturing complex attack signatures and enabling the detection of not only known threats but also new and variant attacks. Deep learning models excel at processing large amounts of data, and parallel computing and efficient algorithm optimization accelerate model training and prediction processes.

[0012] For example, the model in patent US11438377B1 uses a single-pass convolution to extract URL features, which suffers from incomplete feature extraction and fails to fully capture the complex information of the URL. Furthermore, the BERT model has a limited processing capacity for parsed HTML content and cannot consistently process long texts. Furthermore, the content of phishing webpages changes dynamically, and using pre-trained embeddings may not accurately reflect the actual features, resulting in the extraction of redundant features. Furthermore, this existing technology has high computational and storage requirements, making it difficult to deploy on resource-constrained devices. Summary of the Invention

[0013] Purpose of the invention: The purpose of the present invention is to address the deficiencies in the prior art and provide a phishing webpage detection method that integrates URL characters and HTML content semantics. The present invention utilizes CNNs with convolution kernels of different sizes to process URL strings in parallel and extract features of different granularities. By stacking multiple convolutional layers and establishing dense connections between convolutional blocks, the present invention extracts different granularities and long-distance text features of HTML content. While maintaining efficiency, the present invention can more accurately extract webpage features and perform effective classification.

[0014] Technical Solution: The present invention provides a phishing webpage detection method that integrates URL characters and HTML content semantics, comprising the following steps:

[0015] Step S1: Obtain a webpage sample dataset, where the webpage sample dataset includes phishing webpages and corresponding URL address strings, HTML documents, and legitimate webpages and corresponding URL address strings, HTML documents;

[0016] Step S2: Use character embedding technology to transform the URL address string into a URL character vector, and then use convolution kernels CNN of different sizes to process the URL character vector in parallel, so as to extract features of different granularities and realize automatic extraction of deep features of phishing websites, and obtain URL character features F url ;

[0017] Step S3: Use the Beautiful Soup library to parse the HTML document and perform word frequency analysis on the parsed content to remove noise and retain key semantic information;

[0018] Step S4: Use word-level embedding technology to transform the HTML document content processed in step S3 into word-level embedding vectors. By stacking multiple convolutional layers and establishing dense connections between convolutional blocks, a single-layer CNN captures fine-grained semantic features, while a multi-layer cascaded densely connected CNN more effectively captures long-distance text information between word-level embedding vectors, and obtains the HTML content feature F html ;

[0019] Step S5: The URL character feature F obtained in step S2 is url and the HTML content feature F obtained in step S4 html Splice to get the mixed feature F hybrid , then the mixed feature F hybrid Substitute the data into two fully connected layers for classification training, and use the trained neural network as a deep feature extractor to obtain the final phishing webpage detection model.

[0020] Step S6: Send the web page to be detected to the phishing web page detection model trained in step S5 for classification, determine whether the target web page is legal, and inform the user of the detection result, thereby reducing the risk of phishing.

[0021] Furthermore, the specific method of obtaining the webpage sample data set in step S1 is:

[0022] First, the URL address of the network resource (such as email, website, etc.) accessed by the user is detected, including the link accessed by the user by clicking the mouse and the URL address string of the target web page obtained by entering it in the address bar and pressing the Enter key; then the HTML content of the web page is obtained by injecting a script. The content script can run in real time and grab the complete HTML document of the current page.

[0023] Furthermore, the detailed method of converting the URL address string into a URL character vector in step S2 is as follows (the context information of the URL is considered when generating the vector, so that the same character or word can have different embedding vectors in different contexts, thereby achieving accurate extraction of sensitive characters);

[0024] (a) Data preprocessing: The length of each URL address string is fixed to n. If the string length is less than n, it is padded with 0 until its length reaches n. If the string length exceeds n, the content after the nth character is deleted.

