Phishing website detection method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computers, in particular to a phishing website detection method, device and equipment and a storage medium, and the method comprises the steps that a data set of a to-be-detected website is acquired, and the data set of the to-be-detected website comprises URL and HTML codes of the to-be-detected website; determining a feature vector of the URL based on the URL, and determining a first feature vector corresponding to the HTML code based on the HTML code; the feature vector of the URL and a first feature vector corresponding to the HTML code are input into a first model, a first website prediction result output by the first model is obtained, and the first model is deployed in a browser plug-in of a client; and when the first website prediction result indicates that the to-be-detected website is the phishing website, sending a data set and a webpage screenshot of the to-be-detected website to the server.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a phishing website detection method, device, equipment and storage medium. Background Art

[0002] With the continuous development of Internet technology, phishing attacks pose an increasingly serious threat to network security. As a common means of online fraud, phishing attacks can trick users into entering sensitive information such as usernames, passwords, and bank accounts by disguising themselves as legitimate sites. This not only damages the user's property security, but can also lead to serious consequences such as identity theft.

[0003] In the prior art, the detection methods of phishing websites mainly include methods based on signatures or blacklists, methods based on content analysis, and methods based on machine learning, etc. Among them, the methods based on signatures or blacklists rely on a pre-defined list of phishing websites, which requires continuous manual maintenance and updating of the list of phishing websites; the methods based on content analysis judge the authenticity of a website by analyzing the Hypertext Markup Language (HTML) source code, Uniform Resource Locator (URL) structure, domain name information and other features of the web page. This method can identify phishing web pages that imitate the appearance of legitimate websites, but it is difficult to identify phishing websites with high camouflage technology; the methods based on machine learning learn the features that distinguish between normal websites and phishing websites through unsupervised models, however, this method usually requires a large amount of computing resources, has network delay problems, and has the risk of privacy leakage during data transmission. Summary of the invention

[0004] The embodiments of the present application provide a phishing website detection method, apparatus, device and storage medium for improving the real-time and accuracy of phishing website detection.

[0005] In a first aspect, the present application provides a phishing website detection method, the method comprising:

[0006] Acquire a data set of a website to be detected, wherein the data set of the website to be detected includes a uniform resource locator URL of the website to be detected and a hypertext markup language HTML code of the website to be detected;

[0007] Determine a feature vector of the URL based on the URL, and determine a first feature vector corresponding to the HTML code based on the HTML code;

[0008] Inputting the feature vector of the URL and the first feature vector corresponding to the HTML code into a first model, obtaining a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; the first model is deployed in a browser plug-in of a client;

[0009] When the first website prediction result indicates that the website to be detected is a phishing website, sending a data set of the website to be detected and a webpage screenshot of the website to be detected to a server;

[0010] A second website prediction result is received from the server, where the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0011] In the embodiment of the present application, since the first model has few parameters and small amount of calculation, the first model is deployed in the browser plug-in of the client. When the user visits the website, the client can obtain the URL and HTML code of the website to be detected in real time, and perform feature extraction and prediction using the first model respectively, thereby improving the efficiency of phishing website detection. Secondly, since data processing and model prediction are completed in the local browser, the user can receive feedback about the security of the website more quickly, thereby improving the user experience. In addition, when the prediction result of the first website output by the first model indicates that the website to be detected is a phishing website, the client can send the data set and webpage screenshot of the website to be detected to the server for the server to further detect the security of the website. When the client obtains the detection result of the server, it can finally determine whether the website is a phishing website, thereby improving the accuracy of phishing website detection.

[0012] In a possible embodiment, the method further includes:

[0013] When the first website prediction result indicates that the website to be detected is a normal website, the website to be detected is accessed.

[0014] In a possible embodiment, determining the feature vector of the URL based on the URL includes:

[0015] Convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical value sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values;

[0016] A bidirectional long short-term memory network is used to determine a feature vector of the URL according to the first numerical sequence.

[0017] In this embodiment, by presetting a first mapping relationship, each character in the URL is converted into a corresponding numerical value, so that the model can more easily process and learn the structural features of the URL.

[0018] In a possible embodiment, determining a first feature vector corresponding to the HTML code based on the HTML code includes:

[0019] Extracting at least one feature according to the HTML code, wherein the at least one feature includes: one or more of the length of the HTML code, the number of external resources, the number of internal resources, the number of internal links, the number of external links, the number of preset tags, the number of comments, the number of preset events, whether the page uses the hypertext transfer security protocol https protocol, the number of page redirections, and the time required for the page to be loaded;

[0020] A first feature vector of the HTML code is determined using a fully connected neural network according to the at least one feature.

[0021] In this embodiment, by extracting multiple features from HTML codes, such as length, number of resources, etc., the structure and content information of the web page can be fully captured, thereby improving the accuracy of phishing website detection.

[0022] In a possible embodiment, before sending the data set of the website to be detected and the webpage screenshot of the website to be detected to the server, the process includes:

[0023] A first instruction is received, where the first instruction is used to indicate consent to send the data set of the website to be detected and the webpage screenshot of the website to be detected to the server.

[0024] In this embodiment, the client first receives the instruction agreed by the user, and then sends the data set of the website to be detected and the webpage screenshot of the website to be detected to the server, which can better protect the privacy of the user, ensure that the user data will not be disseminated at will, and reduce the risk of data leakage.

