Phishing mail deep detection method based on word frequency and context semantic multi-feature fusion

Abstract

The invention discloses a phishing mail deep detection method based on word frequency and context semantic multi-feature fusion, which shows remarkable innovation in the aspect of improving the ability of a model to process diversified and complex mail texts by fusing character-level and word-level mail header and mail body features and combining a 1-D CNN module and a BiLSTM (Bidirectional Long Short Term Memory). The local feature extraction capability of the CNN and the sequence data processing advantages of the BiLSTM are utilized, and the understanding and classification efficiency of the model on complex mail characteristics is enhanced. Meanwhile, data preprocessing steps such as text standardization and part-of-speech reduction and TF-IDF and Word2Vec technologies are applied, standardized input data are provided for feature extraction and classification tasks, semantic information of words is effectively captured, and the steps are conventional methods in the field of text analysis. On the whole, a new solution is provided for a complex text analysis task in the aspects of fusing an advanced model architecture and utilizing a mature natural language processing technology.

Description

Technical Field

[0001] The present invention relates to network security technology and deep learning technology, and in particular to a phishing email deep detection method based on word frequency and context semantic multi-feature fusion. Background Art

[0002] Phishing attackers send fake links from trusted organizations to users, inducing them to visit fake phishing pages, thereby stealing their personal privacy information.

[0003] The Anti-Phishing Working Group (APWG) reported a sharp increase in phishing attacks in 2023, which was the worst year for phishing on record.

[0004] At the same time, with the continuous development and updating of technology, phishing methods have become more complex and difficult to identify. For example, attackers register domain names that are very similar to real websites and deploy SSL certificates on phishing websites, making these sites appear "safe" in browsers. In addition, some advanced phishing activities even use artificial intelligence to generate content and conversations, which can launch precise phishing attacks based on the characteristics of different groups. Phishing attacks have become the most serious security threat to cyberspace. Therefore, effective detection and defense methods are urgently needed to ensure the security of users' information and property.

[0005] (1) Blacklist-based detection technology

[0006] The blacklist method is an effective defense mechanism in phishing detection. By maintaining a list of known phishing websites and malicious domain names, the system can automatically identify and block users from accessing suspicious links. This method relies on continuous data collection and timely information updates to ensure that emerging threats are added to the blacklist in a timely manner, thereby improving the effectiveness of anti-phishing. Blacklists are usually divided into sender blacklists and link blacklists. By analyzing the sender and link in the email and checking whether it appears on the blacklist, it is determined whether the email is a phishing email. PhishTank and OpenPhish are two commonly used phishing information sharing platforms that provide phishing website data verified by the community. Therefore, the update speed and accuracy of the blacklist directly affect its protection effect.

[0007] (2) Detection technology based on machine learning

[0008] Phishing detection methods based on machine learning automatically detect and block phishing attacks by training models to identify the characteristics of phishing emails. These methods usually use classification algorithms, such as decision trees, support vector machines (SVMs), or neural networks, to analyze various features in emails, such as senders, subjects, links, email content, etc. By learning from a large amount of labeled data, the model can identify the pattern differences between normal emails and phishing emails. The advantage of machine learning methods is that they can continuously optimize and improve detection accuracy as the amount of data increases. Training models usually requires a large-scale dataset of labeled phishing and non-phishing emails. In actual applications, machine learning models can self-adjust and optimize based on the continuously updated email data, so their detection effect and accuracy depend on the diversity and quality of the data.

[0009] (3) Detection technology based on deep learning

[0010] Phishing detection methods based on deep learning use deep neural networks (DNN) to automatically extract high-level features from emails and perform complex pattern recognition through multi-layer network structures. These methods usually use models such as convolutional neural networks (CNN), recurrent neural networks (RNN), or long short-term memory networks (LSTM) to analyze various features in emails, such as text content, sender information, and email structure. Compared with traditional machine learning methods, deep learning can automatically learn more abstract and efficient feature representations from raw data, thereby improving detection accuracy. Deep learning models require a large amount of labeled training data and rely on powerful computing power for training and optimization. In practical applications, deep learning methods can handle more complex data patterns and improve the generalization ability of detection through techniques such as transfer learning. The performance of the model is usually closely related to the size and quality of the data set, and the detection effect can be continuously improved over time and with the addition of new data. Summary of the invention

[0011] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and to provide a method for deep detection of phishing emails based on the fusion of word frequency and contextual semantic multi-features. The present invention can effectively identify and distinguish phishing emails from normal emails, thereby providing an effective prevention mechanism to protect users from phishing email attacks.