[0025] (b) Create a character vocabulary: add all unique characters including letters, numbers and special characters in the URL characters in the web page sample dataset into the vocabulary;

[0026] (c) Character Embedding: Use the embedding layer to map each URL character into a high-dimensional vector space. By assigning a unique integer index to each character, the URL is converted into an integer sequence, and each character is converted into a corresponding specific vector. Finally, an n×d matrix U is obtained, which is expressed as follows:

[0027] U=(e1,e2,…,e n );

[0028] d is the dimension of embedding, e i Indicates the representation of a character in the URL string, i = 1, 2, ..., n.

[0029] Furthermore, the detailed method of extracting character features from the URL character vector in step S2 is as follows:

[0030] First, a CNN network module with multiple convolution kernels of different sizes is used in parallel to extract character combination features of URL characters at different scales.

[0031] Then, each convolution kernel in the CNN network module is followed by a pooling layer (such as a maximum pooling layer), which performs feature dimensionality reduction and retains important features.

[0032] Finally, the important features extracted by different convolution kernels are spliced ​​to form a unified feature vector representation F url ; F url Subsequent classification or other tasks provide rich input information.

[0033] Furthermore, in step S3, the specific method of reading the HTML document content and using the Beautiful Soup library to parse the HTML document of the web page is as follows:

[0034] First, HTML tags are removed, leaving only the plain text portion, which provides the main semantic information of the web page. Then, the retained plain text content is subjected to word frequency analysis to calculate the frequency of each word in the text. Finally, noise words, such as stop words, meaningless numbers and symbols, are removed to reduce interference with the detection results.

[0035] Furthermore, the specific method of step S4 is:

[0036] Step a), data preprocessing, that is, fixing the word length of each HTML document content to m, if the word length of the HTML document content is less than m, then padding it with 0 until its length is m, if the word length of the HTML document content exceeds m, then deleting the content after the mth word;

[0037] Step b) creating a word vocabulary, that is, for the HTML document content obtained in step S3, dividing its content into independent words, treating punctuation characters as separate tokens, and then establishing a corresponding word vocabulary;

[0038] Step c) Word-level embedding: Use the embedding layer to map each word in the HTML document content to a high-dimensional vector space. By assigning a unique integer index to each word, the HTML document content is converted into an integer sequence, and each word is converted into a corresponding specific vector. Finally, an m×d matrix H is obtained, which is expressed as follows:

[0039] H=(x1,x2,…,x m );

[0040] x j represents the representation of a word in HTML content, j = 1, 2, ..., m; d is the embedding dimension.

[0041] Furthermore, step S4 stacks multiple convolutional layers and establishes dense connections between convolutional blocks. Single-layer CNN captures fine-grained semantic features, while multi-layer cascaded densely connected CNN captures long-distance text information more effectively. The specific method for extracting HTML content features is as follows:

[0042] Step a) Input the word-level embedding vector formed by the HTML content into the first convolutional layer of CNN, where the convolution kernel size is 1;

[0043] Step b) Input the output of the first convolutional layer into a pooling layer with a stride of 2 to perform feature dimensionality reduction;

[0044] Step c) Input the output of the first pooling layer to the second convolutional layer, where the convolution kernel size is 3;

[0045] Step d) Input the output of the second convolutional layer into a pooling layer with a stride of 2 to further reduce the dimensionality and extract important features;

[0046] Step e) Concatenate the output of the first convolutional layer and the output of the second convolutional layer to the third convolutional layer, where the convolution kernel size is 3; through the dense connection mechanism, the features are fused layer by layer to enhance the model's ability to capture long-distance text information;

[0047] Step f) Record the convolution results of each module and concatenate them to obtain the final HTML content feature F html ; F html It contains multi-level fine-grained and long-range semantic information, providing rich feature representation for subsequent classification or detection tasks.

[0048] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0049] 1. This paper proposes a multi-scale convolution strategy for fine-grained extraction of URL character-level local features. Using CNNs with convolution kernels of different sizes to process URL strings in parallel, this method extracts features of varying granularity, thereby comprehensively capturing the multi-level information of the data.