[0025] In a possible embodiment, when the first website prediction result indicates that the website to be detected is a phishing website, the user is prompted that the website to be detected may be a phishing website, and the user is asked whether he agrees to send the data set of the website to be detected and the web page screenshot of the website to be detected to the server.

[0026] In this embodiment, when the first website prediction result indicates that the website to be detected is a phishing website, the client can promptly warn the user of possible risks and ask the user whether he agrees to send data, which can enhance the user's sense of trust and help protect the user's privacy and data security.

[0027] In a possible embodiment, the first model is obtained based on a first phishing website historical data set and a first normal website historical data set, wherein the first phishing website historical data set includes URLs of M1 phishing websites and HTML codes of the M1 phishing websites, and the first normal website historical data set includes URLs of N1 normal websites and HTML codes of the N1 normal websites, and M1 and N1 are positive integers.

[0028] In a second aspect, an embodiment of the present application provides a phishing website monitoring method, which is applied to a server and includes:

[0029] Receiving a data set of a website to be detected and a webpage screenshot of the website to be detected from a client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected;

[0030] Determine a feature vector of the URL based on the URL, determine a second feature vector corresponding to the HTML code based on the HTML code, and determine a feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected;

[0031] Inputting the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into a second model to obtain a second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website;

[0032] The second website prediction result is sent to the client.

[0033] In the embodiment of the present application, when the client performs a preliminary detection on the website to be detected, and the prediction result indicates that the website to be detected may be a phishing website, the server can further analyze the relevant data of the website to be detected sent by the client, wherein, by combining the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot, the deeper features of the website to be detected can be extracted, thereby improving the accuracy of phishing website detection. In addition, after the second model outputs the prediction result, the server can send the prediction result to the client in real time to improve the efficiency of detection.

[0034] In a possible embodiment, determining the feature vector of the URL based on the URL includes:

[0035] Convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical value sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values;

[0036] A bidirectional long short-term memory network is used to determine a feature vector of the URL according to the first numerical sequence.

[0037] In this embodiment, by presetting a first mapping relationship, each character in the URL is converted into a corresponding numerical value, so that the model can more easily process and learn the structural features of the URL.

[0038] In a possible embodiment, determining a first feature vector corresponding to the HTML code based on the HTML code includes:

[0039] Determine a first text sequence according to the HTML code, wherein the first text sequence is arranged in sequence according to HTML tags, tag attributes, and tag text;

[0040] Determine a plurality of subtexts according to the first text sequence;

[0041] Converting the plurality of sub-texts into a plurality of sub-vectors;

[0042] The plurality of sub-vectors are encoded using a preset model to obtain a second feature vector corresponding to the HTML code, wherein the second feature vector corresponding to the HTML code is an average pooling result of the plurality of sub-vectors.

[0043] In this embodiment, the server parses the HTML code, obtains all HTML tags, tag attributes, and text content in the tags, removes meaningless content such as blanks, arrows, and end characters, and arranges each line of the HTML code in the format of "{HTML tag}[tag attribute]{tag text}" to form a first text sequence. This parsing method can perform a more detailed analysis of the main content in the HTML code and improve the accuracy of phishing website detection. In addition, the long text is cut into multiple sub-texts, and the sub-vectors after the sub-text conversion are encoded using a preset model, and average pooling is performed to generate a unified feature representation. This method enables the model to maintain the integrity of the data when processing long text data, and at the same time, the features of multiple sub-texts are merged into a vector of fixed dimension, which improves the stability of the model and the ability to process long text data.

[0044] In a possible embodiment, determining a feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected includes:

[0045] The webpage screenshot of the website to be detected is cropped according to preset parameters, and the cropped image is normalized, and the feature vector of the webpage screenshot is determined based on the normalized image.

[0046] In this embodiment, the server crops the web page screenshot of the website to be detected, which can remove unnecessary edge parts, retain the core content area of ​​the web page, and meet the input size requirements of the model. By combining the features of the web page screenshot, the accuracy of detection can be improved from the visual feature aspect.

[0047] In a possible embodiment, the second model is obtained based on a second phishing website historical data set and a second normal website historical data set, wherein the second phishing website historical data set includes URLs of M2 phishing websites, HTML codes of the M2 phishing websites, and web page screenshots of the M2 phishing websites, and the second normal website historical data set includes URLs of N2 normal websites, HTML codes of the N2 normal websites, and web page screenshots of the N2 normal websites, and M2 and N2 are positive integers.

[0048] In a third aspect, an embodiment of the present application further provides a phishing website detection device, the device comprising a transceiver unit and a processing unit;

[0049] The transceiver unit is used to obtain a data set of a website to be detected, wherein the data set of the website to be detected includes a uniform resource locator URL of the website to be detected and a hypertext markup language HTML code of the website to be detected;

[0050] The processing unit is used to determine a feature vector of the URL based on the URL, and to determine a first feature vector corresponding to the HTML code based on the HTML code; and is also used to input the feature vector of the URL and the first feature vector corresponding to the HTML code into a first model to obtain a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; the first model is deployed in a browser plug-in of a client;

[0051] The transceiver unit is also used to send a data set of the website to be detected and a screenshot of the web page of the website to be detected to the server when the first website prediction result indicates that the website to be detected is a phishing website; and to receive a second website prediction result from the server, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0052] In a fourth aspect, an embodiment of the present application further provides a phishing website detection device, the device comprising a transceiver unit and a processing unit;

[0053] The transceiver unit is used to receive a data set of a website to be detected and a webpage screenshot of the website to be detected from a client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected;

[0054] The processing unit is used to determine the feature vector of the URL based on the URL, determine the second feature vector corresponding to the HTML code based on the HTML code, and determine the feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected; and is also used to input the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into a second model to obtain a second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website;

[0055] The transceiver unit is further used to send the second website prediction result to the client.