[0012] Technical solution: A phishing email in-depth detection method based on word frequency and context semantic multi-feature fusion of the present invention comprises the following steps:

[0013] Step 1: Divide the acquired email into the email header and email body, and perform data preprocessing on each to form standardized email text, including parsing email content, standardizing text format, removing unnecessary characters, and performing part-of-speech restoration, so as to standardize the email text and provide a data basis for subsequent feature extraction and classification;

[0014] Step 2: Use TF-IDF and Word2Vec to extract features from the preprocessed email text, and obtain character-level email header features, character-level email body features, word-level email header features, and word-level email body features;

[0015] Among them, TF-IDF is used to extract word-level features and character-level features of email text; Skip-Gram, a skip-gram model of Word2Vec, is used to extract word-level features of email text;

[0016] TF-IDF can evaluate the importance of words in a document set. The Skip-Gram model converts words into vectors through a neural network model to capture semantic relationships, which helps improve the accuracy and context understanding of the model, thereby demonstrating excellent application results in areas such as spam identification and sentiment analysis.

[0017] Step 3: Fuse the above four features. First, sum the vectors generated by Word2Vec. Then use the TF-IDF weight to perform weighted summation on the vectors generated by Word2Vec. Finally, link the vectors generated by TF-IDF with the Word2Vec vectors weighted by TF-IDF. The fused features can improve the accuracy of phishing email classification.

[0018] Step 4: construct a phishing email classification model based on a one-dimensional convolutional neural network 1-D CNN and a bidirectional long short-term memory network BiLSTM; input the fused features into the phishing email classification model to classify phishing emails and effectively distinguish phishing emails from non-phishing emails. The phishing email classification model includes an input layer, a 1-D CNN module, a BiLSTM module, an Attention mechanism, and an output layer in sequence. The specific construction method is as follows:

[0019] The 1-D CNN module adjusts the kernel size of the convolution layer to better capture the close dependencies between words. At the same time, the depth and number of convolution layers are increased (convolution kernel size: 5×5; convolution layer depth: 3 layers; number of convolution layers: 64, 128, 256; the number of output channels of each layer increases layer by layer), which can deeply extract the features of the text. In addition, the batch normalization layer is introduced to not only improve the training stability of the network, but also accelerate the convergence speed, thereby improving the overall performance.

[0020] The 1-D CNN module processes the input fusion features as follows: (a) the text data of the fusion features is converted into a vector form and input into the convolution layer of the CNN;

[0021] (b) The convolutional layer processes the input data through multiple kernels, extracts key features, and outputs these features to the pooling layer;

[0022] (c) The pooling layer further processes these features to reduce the amount of computation by reducing the feature dimension, and then outputs them to the dropout layer to reduce overfitting;

[0023] (d),The feature vector after CNN processing is fed into the BiLSTM module;

[0024] The BiLSTM module receives the output from the 1-D CNN module, analyzes the sequence features in the text, mines the correlation between different parts, and finally outputs the comprehensive feature representation of the text to capture and understand the long-distance dependency in the text through the BiLSTM module;

[0025] The BiLSTM module is optimized to use a multi-layer structure to enhance the model's ability to capture long-distance text dependencies; by adjusting the number of LSTM units and the dimension of the hidden state, the model's memory and processing capabilities are improved. In addition, the introduced residual connection facilitates deeper network training and prevents information loss during training, so that the model can remain efficient and accurate even when processing very complex language structures; the specific method is to add the input of each layer of LSTM directly to its output to form a "jump" connection, thereby improving information flow and the model's learning ability;

[0026] Attention mechanism processing process:

[0027] (a) Use the Viterbi algorithm to perform word segmentation on the text content;

[0028] (b) Calculate the TF-IDF value of each word, which is a statistical method to measure the importance of a word in a document collection;

[0029] (c) Select the top 20 words with the highest TF-IDF values ​​as the criterion for judging the importance of the text;

[0030] (d) Calculate a weight value based on the number of these 20 words in each part of the email. This weight value is used to emphasize important parts of the text in the Attention mechanism.