[0050] 2. This paper uses a cascaded densely connected CNN architecture to extract word-level features from HTML text. By stacking multiple convolutional layers and establishing dense connections between convolutional blocks, this architecture allows a single-layer CNN to capture fine-grained semantic features, while a multi-layer cascaded densely connected CNN can more effectively capture long-range text information, thereby extracting deeper and finer-grained semantic features.

[0051] 3. This paper proposes a multi-layered, fine-grained, deep semantic feature fusion mechanism for URL characters and HTML content. Using a fully connected layer to fuse these two types of information, the model enhances its ability to characterize phishing website features, thereby improving recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is the overall flow chart of the present invention;

[0053] Figure 2 Flowchart of URL feature extraction in the embodiment;

[0054] Figure 3 This is a flowchart of HTML content feature extraction in the embodiment;

[0055] Figure 4 Flowchart of an embodiment using a fully connected layer to fuse URL character and HTML content semantic classification. DETAILED DESCRIPTION

[0056] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0057] like Figure 1 As shown, the phishing webpage detection method of the present invention that integrates URL characters and HTML content semantics includes the following steps:

[0058] Step S1: Obtain a webpage sample dataset, where the webpage sample dataset includes phishing webpages and corresponding URL address strings, HTML documents, and legitimate webpages and corresponding URL address strings, HTML documents;

[0059] Step S2: Use character embedding technology to transform the URL address string into a URL character vector, and then use convolution kernels CNN of different sizes to process the URL character vector in parallel, so as to extract features of different granularities and realize automatic extraction of deep features of phishing websites, and obtain URL character features F url ;

[0060] Step S3: Use the Beautiful Soup library to parse the HTML document and perform word frequency analysis on the parsed content to remove noise and retain key semantic information;

[0061] Step S4: Use word-level embedding technology to transform the HTML document content processed in step S3 into word-level embedding vectors. By stacking multiple convolutional layers and establishing dense connections between convolutional blocks, a single-layer CNN captures fine-grained semantic features, while a multi-layer cascaded densely connected CNN more effectively captures long-distance text information between word-level embedding vectors, and obtains the HTML content feature F html ;

[0062] Step S5: The URL character feature F obtained in step S2 is url and the HTML content feature F obtained in step S4 html Splice to get the mixed feature F hybrid , then the mixed feature F hybrid Substitute the data into two fully connected layers for classification training, and use the trained neural network as a deep feature extractor to obtain the final phishing webpage detection model.

[0063] Step S6: Send the web page to be detected to the phishing web page detection model trained in step S5 for classification, determine whether the target web page is legal, and inform the user of the detection result, thereby reducing the risk of phishing.

[0064] The specific method of obtaining the webpage sample dataset in step S1 of this embodiment is:

[0065] First, the URL address of the network resource accessed by the user is detected, including the link accessed by the user by clicking the mouse and the URL address string of the target web page obtained by entering it in the address bar and pressing the Enter key; then the HTML content of the web page is obtained by injecting a script. The content script can run in real time and grab the complete HTML document of the current page.

[0066] The detailed method of converting the URL address string into a URL character vector in step S2 of this embodiment is as follows:

[0067] (a) Data preprocessing: The length of each URL address string is fixed to n. If the string length is less than n, it is padded with 0 until its length reaches n. If the string length exceeds n, the content after the nth character is deleted. The URL is then converted to the target encoding based on the mapping relationship between the set characters and integers.

[0068] (b) Create a character vocabulary: add all unique characters including letters, numbers and special characters in the URL characters in the web page sample dataset into the vocabulary;

[0069] (c) Character Embedding: Use the embedding layer (which converts sparse vectors to dense vectors) to map each URL character into a high-dimensional vector space. By assigning a unique integer index to each character, the URL is converted into an integer sequence, and each character is converted into a corresponding specific vector. Finally, an n×d matrix U is obtained, which is expressed as follows:

[0070] U=(e1,e2,…,e n );

[0071] d is the dimension of embedding, e i Indicates the representation of a character in the URL string, i = 1, 2, ..., n.