[0056] In a fifth aspect, the present application provides a phishing website detection device, including:

[0057] A memory for storing program instructions;

[0058] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0059] In a sixth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0060] In a seventh aspect, the present application provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect.

[0061] In an eighth aspect, the present application provides a communication system, comprising a client and a server, wherein the client is used to execute the method described in any one of the first aspect, and the server is used to execute the method described in any one of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A flowchart of a phishing website detection method provided in an embodiment of the present application;

[0063] Figure 2 A schematic diagram of obtaining a feature vector of a URL provided in an embodiment of the present application;

[0064] Figure 3 A schematic diagram of obtaining a first feature vector corresponding to an HTML code provided in an embodiment of the present application;

[0065] Figure 4 A schematic diagram of obtaining a first website prediction result through a first model provided in an embodiment of the present application;

[0066] Figure 5 A schematic diagram of obtaining a second feature vector corresponding to an HTML code provided in an embodiment of the present application;

[0067] Figure 6 A schematic diagram of obtaining a feature vector of a webpage screenshot provided in an embodiment of the present application;

[0068] Figure 7 A schematic diagram of obtaining a second website prediction result through a second model provided in an embodiment of the present application;

[0069] Figure 8 A schematic diagram of the structure of the phishing website detection device provided in the embodiment of the present application Figure 1 ;

[0070] Fig. 9 A schematic diagram of the structure of the phishing website detection device provided in the embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0071] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] To facilitate understanding, the technical terms involved in the embodiments of the present application are first explained.

[0073] Phishing websites: Disguise themselves as legitimate websites to trick users into providing sensitive information, such as usernames, passwords, and credit card information.

[0074] Bidirectional Long Short-Term Memory (BiLSTM): A special recurrent neural network that processes sequence data through two Long Short-Term Memory (LSTM) layers, where one LSTM layer processes data from the beginning to the end of the sequence (forward) to capture the forward dependencies in the sequence, and the other LSTM layer processes data from the end to the beginning of the sequence (reverse) to capture the reverse dependencies in the sequence. The forward and reverse outputs are merged at each time step to form the final output representation.

[0075] Open Neural Network Exchange (ONNX): is an open deep learning model exchange format for interoperability between different deep learning frameworks. It allows developers to train models in different frameworks, then export them in ONNX format and run them in other frameworks or platforms that support ONNX.

[0076] With the development of Internet technology, especially the popularity of social media and mobile Internet, the forms and propagation methods of phishing websites have become more diverse and covert. Currently, a variety of methods and technologies have been proposed and applied in practice. However, each method has its shortcomings.

[0077] The current phishing website detection methods have the following main problems: 1) It is impossible to detect phishing websites that are not in the predefined malicious website list in a timely manner; 2) It is difficult to accurately detect phishing websites with high camouflage technology; 3) It is necessary to use cloud servers to detect users' visited websites, which is costly, may have network delay problems, and there is a risk of privacy leakage during data transmission.

[0078] Based on the above problems, Figure 1 As shown, an embodiment of the present invention provides a phishing website detection method, which specifically includes:

[0079] Step 100: The client obtains a data set of a website to be detected, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected.

[0080] In the specific implementation, the user enters the URL or clicks the link in the local browser to initiate a request to access the website. The client can perceive the user's access request and start the data collection process. The collected data is the URL and HTML code of the website, where the URL is the complete address requested by the user, including information such as the protocol, domain name, and path, and the HTML code is the source code of the page requested by the user, including text content, tags, attributes, and other information.

[0081] For example, when a user enters a URL or clicks a link in a browser, the client can first send a request to the website through the HTTP protocol, and use the HTTP status code of the response to determine whether the URL is accessible. For example, the returned status code is 200 and 301, indicating that the URL is accessible; the returned status code is 404 or 500, indicating that the URL is inaccessible. If the URL is inaccessible, the client can prompt the user that the website is invalid.

[0082] When the URL is accessible, the client saves the URL of the website and further simulates the user's browsing behavior through the Selenium library to load the dynamic content in the page. In this process, the page loading timeout can be set, for example, 10 seconds, to ensure that all dynamic content in the page can be loaded in a reasonable time. After the page is loaded, the client can obtain the complete HTML code and save it in the local file system.

[0083] Step 110: The client determines a feature vector of the URL based on the URL, and determines a first feature vector corresponding to the HTML code based on the HTML code.

[0084] In a specific implementation, the client may perform feature extraction on the acquired URL and HTML code to generate a corresponding feature vector.

[0085] The client determines the feature vector of the URL based on the URL. Exemplarily, the client converts each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values, and then determines the feature vector of the URL using a bidirectional long short-term memory network according to the first numerical sequence.

[0086] In a specific implementation, a first mapping relationship is predefined in advance, wherein the first mapping relationship indicates the correspondence between each character (letter, number, special character, etc.) that may appear in the URL and a unique numerical value. According to the first mapping relationship, each character in the URL is converted into a corresponding numerical value, and the characters are arranged in the order of the characters in the URL to form a first numerical sequence.