[0031] Furthermore, the preprocessing of step 1 is to parse and normalize the obtained emails, and the specific method is as follows: the emails are divided into email headers and email bodies, the email headers include titles, sender information, recipient information, sending time and other technical information, which help identify phishing techniques and patterns, including identifying forged addresses and fraud patterns, as well as the time pattern or periodicity of attacks; the email body is the main carrier of information, including text, images, links and other media content; by analyzing the email body, social engineering techniques can be used to identify fake legitimate organizations or emergency situations, and specific keywords, links and attachments can be extracted, which are all crucial parts of phishing email detection and feature extraction; email headers and email bodies are converted into standardized text formats, and unnecessary characters (for example, HTML tags, special symbols, etc.) are removed, and parts of speech are restored (such as restoring verbs to their original forms) to facilitate subsequent feature extraction and email classification tasks.

[0032] Furthermore, the detailed method of feature extraction in step 2 is as follows:

[0033] Step 2.1: Extract text features based on the TF-IDF attention mechanism. First, calculate the TF value and IDF value respectively, and then use the product of the TF value and the IDF value as the TF-IDF weight. The TF value describes the number of times a given word (term) appears in the text. The IDF value describes the general importance of a term in the email collection, that is, the logarithm of the ratio of the total number of emails to the number of emails in which the term appears.

[0034] Step 2.2: The word-level text feature extraction process based on Word2Vec is:

[0035] First, use a large number of email text datasets to pre-train Word2Vec (Skip-Gram) to map each word into a high-dimensional vector to capture the semantic relationship between words; use the pre-trained Skip-Gram model to process the standard email text processed in step 1, and convert each word in the email body into a corresponding word vector; finally, aggregate the word vectors of all words (such as weighted average or maximum pooling) to obtain a word-level feature vector representing the entire email for subsequent classification tasks.

[0036] Formula (1) gives the calculation method of the TF value of a term (word) t in an email e:

[0037]

[0038] Here, ft,e refers to the frequency of term t in email e;

[0039] Formula (2) gives the calculation method of the IDF value of a word t in the email set E:

[0040]

[0041] Where n is the total number of emails in the email set E; the denominator is represented by the number of emails containing the word t i If the word is not in the corpus, the denominator will be 0, so the denominator is generally increased by 1. The calculation formula of TF-IDF weight is as follows:

[0042] TF-IDF(t,e,E)=TF(t,e)×IDF(t,E).(3)

[0043] The TF-IDF weight not only helps the model understand which words have high discrimination in the document, but also provides valuable information for model classification when building the feature set.

[0044] The model is trained by combining the Skip-Gram model and the Softmax function in the Word2vec technology to more effectively extract the features of the phishing email text. The training complexity of the Skip-Gram model is:

[0045] Q=C×(D+D×log2V)(4)

[0046] Among them, C represents the maximum distance between words; D is the representation of the word; and V is the dimension of the vector.

[0047] In the Skip-Gram model, each word w is associated with two vectors, namely u representing the word itself w The vector and v representing its context w vector; As shown in formula (5), given a word w j In the case of, accurately predict another word w i The probability of is:

[0048]

[0049] Among them, P(w i |w j ) refers to the occurrence of w in the context j When i The probability of being the target word.

[0050] Furthermore, step 3 combines TF-IDF and Word2Vec, uses TF-IDF weights to strengthen the word vectors learned by Word2Vec, thereby improving the importance of keywords in the text, and uses the semantic information of Word2Vec to enrich the TF-IDF bag-of-words model, so that the text representation not only considers the frequency of keywords, but also includes their semantic similarity and context information. The specific feature fusion method is:

[0051] Assume that an email document e={t1,t2,…,t N}, where t i (i=1,2,…,N, N is the number of words in the whole email) is the word in document e; w2v(t i ) is obtained by Word2Vec i The vector representation of w(t i ) is t obtained by TF-IDF i The process of generating the mixed feature vector of phishing email text based on TF-IDF and Word2Vec is as follows:

[0052] (1) Sum the vectors generated by Word2Vec

[0053] Assume that d (containing M words) is a piece of text in document e, and use Word2Vec to identify a word t in d. i (i=1,2,…,M, M is the number of words in a paragraph of the entire email) The generated vector is w2v(t i ). The sum of the vectors of each word in d is:

[0054]

[0055] (2) Use TF-IDF weights to weight the vectors generated by Word2Vec

[0056] Assume that d (containing M words) is a piece of text in document e, and use TF-IDF to get a word t in d i The weight of (i=1,2,…,M) is w(t i ), use Word2Vec to get t i The vector is w2v(t i ).