[0072] This example segments the URL string into characters and converts each character into a vector. First, different characters in the URL are mapped to different integers. A vocabulary is created based on all unique characters (including letters, numbers, and special characters) in the URLs in the dataset. By performing statistical analysis on the URLs in the dataset, the number of character types N that appear is determined. Because neural networks can only process fixed-length vectors, this example sets the URL length to a fixed value.

[0073] like Figure 2 As shown, the detailed method of extracting character features from the URL character vector in step S2 of this embodiment is as follows:

[0074] First, a CNN network module with multiple convolution kernels of different sizes is used in parallel to extract character combination features of URL characters at different scales; the sizes of the two convolution kernels are h1 and h2;

[0075] The formulas for extracting features using these two convolution kernels are as follows:

[0076]

[0077] In the above formula, C i It is represented by the character window e i New features generated; w∈R k×his the weight matrix, k is the number of channels, h is the convolution kernel size; b is the bias term; . represents the convolution operation; f1 is the ReLU activation function;

[0078] Then, each convolution kernel in the CNN network module is followed by a pooling layer, which performs feature dimensionality reduction and retains important features. The expression is as follows:

[0079] F url1 =maxpooling(C1);

[0080] F url2 =maxpooling(C2);

[0081] Finally, the important features extracted by different convolution kernels are spliced ​​to form a unified feature vector representation F url ;

[0082] F url =Concat(F url1 ,F url2 ).

[0083] In step S3 of this embodiment, the HTML document content is read and the specific method of using the Beautiful Soup library to parse the HTML document of the web page is as follows:

[0084] First, remove HTML tags and keep only the plain text part; then, perform word frequency analysis on the retained plain text content to calculate the frequency of each word in the text; finally, remove noise words.

[0085] The specific method for processing the HTML document of the web page obtained above is:

[0086] Step a), data preprocessing, that is, fixing the word length of each HTML document content to m, if the word length of the HTML document content is less than m, then padding it with 0 until its length is m, if the word length of the HTML document content exceeds m, then deleting the content after the mth word;

[0087] Step b) creating a word vocabulary, that is, for the HTML document content obtained in step S3, dividing its content into independent words, treating punctuation characters as separate tokens, and then establishing a corresponding word vocabulary;

[0088] Step c) Word-level embedding: Use the embedding layer to map each word in the HTML document content to a high-dimensional vector space. By assigning a unique integer index to each word, the HTML document content is converted into an integer sequence, and each word is converted into a corresponding specific vector. Finally, an m×d matrix H is obtained, which is expressed as follows:

[0089] H=(x1,x2,…,x m );

[0090] x j represents the representation of a word in HTML content, j = 1, 2, ..., m; d is the embedding dimension.

[0091] like Figure 3 As shown, the matrix H obtained in step S4 of this embodiment is input into a 3-layer cascaded densely connected CNN for deep feature extraction. Under this architecture, a single-layer CNN captures fine-grained semantic features, while a multi-layer cascaded densely connected CNN more effectively captures long-distance text information, thereby extracting deeper and finer-grained semantic features. The specific method is as follows:

[0092] Step a) Input the word-level embedding vector formed by the HTML content into the first convolutional layer of CNN, where the convolution kernel size of the layer is 1; Step b) Input the output of the first convolutional layer into the pooling layer with a stride of 2 to perform feature dimensionality reduction; Step c) Input the output of the first pooling layer into the second convolutional layer; Step d) Input the output of the second convolutional layer into the pooling layer with a stride of 2 to further reduce the dimensionality and extract important features; Step e) Concatenate the output of the first convolutional layer and the output of the second convolutional layer into the third convolutional layer; Through the dense connection mechanism, the features are fused layer by layer to enhance the model's ability to capture long-distance text information; Step f) Record the convolution results of each module and splice them together to obtain the final HTML content feature F html .