[0087] Exemplarily, the rules for establishing the first mapping relationship may be as follows: lowercase letters az are mapped to 1-26, uppercase letters AZ are mapped to 27-52, numbers 0-9 are mapped to 53-62, special characters (. / +-_:;?"><{}()[]~!#$*\, etc.) are 24 in total, mapped to 63-86, and other unknown characters are uniformly mapped to 87. If the length of the URL is less than the preset total length, for example, the preset total length is 1000 characters, the filled blank characters can be mapped to 0. According to the predefined first mapping relationship, all characters in the URL can be converted into corresponding numerical values ​​in sequence to form a first numerical sequence.

[0088] Exemplarily, the first numerical sequence is one-hot encoded, wherein each numerical value in the first numerical sequence can be converted into an 88-dimensional vector, and the position corresponding to each numerical value in the vector is set to 1, and the remaining positions are set to 0, thereby obtaining a vector sequence. Further, the vector sequence is input into the BiLSTM model to obtain the feature vector of the URL.

[0089] The BiLSTM model includes two LSTM layers, which process the forward sequence and the reverse sequence respectively. Each LSTM layer is equipped with 128 hidden units to capture the time dependency in the first numerical sequence. The number of stacked layers of the model is 2, indicating that the output of the first LSTM layer can be used as the input of the second LSTM layer. In addition, other models can also be used, which is not limited in this application.

[0090] In the specific implementation, the BiLSTM model first converts the vector sequence into 64 dimensions through the embedding layer. The converted vector sequence is input into two LSTM layers, one LSTM layer is used to process the forward sequence, and the other LSTM layer is used to process the reverse sequence. After each LSTM layer processes the sequence, it will generate a 128-dimensional output vector. Therefore, the model outputs a 256-dimensional feature vector, which is used as the feature vector of the URL.

[0091] For example, Figure 2 As shown in , if the obtained URL is in the format of "HTTPS: / / example.com", the process of obtaining the feature vector of the URL based on the URL is as follows Figure 2 As shown, first, according to the first mapping relationship, each character "H", "T", "T", "P", "S", ":", " / ", " / ", "e", "x", "a", "m", "p", "l", "e", ".", "c", "o", "m" in the URL is converted into a corresponding numerical value, wherein "H" is mapped to "34", "T" is mapped to "46", "P" is mapped to "42", "S" is mapped to "45", ":" is mapped to "65", " / " is mapped to "64", "e" is mapped to "5", "x" is mapped to "24", "a" is mapped to "1", "m" is mapped to "13", "p" is mapped to "16", "l" is mapped to "12", "." is mapped to "63", "c" is mapped to "3", and "o" is mapped to "15". After being converted into corresponding numerical values, they are arranged in the order of the URL to form a first numerical sequence, and then the first numerical sequence is uniquely hot encoded and converted into a vector sequence, wherein the vector sequence includes 19 88-dimensional vectors, and the vector sequence is passed through the BiLSTM model to obtain the feature vector of the URL.

[0092] The client determines the first feature vector corresponding to the HTML code based on the HTML code. Exemplarily, the client extracts at least one feature according to the HTML code, wherein the at least one feature includes: one or more of the length of the HTML code, the number of external resources, the number of internal resources, the number of internal links, the number of external links, the number of preset tags, the number of comments, the number of preset events, whether the page uses the https protocol, the number of page redirections, and the time required for the page to load, and then determines the first feature vector of the HTML code using a fully connected neural network according to the at least one feature.

[0093] The number of preset tags may include but is not limited to: the number of iframe tags, the number of form tags, the number of a tags, and the number of script tags. The number of preset events may include but is not limited to: the number of mouseover events and the number of click events. The number of comments may refer to the number of html comments.

[0094] In a specific implementation, first, the client analyzes the acquired HTML code to extract at least one of the above features.

[0095] Secondly, the extracted features are preprocessed, the Boolean type features in the features (whether the page uses the https protocol) are converted into numerical forms of 0 or 1, and the remaining features are standardized and converted into numerical forms between 0-1. This application does not limit the specific method of converting features into numerical forms.

[0096] Third, the preprocessed features are input into a fully connected neural network (FCN) to obtain the first feature vector corresponding to the HTML code.

[0097] Among them, FCN contains three hidden layers. The first layer receives input features and is used to capture the preliminary relationship between features. The second layer is used to extract higher-level features from the output of the first layer. The third layer is used to integrate the features of the first two layers. The preprocessed features are input into FCN, and the feature vector output at the end is used as the first feature vector of the HTML code. Among them, other models can also be used, and this application does not limit this.

[0098] For example, the preprocessed features are input into FCN. The first layer of FCN contains 64 neurons. The first layer receives the preprocessed features. The second layer contains 128 neurons. The output of the first layer is used as input to extract deeper features. The third layer contains 64 neurons. The features of the first two layers are integrated together. Finally, a 64-dimensional feature vector can be output and used as the first feature vector of the HTML code. The process of obtaining the first feature vector corresponding to the HTML code based on the HTML code can be as follows: Figure 3 shown.

[0099] Step 120: The client inputs the feature vector of the URL and the first feature vector corresponding to the HTML code into the first model to obtain the first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website, and the first model is deployed in the browser plug-in of the client.