[0057] Formula (7) gives the calculation method for the TF-IDF weighted sum of the Word2Vec vectors of the words in d.

[0058]

[0059] (3) Link the vector generated by TF-IDF with the Word2Vec vector weighted by TF-IDF

[0060] For a certain text segment d in document e, the TF-IDF vector generated by formula (3) through TF-IDF is connected with the weighted vector generated by formula (7) to obtain the final vector describing the text segment d, that is,

[0061] C(d)=concatenate(TF-IDF(d),w_R(d))(8).

[0062] The fusion feature can enhance the expression of the importance of keywords in the text, so that the representation of the text not only considers the frequency of keywords, but also includes their semantic similarity and contextual information.

[0063] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0064] (1) Multi-layer feature extraction: The technical solution of the present invention generates and fuses multi-layer features in the data preprocessing stage, and uses natural language processing methods such as TF-IDF and Word2Vec to convert email text into four types of text features including character-level and word-level features. Compared with traditional methods, this multi-layer feature extraction method enhances the classification ability of the model in complex email text analysis tasks, and effectively responds to diverse and complex email classification needs.

[0065] (2) Application of deep learning model: In the phishing email classification stage, a combination of one-dimensional convolutional neural network (1-D CNN) and bidirectional long short-term memory network (BiLSTM) was used to build the underlying model for phishing email text classification. Compared with traditional rule-based or shallow feature-based methods, this deep learning-based model can better capture the complex semantics and contextual information in the email text, improving the accuracy and efficiency of phishing website detection.

[0066] (3) Automated feature extraction: The feature extraction process of the technical solution of the present invention is fully automated and only relies on the structure and content of the email text itself, without any human intervention. This ensures the consistency and comprehensiveness of the features, avoids the deviations and errors that may be caused by human factors, and improves the stability and reliability of the model.

[0067] (4) Attention mechanism optimization: The technical solution of the present invention adds an attention mechanism in the feature generation and fusion stage for feature selection, further optimizing the performance of the model. Through the attention mechanism, the model can automatically learn and select the most discriminative features, thereby improving the accuracy of phishing website detection and reducing the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is the overall flow chart of the present invention;

[0069] Figure 2 It is the basic structure of email;

[0070] Figure 3 This is the process of part of speech restoration of the present invention;

[0071] Figure 4 It is the underlying classification model based on the CNN-BiLSTM architecture in the present invention. DETAILED DESCRIPTION

[0072] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0073] like Figure 1 As shown, the phishing email in-depth detection method based on word frequency and context semantic multi-feature fusion of the present invention includes the following steps:

[0074] Step 1: Divide the obtained email into the email header and the email body, and perform data preprocessing on each of them to form a standardized email text. The preprocessing operation includes parsing the email content, standardizing the text format, removing unnecessary characters, and performing part-of-speech restoration.

[0075] Step 2: Use TF-IDF and Word2Vec to extract features from the preprocessed email text, and obtain character-level email header features, character-level email body features, word-level email header features, and word-level email body features;

[0076] Among them, TF-IDF is used to extract word-level features and character-level features of email text; Skip-Gram, a skip-gram model of Word2Vec, is used to extract word-level features of email text;

[0077] Step 3: Fuse the above four features: first sum the vectors generated by Word2Vec, then use the TF-IDF weight to perform weighted summation on the vectors generated by Word2Vec, linking the vectors generated by TF-IDF with the Word2Vec vectors weighted by TF-IDF;

[0078] Step 4: Build a phishing email classification model based on the one-dimensional convolutional neural network 1-D CNN and the bidirectional long short-term memory network BiLSTM; input the fused features into the phishing email classification model to classify the phishing emails; Figure 4 As shown in the figure, the phishing email classification model includes the input layer, 1-D CNN module, BiLSTM module, Attention mechanism and output layer in sequence. The specific construction method is as follows:

[0079] The improved 1-D CNN module adjusts the kernel size of the convolutional layer, increases the depth and number of convolutional layers, and introduces a batch normalization layer.