[0093] The specific expression of the above process is as follows:

[0094] After convolution, the output of each intermediate layer is as follows:

[0095]

[0096] Among them, X l ∈R m×k ; l is the index of each layer; k is the dimension of the feature representation after conversion.

[0097] The model connects the output of the upstream layer X1, X2, ..., X l-1 As input, and generate feature maps for the current layer, both are as follows:

[0098] X l =f(w l .[X1,X2,…,X l-1 ]);

[0099] Among them, [X1,X2,…,X l-1] is the feature map generated by the 1st, 2nd, ..., l-1th layers; X i ∈R m×k ;w l ∈R (l -1)×k×w×k is the weight matrix, and (l-1)×k is the sum of the number of feature map channels generated by all previous layers; w represents the size of the convolution kernel; k represents the number of convolution output channels; the composite function f consists of convolution, batch normalization and ReLU functions.

[0100] The different granularity features of the input data are extracted through multiple convolution modules; then, these feature vectors are input to the maximum pooling layer for downsampling, retaining the most representative features, significantly reducing the data dimension, and improving the prediction performance; after the maximum pooling process, the important feature vectors are spliced ​​to obtain F html :

[0101] F html =maxpooling([X1,X2,…,X l ]).

[0102] Step S5 takes the URL character feature F obtained in step S2 and url and the HTML content feature F obtained in step S4 html Splice to get the mixed feature F hybrid , then the mixed feature F hybrid Substitute into two fully connected layers for classification training.

[0103] The specific expression of the above process is as follows:

[0104] like Figure 4 As shown, this embodiment uses URL character level features F url and F html Combined to generate mixed features F hybrid :

[0105] F hybrid =concat(F url ,F html );

[0106] Then, the mixed features are input into two fully connected layers. Let the weight matrix w1 of the first fully connected layer be and the bias be b1, and the output be H1;

[0107] Secondly, H1 is substituted into the second fully connected layer. The weight matrix of the second fully connected layer is w2, the bias is b2, and the sigmoid activation function is used to obtain the binary classification result output.

[0108] The classification mapping process is as follows:

[0109] H1=relu(w1F hybrid +b1);

[0110] output = sigmoid(w2H1+b2);

[0111] In step S6, the web page to be detected is sent to the detection model trained in step S5 for classification, to determine whether the target web page is legal, and the detection result is notified to the user, thereby reducing the risk of phishing.

Claims

1. A phishing webpage detection method that integrates URL characters and HTML content semantics, characterized in that: The following steps are involved: Step S1: Obtain a webpage sample dataset, where the webpage sample dataset includes phishing webpages and corresponding URL address strings, HTML documents, and legitimate webpages and corresponding URL address strings, HTML documents; Step S2: Use character embedding technology to transform the URL address string into a URL character vector, and then use convolution kernels CNN of different sizes to process the URL character vector in parallel, so as to extract features of different granularities, realize the automatic extraction of deep features of phishing websites, and obtain URL character features. ; Step S3: Use the Beautiful Soup library to parse the HTML document and perform word frequency analysis on the parsed content to remove noise and retain key semantic information; Step S4: Use word-level embedding technology to transform the HTML document content processed in step S3 into word-level embedding vectors. By stacking multiple convolutional layers and establishing dense connections between convolutional blocks, a single-layer CNN captures fine-grained semantic features, while a multi-layer cascaded densely connected CNN more effectively captures long-distance text information between word-level embedding vectors to obtain HTML content features. ; Step S5: The URL character features obtained in step S2 are and the HTML content features obtained in step S4 Splicing to get mixed features , then the mixed features Substitute the data into two fully connected layers for classification training, and use the trained neural network as a deep feature extractor to obtain the final phishing webpage detection model. Step S6: Send the web page to be detected to the phishing web page detection model trained in step S5 for classification, determine whether the target web page is legal, and inform the user of the detection result, thereby reducing the risk of phishing.

2. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1 is characterized in that: The specific method of obtaining the webpage sample dataset in step S1 is: First, the URL address of the network resource accessed by the user is detected, including the link accessed by the user by clicking the mouse and the URL address string of the target web page obtained by entering it in the address bar and pressing the Enter key; then the HTML content of the web page is obtained by injecting a script, which runs in real time to crawl the complete HTML document of the current page.

3. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1 is characterized in that: The detailed method of converting the URL address string into a URL character vector in step S2 is as follows: (a) Data preprocessing: The length of each URL address string is fixed to n. If the string length is less than n, it is padded with 0 until its length reaches n. If the string length exceeds n, the content after the nth character is deleted. (b) Create a character vocabulary: add all unique characters including letters, numbers and special characters in the URL characters in the web page sample dataset into the vocabulary; (c) Character Embedding: Use the embedding layer to map each URL character into a high-dimensional vector space. By assigning a unique integer index to each character, the URL is converted into an integer sequence, and each character is converted into a corresponding specific vector. Finally, an n×d matrix U is obtained, which is expressed as follows: ； d is the dimension of the embedding, Indicates the representation of a character in the URL string, i=1, 2, ..., n.

4. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1, characterized in that: The detailed method of extracting character features from the URL character vector in step S2 is as follows: First, a CNN network module with multiple convolution kernels of different sizes is used in parallel to extract character combination features of URL characters at different scales. Then, each convolution kernel in the CNN network module is followed by a pooling layer, which performs feature dimensionality reduction and retains important features; Finally, the important features extracted by different convolution kernels are spliced ​​to form a unified feature vector representation .

5. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1, characterized in that: In step S3, the HTML document content is read and the specific method of using the Beautiful Soup library to parse the HTML document of the web page is as follows: First, remove HTML tags and keep only the plain text part; then, perform word frequency analysis on the retained plain text content to calculate the frequency of each word in the text; finally, remove noise words.

6. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1, characterized in that: The specific method of step S4 is: Step a), data preprocessing, that is, fixing the word length of each HTML document content to m, if the word length of the HTML document content is less than m, then padding it with 0 until its length is m, if the word length of the HTML document content exceeds m, then deleting the content after the mth word; Step b) creating a word vocabulary, that is, for the HTML document content obtained in step S3, dividing its content into independent words, treating punctuation characters as separate tokens, and then establishing a corresponding word vocabulary; Step c) Word-level embedding: using the embedding layer to map each word in the HTML document content to a high-dimensional vector space, by assigning a unique integer index to each word, converting the HTML document content into an integer sequence, and converting each word into a corresponding specific vector, ultimately obtaining an m×d matrix. , the expression is as follows: ； Represents the representation of a word in HTML content, j = 1, 2, ..., m; d is the embedding dimension.

7. The phishing webpage detection method integrating URL characters and HTML content semantics according to claim 1, characterized in that: The specific method of extracting HTML content features in step S4 is: Step a) Input the word-level embedding vector formed by the HTML content into the first convolutional layer of CNN, where the convolution kernel size is 1; Step b) Input the output of the first convolutional layer into a pooling layer with a stride of 2 to perform feature dimensionality reduction; Step c) Input the output of the first pooling layer into the second convolutional layer; Step d) Input the output of the second convolutional layer into a pooling layer with a stride of 2 to further reduce the dimensionality and extract important features; Step e) Concatenate the output of the first convolutional layer and the output of the second convolutional layer to the third convolutional layer; through the dense connection mechanism, the features are integrated layer by layer to enhance the model's ability to capture long-distance text information; Step f) Record the convolution results of each module and concatenate them to obtain the final HTML content features. .

Images