[0100] The client first obtains a first model. The first model is obtained based on a first phishing website historical data set and a first normal website historical data set. Exemplarily, the client may obtain the first model in the following manners, but not limited to:

[0101] 1. The client obtains a first phishing website data set and a first normal website historical data set.

[0102] The first phishing website data set includes URLs of M1 phishing websites and HTML codes of M1 phishing websites, and the first normal website historical data set includes URLs of N1 normal websites and HTML codes of N1 normal websites, where M1 and N1 are positive integers. The process of obtaining the data set is the same as the process of obtaining the data set of the website to be detected in step 100 above, and will not be described in detail here.

[0103] 2. The client obtains a first model based on the first phishing website historical data set and the first normal website historical data set.

[0104] Among them, the client obtains feature vectors of M1 URLs and feature vectors corresponding to M1 HTML codes based on the first phishing website historical data set, and obtains feature vectors of N1 URLs and feature vectors corresponding to N1 HTML codes based on the first normal website historical data set, wherein the acquisition process is consistent with the above-mentioned process of obtaining the feature vector of the URL of the website to be detected and the first feature vector corresponding to the HTML code of the website to be detected, and will not be elaborated here.

[0105] Further, for the M1 phishing websites in the first phishing website historical data set, the feature vector of the URL of each phishing website and the feature vector corresponding to the HTML code are concatenated, and M1 feature vectors can be obtained after concatenation; for the N1 normal websites in the first normal website historical data set, the feature vector of the URL of each normal website and the feature vector corresponding to the HTML code are concatenated, and N1 feature vectors can be obtained after concatenation. Afterwards, the M1 feature vectors and the N1 feature vectors are input into a fully connected neural network for training, and the network may include multiple hidden layers, each layer having a certain number of neurons, for learning the relationship between features, and through multiple iterative training, a first model may be obtained, wherein the output result of the first model may include the probability values ​​of phishing websites and normal websites.

[0106] After obtaining the first model, the client converts the first model into ONNX format and deploys it to the browser plug-in through relevant technical means. This technology enables the first model to be efficiently executed in the browser plug-in, reducing the cost of detection. It can obtain the URL and HTML code of the website to be detected in real time when the user visits the website, and perform feature extraction and model prediction respectively, ensuring that users can quickly detect phishing risks when browsing the web in daily life, reducing security threats caused by phishing. Among them, the relevant technical means can be front-end technology, such as ONNXRuntime-Web technology, which is not specifically limited in this application.

[0107] Exemplarily, after obtaining the feature vector of the URL and the first feature vector of the HTML code, the two feature vectors may be concatenated to form a joint feature vector. The concatenation formula is as follows:

[0108] F concat =[F BiLSTM ; F FCN ]

[0109] Among them, F BiLSTM and F FCN They represent the feature vector of the URL extracted by BiLSTM and the first feature vector corresponding to the HTML code extracted by FCN, respectively. concat is the concatenated joint feature vector.

[0110] Furthermore, if Figure 4 As shown, the concatenated joint feature vector F concat The first model is input to obtain a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0111] In the specific implementation, the concatenated joint feature vector F concatAfter input into the first model, a 2D vector can be obtained according to the output layer of the first model. The 2D vector is converted into two numerical values ​​between 0 and 1 through the Softmax activation function, where the sum of the two numerical values ​​is 1, and each numerical value corresponds to a probability value of a category. The size of these two numerical values ​​can be used to determine whether the website to be detected is a normal website or a phishing website.

[0112] Exemplarily, when the first model sets the threshold of the probability value corresponding to the phishing website to 0.4, if the probability value corresponding to the phishing website is 0.6 and the probability value corresponding to the normal website is 0.4, then the website is determined to be a phishing website; if the probability value corresponding to the phishing website is 0.3 and the probability value corresponding to the normal website is 0.7, then the website is determined to be a normal website.

[0113] Step 130: When the first website prediction result indicates that the website to be detected is a phishing website, the client sends a data set of the website to be detected and a webpage screenshot of the website to be detected to the server.

[0114] When the first website prediction result indicates that the website to be detected is a phishing website, the client can receive a first instruction, which is used to indicate consent to send a data set of the website to be detected and a webpage screenshot of the website to be detected to the server. Based on the first instruction, the client sends the data set of the website to be detected and the webpage screenshot of the website to be detected to the server.

[0115] Exemplarily, when the first website prediction result indicates that the website to be detected is a phishing website, the client can first prompt the user that the website to be detected may be a phishing website, and ask the user whether to agree to send the data set of the website to be detected and the webpage screenshot of the website to be detected to the server. If the user agrees, the client receives the first instruction, and encrypts the data set and webpage screenshot of the website to be detected, and sends them to the server. Alternatively, the client can also encrypt the feature vector of the URL of the website to be detected, the HTML code of the website to be detected, and the webpage screenshot, and send them to the server. Among them, this application does not limit the specific method of data encryption.

[0116] In addition, when the first website prediction result indicates that the website to be detected is a normal website, the client accesses the website to be detected. Figure 1 For example, when the first website prediction result indicates that the website to be detected is a normal website, the client can respond to the user's request to access the website to be detected and send an access request to the server of the website to be detected. In addition, the client can display a prompt box on the current page, which is used to prompt the user that the website to be detected requested to access is a normal website or a non-phishing website.

[0117] Corresponding to step 130 , the server receives a data set of the website to be detected and a webpage screenshot of the website to be detected from the client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected.