[0080] CNN processing steps:

[0081] (a) Text data is converted into vector form and input into the convolutional layer of CNN;

[0082] (b) The convolutional layer processes the input data through multiple kernels, extracts key features, and outputs these features to the pooling layer;

[0083] (c) The pooling layer further processes these features to reduce the amount of computation by reducing the feature dimension, and then outputs them to the dropout layer to reduce overfitting;

[0084] (d) The feature vector processed by CNN is fed into the BiLSTM layer to capture and understand the long-distance dependencies in the text;

[0085] The optimized BiLSTM module adjusts the number of LSTM units and the dimension of the hidden state. In addition, the residual connection is introduced. The BiLSTM module processing steps are:

[0086] (a) The BiLSTM layer receives the output from the CNN, further analyzes the sequence features in the text, mines the correlation between different parts, and finally outputs the comprehensive feature representation of the text;

[0087] Attention mechanism processing process:

[0088] (a) Use the Viterbi algorithm to perform word segmentation on the text content;

[0089] (b) Calculate the TF-IDF value of each word, which is a statistical method to measure the importance of a word in a document collection;

[0090] (c) Select the top 20 words with the highest TF-IDF values ​​as the criterion for judging the importance of the text;

[0091] (d) Calculate a weight value based on the number of these 20 words in each part of the email. This weight value is used to emphasize important parts of the text in the Attention mechanism.

[0092] like Figure 2 As shown, in the preprocessing of step 1 of this embodiment, the obtained email is parsed and the text is normalized, and the specific method is:

[0093] First, emails are divided into email headers and email bodies. Email headers include title, sender information, recipient information, sending time and other technical information, while email bodies include text, images, links and other media content.

[0094] Then, the contents of the email header and email body are converted into a standardized text format, followed by removing unnecessary characters and performing part-of-speech restoration.

[0095] The detailed steps of feature extraction in step 2 above are as follows:

[0096] Step 2.1: Extract text features based on the TF-IDF attention mechanism. First, calculate the TF value and ID value respectively, and then calculate the TF-IDF weight. The calculation method is the product of the TF value and the IDF value.

[0097] Step 2.2: Extract word-level text features based on Word2Vec. First, use the existing email text dataset to pre-train the Word2Vec model. Use the pre-trained Word2Vec model to convert each word in the standard email text processed in step 1 into a corresponding word vector. Aggregate the word vectors of all words to finally obtain a word-level feature vector representing the entire email, such as Figure 3 shown.

[0098] When this embodiment uses TF-IDF to extract word-level and character-level features from email text, the TF value represents the number of times a certain word t appears in email e, and the IDF value represents the general importance of word t in the email collection, that is, the logarithm of the ratio of the total number of emails to the number of emails in which the term appears;

[0099] The calculation formula is:

[0100]

[0101] Where ft,e refers to the frequency of word t in email e, n is the total number of emails in the email set E, e is the number of emails in the mailing set E, and the denominator of formula (2) is expressed as i If the word is not in the corpus, the denominator will be 0, so the denominator is usually increased by 1.

[0102] Finally, the calculation formula of TF-IDF weight is:

[0103] TF-IDF(t,e,E)=TF(t,e)×IDF(t,E)(3)

[0104] The Skip-Gram model and the Softmax function are combined to train the model. The training complexity of the Skip-Gram model is:

[0105] Q = C × (D + D × log2V) (4) where C represents the maximum distance between words; D is the representation of the word; V is the dimension of the vector;

[0106] Next, since each word w is associated with it by two vectors, namely u representing the word itself w ) vector and v representing its context w vector; therefore, the Softmax function is used to j In the case of i The probability of is:

[0107]

[0108] Among them, P(w i |w j ) refers to the occurrence of w in the context j When i The probability of being the target word.

[0109] In this embodiment, it is assumed that a certain email document e={t1, t2, …, t N}, t i is a word in document e, i = 1, 2, ..., N, w2v(t i ) is obtained by Word2Vec i The vector representation of w(t i ) is t obtained by TF-IDF i The specific method of feature fusion in step 3 is:

[0110] Step 3.1, sum the vectors generated by Word2Vec;

[0111] Assume that d is a piece of text in document e and contains M words. Use Word2Vec to find a word t in d. i The vector generated by (i=1,2,…,M) is w2v(t i ); The sum of the vectors of each word in d is:

[0112]

[0113] Step 3.2: Use TF-IDF weights to perform weighted summation on the vectors generated by Word2Vec.