[0118] In a specific implementation, the server receives encrypted data from the client and decrypts the data to obtain a data set and webpage screenshots of the website to be detected.

[0119] Exemplarily, after receiving the encrypted data, the server can use a decryption key and other algorithms to decrypt the data. The decrypted data is the URL of the website to be detected, the HTML code of the website to be detected, and a screenshot of the web page of the website to be detected.

[0120] Step 140: The server determines a feature vector of the URL based on the URL, determines a second feature vector corresponding to the HTML code based on the HTML code, and determines a feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected.

[0121] In a specific implementation, after obtaining the data set and webpage screenshots of the website to be detected, the server can perform feature extraction on the received URL, HTML code and webpage screenshot to generate a corresponding feature vector.

[0122] In a possible design, the server determines the feature vector of the URL based on the URL. For details, please refer to the above related content, which will not be repeated here.

[0123] In another possible design, the server receives the feature vector of the URL of the website to be detected from the client. On this basis, the server does not need to extract the feature vector of the URL based on the URL.

[0124] The server determines the second feature vector corresponding to the HTML code based on the HTML code. Exemplarily, the server determines a first text sequence according to the HTML code, the first text sequence is arranged in sequence according to HTML tags, tag attributes, and tag texts, and then determines multiple sub-texts according to the first text sequence, converts the multiple sub-texts into multiple sub-vectors, and then encodes the multiple sub-vectors using a preset model to obtain the second feature vector corresponding to the HTML code, wherein the second feature vector corresponding to the HTML code is the average pooling result of the multiple sub-vectors.

[0125] In the specific implementation, first, the server parses the acquired HTML code, obtains all HTML tags, tag attributes and text content within the tags, and removes meaningless content such as blank characters, arrows, and end characters.

[0126] Secondly, arrange each line of HTML code in sequence according to the format of "{HTML tag}[tag attribute]{tag text}" to form a first text sequence.

[0127] For example, suppose the HTML code is as follows:

[0128]

[0129]

[0130] According to the parsing rules, the first text sequence after parsing is as follows:

[0131] html[]

[0132] head[]

[0133] title[]Example Page

[0134] head[]

[0135] body[]

[0136] h1[]Welcome to Example

[0137] p[]This is an example paragraph.

[0138] a[href=http: / / example.com]Example Link

[0139] …

[0140] Third, the parsed first text sequence is cut into multiple sub-texts of the same length, each sub-text is vectorized to obtain multiple sub-vectors of the same length, the multiple sub-vectors are input into the preset model for encoding, and all the encoded sub-vectors are average pooled to obtain a final HTML feature vector, that is, the second feature vector corresponding to the HTML code.

[0141] For example, the parsed first text sequence can be cut into pieces of length 512 to obtain a plurality of sub-texts of length 512, and the plurality of sub-texts can be vectorized to obtain a plurality of sub-vectors of length 512. After encoding and average pooling by a preset model, a final 768-dimensional HTML feature vector can be obtained, i.e., the second feature vector corresponding to the HTML code. The process of obtaining the second feature vector corresponding to the HTML code based on the HTML code can be as follows: Figure 5 shown.

[0142] Exemplarily, the BERT model can be used to encode the multiple sub-vectors obtained, and then the encoded results are average-pooled to generate a unified feature representation. This approach enables the BERT model to maintain data integrity when processing long text data, while fusing the features of multiple texts into a vector of fixed dimension, thereby improving the stability of the BERT model and its ability to process long text data.

[0143] The server determines the feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected, crops the webpage screenshot of the website to be detected according to preset parameters, normalizes the cropped image, and determines the feature vector of the webpage screenshot based on the normalized image.

[0144] In the specific implementation, first, the server scales the received web page screenshot to a preset resolution, and performs center cropping on the scaled image according to preset parameters. The purpose of cropping is to remove unnecessary edge parts, retain the core content area of ​​the web page, and meet the input size requirements of the model. Furthermore, the scaled image is normalized.

[0145] Secondly, a densely connected convolutional network is used to extract features from the normalized image, the last classification layer of the network is removed, and the output is flattened to obtain a feature vector as the feature vector of the web page screenshot.

[0146] For example, the server can scale the webpage screenshot to a resolution of 256×256 pixels, then perform center cropping on the scaled image to a 224×224 image, and further normalize the cropped image to scale all pixels of the image to between 0 and 1. Secondly, use a densely connected convolutional network to extract features from the normalized image, remove the last classification layer of the network, flatten the output result, and obtain a 1024-dimensional feature vector as the feature vector of the webpage screenshot. The process of obtaining the feature vector of the webpage screenshot based on the webpage screenshot can be as follows: Figure 6 shown.

[0147] Step 150: The server inputs the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into the second model to obtain the second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0148] The server first obtains the second model.

[0149] Among them, the second model is obtained based on the second phishing website historical data set and the second normal website historical data set.

[0150] Exemplarily, the server may obtain the second model in the following manner, but not limited to:

[0151] 1. The server obtains the second phishing website historical data set and the second normal website historical data set.

[0152] The second phishing website historical data set includes URLs of M2 phishing websites, HTML codes of M2 phishing websites, and webpage screenshots of M2 phishing websites, and the second normal website historical data set includes URLs of N2 normal websites, HTML codes of N2 normal websites, and webpage screenshots of N2 normal websites, where M2 and N2 are positive integers. The process of obtaining the data set is the same as the process of obtaining the data set of the website to be detected in the above step 100, and will not be repeated here.

[0153] 2. The server obtains a second model based on the second phishing website historical data set and the second normal website historical data set.

[0154] Among them, the server obtains feature vectors of M2 URLs, feature vectors corresponding to M2 HTML codes, and feature vectors of M2 web page screenshots of phishing websites based on the second phishing website historical data set, and obtains feature vectors of N2 URLs, feature vectors corresponding to N2 HTML codes, and feature vectors of N2 web page screenshots of normal websites based on the second normal website historical data set, wherein the acquisition process is consistent with the above-mentioned process of obtaining the feature vector of the URL of the website to be detected, the second feature vector corresponding to the HTML code of the website to be detected, and the feature vector of the web page screenshot of the website to be detected, and no further details are given here.

[0155] Furthermore, for the M2 phishing websites in the second phishing website historical data set, the feature vectors of the URL of each phishing website, the feature vectors corresponding to the HTML code, and the feature vectors of the webpage screenshots are concatenated, and M2 feature vectors can be obtained after concatenation; for the N2 normal websites in the second normal website historical data set, the feature vectors of the URL of each normal website, the feature vectors corresponding to the HTML code, and the feature vectors of the webpage screenshots are concatenated, and N2 feature vectors can be obtained after concatenation. Afterwards, the M2 feature vectors and the N2 feature vectors are input into a fully connected neural network for training, and the network may include multiple hidden layers, each layer having a certain number of neurons, for learning the relationship between features, and through multiple iterative training, a second model may be obtained, wherein the output results of the second model may include probability values ​​of phishing websites and normal websites.

[0156] After obtaining the second model, Figure 7As shown, the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot are concatenated to form a joint feature vector. The joint feature vector is input into the second model to obtain the second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0157] In a specific implementation, after the spliced ​​joint feature vector is input into the second model, a two-dimensional vector can be obtained according to the output layer of the second model. The two-dimensional vector is converted into two numerical values ​​between 0 and 1 through the Softmax activation function, where the sum of the two numerical values ​​is 1, and each numerical value corresponds to a probability value of a category. The size of these two numerical values ​​can be used to determine whether the website to be detected is a normal website or a phishing website.

[0158] Exemplarily, when the second model sets the threshold of the probability value corresponding to the phishing website to 0.4, if the probability value corresponding to the phishing website is 0.6 and the probability value corresponding to the normal website is 0.4, then the website is determined to be a phishing website; if the probability value corresponding to the phishing website is 0.3 and the probability value corresponding to the normal website is 0.7, then the website is determined to be a normal website.

[0159] Step 160: The server sends the second website prediction result to the client.

[0160] In a specific implementation, after obtaining the second website prediction result according to the second model, the server encrypts the second website prediction result and returns it to the client through an application programming interface (Application Programming Interface, API), and the client informs the user of the detailed detection result.

[0161] Step 170: When the second website prediction result indicates that the website to be detected is a normal website, the client accesses the website to be detected; when the second website prediction result indicates that the website to be detected is a phishing website, the client will intercept the user's request to access the website to be detected.

[0162] In summary, the present application provides a method for detecting phishing websites. The first model with a small number of parameters is deployed in the browser plug-in of the client. When the user visits the website, the URL and HTML code of the website to be detected can be obtained in real time, and feature extraction and model prediction can be performed respectively, thereby improving the efficiency of phishing website detection. The second model is deployed on the server side. On the basis of the preliminary detection on the client side that the website to be detected may be a phishing website, further detection can be performed on the relevant data of the website to be detected. Among them, the second model combines the features of three different dimensions, namely the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot, so as to extract deeper features of the website to be detected, thereby improving the accuracy of phishing website detection. In addition, before the client sends the data of the website to be detected to the server side, it needs to first ask the customer whether it agrees to further detection, and encrypt the relevant data based on the user's consent, and then send it to the server side. This method can better protect the user's privacy, ensure that user data will not be disseminated at will, and reduce the risk of data leakage.

[0163] Figure 8 and Fig. 9 A schematic diagram of a possible phishing website detection device provided in an embodiment of the present application. The phishing website detection device can be used to implement the functions of the client in the above method embodiment.

[0164] like Figure 8 As shown, the phishing website detection device 800 includes a transceiver unit 810 and a processing unit 820 .

[0165] When the phishing website detection device 800 is used to implement Figure 1 The functions of the client in the method embodiment shown are:

[0166] The transceiver unit 810 is used to obtain a data set of a website to be detected, wherein the data set of the website to be detected includes a uniform resource locator URL of the website to be detected and a hypertext markup language HTML code of the website to be detected;

[0167] The processing unit 820 is used to determine a feature vector of the URL based on the URL, and to determine a first feature vector corresponding to the HTML code based on the HTML code; and is also used to input the feature vector of the URL and the first feature vector corresponding to the HTML code into a first model to obtain a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; the first model is deployed in a browser plug-in of a client;

[0168] The transceiver unit 810 is also used to send a data set of the website to be detected and a screenshot of the web page of the website to be detected to the server when the first website prediction result indicates that the website to be detected is a phishing website; and to receive a second website prediction result from the server, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

[0169] In a possible implementation, the processing unit 820 is further configured to access the website to be detected when the first website prediction result indicates that the website to be detected is a normal website.