[0114] Use TF-IDF to get a word t in d i The weight of (i=1,2,…,M) is w(t i ), use Word2Vec to get t iThe vector is w2v(t i ) ; Calculate the TF-IDF weighted sum of the Word2Vec vectors of the words in d:

[0115]

[0116] Step 3.3: Link the vector generated by TF-IDF with the Word2Vec vector weighted by TF-IDF.

[0117] For a certain text d in document e, the TF-IDF vector TF-IDF(d) generated by TF-IDF is connected with the weighted vector w_R(d) to obtain the final vector describing the email text segment d, that is,

[0118] C(d)=concatenate(TF-IDF(d),w_R(d))(8)

[0119] The present invention comprehensively utilizes advanced natural language processing technology and deep learning models to improve the accuracy and efficiency of email classification, especially when processing complex and ever-changing email content, and can effectively identify phishing emails and protect users from online fraud.

[0120] In order to verify the overall performance of the phishing email detection research, this embodiment tests the performance of four existing phishing email detection models. Among these four models, the Ensemble Classification framework adopts a stacked ensemble method (i.e., SVM+XGBoost is used as the basic learner and logistic regression is used as the final decision maker) to improve the classification and detection performance of phishing emails. The ICSOA-DLPEC model uses deep learning and intelligent cuckoo search algorithms to efficiently identify and distinguish phishing emails. 1D-CNNPD is based on a one-dimensional convolutional neural network (1D-CNN) and introduces recursive layers such as LSTM, Bi-LSTM, GRU and Bi-GRU to enhance the model's feature extraction and context understanding capabilities. HELPHE combines the envelopment learning method with hybrid features to provide a more accurate email representation by fusing the content and text features of the email. HELPHED proposes two implementation methods, namely the stack envelopment learning method and soft voting envelopment learning. This embodiment adopts the second implementation method of HELPHED.

[0121] Table 1 Performance data comparison of the present invention

[0122]

[0123] Table 2 Effectiveness evaluation table of CNN-BiLSTM underlying classification architecture

[0124]

[0125] It can be seen from the experimental results in Table 1 and Table 2 that the present invention can effectively identify and distinguish phishing emails from normal emails, thereby providing an effective prevention mechanism to protect users from phishing email attacks, and the present invention can better capture the complex semantics and contextual information in the email text, thereby improving the accuracy and efficiency of phishing website detection.

Claims

1. A phishing email deep detection method based on word frequency and context semantic multi-feature fusion, characterized in that: The following steps are involved: Step 1: Divide the obtained email into the email header and the email body, and perform data preprocessing on each of them to form a standardized email text. The preprocessing operation includes parsing the email content, standardizing the text format, removing unnecessary characters, and performing part-of-speech restoration. Step 2: Use TF-IDF and Word2Vec to extract features from the preprocessed email text, and obtain character-level email header features, character-level email body features, word-level email header features, and word-level email body features; Among them, TF-IDF is used to extract word-level features and character-level features of email text; Skip-Gram, a skip-gram model of Word2Vec, is used to extract word-level features of email text; Step 3: Fuse the above four features: first sum the vectors generated by Word2Vec, then use the TF-IDF weight to perform weighted summation on the vectors generated by Word2Vec, linking the vectors generated by TF-IDF with the Word2Vec vectors weighted by TF-IDF; Step 4: construct a phishing email classification model based on a one-dimensional convolutional neural network 1-D CNN and a bidirectional long short-term memory network BiLSTM; input the fused features into the phishing email classification model to classify the phishing emails; the phishing email classification model includes an input layer, a 1-D CNN module, a BiLSTM module, an Attention mechanism and an output layer in sequence, and the specific construction method is as follows: The 1-D CNN module processes the input fusion features as follows: (a) The text data with fused features is converted into vector form and input into the convolutional layer of CNN; (b) The convolution layer processes the input data through multiple kernels, extracts key features, and outputs the key features to the pooling layer; (c) The pooling layer reduces the feature dimension of the key features and then outputs them to the discard layer; (d),The feature vector after CNN processing is fed into the BiLSTM module; The BiLSTM module receives the output from the 1-D CNN module, analyzes the sequence features in the text, and finally outputs the comprehensive feature representation of the text; the BiLSTM module is used to capture and understand the long-distance dependencies in the text; the BiLSTM module introduces a residual connection; the residual connection directly adds the input and output of the LSTM unit; Attention mechanism processing process: (a) Use the Viterbi algorithm to perform word segmentation on the text content; (b) Calculate the TF-IDF value of each word, which is a statistical method to measure the importance of a word in a document collection; (c) Select the top 20 words with the highest TF-IDF values ​​as the criterion for judging the importance of the text; (d) Calculate a weight value based on the number of these 20 words in each part of the email. This weight value is used to emphasize important parts of the text in the Attention mechanism.

2. According to claim 1, the method for deep detection of phishing emails based on word frequency and context semantic multi-feature fusion is characterized in that: The preprocessing of step 1 is to parse and normalize the obtained emails. The specific method is as follows: First, emails are divided into headers and bodies. The headers include the title, sender information, recipient information, sending time, and other technical information, while the body includes text, images, links, and other media content. Then, the contents of the email header and body are converted into a standardized text format, followed by removing unnecessary characters and performing part-of-speech restoration.

3. According to claim 1, the method for deep detection of phishing emails based on word frequency and contextual semantic multi-feature fusion is characterized in that: The detailed steps of feature extraction in step 2 are as follows: Step 2.1: Extract text features based on the TF-IDF attention mechanism. First, calculate the TF value and ID value respectively, and then calculate the TF-IDF weight. The calculation method is the product of the TF value and the IDF value. Step 2.2: Extract word-level text features based on Word2Vec. First, use the existing email text dataset to pre-train the Word2Vec model. Use the pre-trained Word2Vec model to convert each word in the standard email text processed in step 1 into a corresponding word vector. The word vectors of all words are aggregated to finally obtain the word-level feature vector representing the entire email.

4. The phishing email in-depth detection method based on word frequency and context semantic multi-feature fusion according to claim 1 or 3 is characterized in that: When using TF-IDF to extract word-level and character-level features from email text, the TF value represents the number of times a word t appears in email e, and the IDF value represents the general importance of word t in the email collection, that is, the logarithm of the ratio of the total number of emails to the number of emails in which the term appears; The calculation formula is: Among them, f t,e Refers to the frequency of word t in email e, n is the total number of emails in the email set E; e is the email in the mailing set E; i represents the current word t i ; j is the email index in the email set, E j Refers to the jth email, which contains t i Finally, the calculation formula of TF-IDF weight is: TF-IDF(t,e,E)=TF(t,e)×IDF(t,E)(3).

5. The phishing email in-depth detection method based on word frequency and context semantic multi-feature fusion according to claim 1 or 3 is characterized in that: The Skip-Gram model and the Softmax function are combined to train the model. The training complexity of the Skip-Gram model is: Q = C × (D + D × log2V) (4) where C represents the maximum distance between words; D is the representation of the word; V is the dimension of the vector; Next, since each word w is associated with it by two vectors, namely u representing the word itself w The vector and v representing its context w vector; therefore, the Softmax function is used to j In the case of i The probability of is: Among them, P(w i |w j ) refers to the occurrence of w in the context j When i The probability of being the target word.

6. The phishing email deep detection method based on word frequency and context semantic multi-feature fusion according to claim 1 is characterized in that: Assume that an email document e={t1,t2,…,t N }, t i is the word in document e, i=1,2,…,N, N is the number of words in the whole email, w2v(t i ) is obtained by Word2Vec i The vector representation of w(t i ) is t obtained by TF-IDF i The specific method of feature fusion in step 3 is: Step 3.1, sum the vectors generated by Word2Vec; Assume that d is a piece of text in document e and contains M words. Use Word2Vec to find a word t in d. i The generated vector is w2v(t i ); The sum of the vectors of each word in d is: Here, i = 1, 2, ..., M, M is the number of words in a paragraph of the entire email; Step 3.2: Use TF-IDF weights to perform weighted summation on the vectors generated by Word2Vec. Use TF-IDF to get a word t in d i The weight of (i=1,2,…,M) is w(t i ), use Word2Vec to get t i The vector is w2v(t i ) ; Calculate the TF-IDF weighted sum of the Word2Vec vectors of the words in d: Step 3.3: Link the vector generated by TF-IDF with the Word2Vec vector weighted by TF-IDF. For a certain text d in document e, the TF-IDF vector TF-IDF(d) generated by TF-IDF is connected with the weighted vector w_R(d) to obtain the final vector describing the email text segment d, that is, C(d)=concatenate(TF-IDF(d),w_R(d))(8).

Images