[0170] In a possible implementation, the processing unit 820, when determining the feature vector of the URL based on the URL, is specifically used to convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values; and is used to determine the feature vector of the URL using a bidirectional long short-term memory network according to the first numerical sequence.

[0171] In a possible implementation, the processing unit 820, when determining the first feature vector corresponding to the HTML code based on the HTML code, is specifically used to extract at least one feature based on the HTML code, wherein the at least one feature includes: one or more of the length of the HTML code, the number of external resources, the number of internal resources, the number of internal links, the number of external links, the number of preset tags, the number of comments, the number of preset events, whether the page uses the hypertext transfer security protocol https protocol, the number of page redirections, and the time required for the page to load; and is used to determine the first feature vector of the HTML code using a fully connected neural network based on the at least one feature.

[0172] In a possible implementation, before sending the data set of the website to be detected and the screenshot of the web page of the website to be detected to the server, the transceiver unit 810 is also used to receive a first instruction, and the first instruction is used to indicate agreement to send the data set of the website to be detected and the screenshot of the web page of the website to be detected to the server.

[0173] In a possible implementation, when the first website prediction result indicates that the website to be detected is a phishing website, the processing unit 820 is also used to prompt the user that the website to be detected may be a phishing website, and ask the user whether to agree to send the data set of the website to be detected and the web page screenshot of the website to be detected to the server.

[0174] In a possible implementation, the first model is obtained based on a first phishing website historical data set and a first normal website historical data set, wherein the first phishing website historical data set includes URLs of M1 phishing websites and HTML codes of the M1 phishing websites, and the first normal website historical data set includes URLs of N1 normal websites and HTML codes of the N1 normal websites, and M1 and N1 are positive integers.

[0175] When the phishing website detection device 800 is used to implement Figure 1 The functions of the server in the method embodiment shown are:

[0176] The transceiver unit 810 is used to receive a data set of a website to be detected and a webpage screenshot of the website to be detected from a client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected;

[0177] The processing unit 820 is used to determine the feature vector of the URL based on the URL, determine the second feature vector corresponding to the HTML code based on the HTML code, and determine the feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected; and is also used to input the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into a second model to obtain a second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website;

[0178] The transceiver unit 810 is further configured to send the second website prediction result to the client.

[0179] In a possible implementation, the processing unit 820, when determining the feature vector of the URL based on the URL, is specifically used to convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values; and is used to determine the feature vector of the URL using a bidirectional long short-term memory network according to the first numerical sequence.

[0180] In a possible implementation, the processing unit 820, when determining the first feature vector corresponding to the HTML code based on the HTML code, is specifically used to determine a first text sequence according to the HTML code, the first text sequence being arranged in sequence according to HTML tags, tag attributes and tag texts; is also used to determine a plurality of sub-texts according to the first text sequence; is also used to convert the plurality of sub-texts into a plurality of sub-vectors; and is used to encode the plurality of sub-vectors using a preset model to obtain a second feature vector corresponding to the HTML code, wherein the second feature vector corresponding to the HTML code is an average pooling result of the plurality of sub-vectors.

[0181] In a possible implementation, the processing unit 820, when determining the feature vector of the web page screenshot based on the web page screenshot of the website to be detected, is specifically used to crop the web page screenshot of the website to be detected according to preset parameters, and normalize the cropped image, and determine the feature vector of the web page screenshot based on the normalized image.

[0182] In a possible implementation, the second model is obtained based on a second phishing website historical data set and a second normal website historical data set, wherein the second phishing website historical data set includes URLs of M2 phishing websites, HTML codes of the M2 phishing websites, and web page screenshots of the M2 phishing websites, and the second normal website historical data set includes URLs of N2 normal websites, HTML codes of the N2 normal websites, and web page screenshots of the N2 normal websites, and M2 and N2 are positive integers.

[0183] For more detailed description of the transceiver unit 810 and the processing unit 820, please refer to Figure 1 The relevant description in the method embodiment shown is directly obtained and will not be repeated here.

[0184] like Fig. 9 As shown, the phishing website detection device 900 includes a processor 910 and a communication interface 920. The processor 910 and the communication interface 920 are coupled to each other. It is understandable that the communication interface 920 can be a transceiver or an input-output interface. Optionally, the phishing website detection device 900 may also include a memory 930 for storing instructions executed by the processor 910 or storing input data required by the processor 910 to run the instructions or storing data generated after the processor 910 runs the instructions.

[0185] When the phishing website detection device 800 is used to implement Figure 1 When the method is shown, the processor 910 is used to implement the functions of the above-mentioned processing unit 820, and the communication interface 920 is used to implement the functions of the above-mentioned transceiver unit 810.

[0186] The division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0187] Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: computer program code, when the computer program code is executed on a computer, the computer executes any of the phishing website detection methods discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the phishing website detection method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0188] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the phishing website detection methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of the phishing website detection method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0189] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0190] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting phishing websites, characterized in that: The method is applied to a client, and the method comprises: Acquire a data set of a website to be detected, wherein the data set of the website to be detected includes a uniform resource locator URL of the website to be detected and a hypertext markup language HTML code of the website to be detected; Determine a feature vector of the URL based on the URL, and determine a first feature vector corresponding to the HTML code based on the HTML code; Inputting the feature vector of the URL and the first feature vector corresponding to the HTML code into a first model, obtaining a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; the first model is deployed in a browser plug-in of a client; When the first website prediction result indicates that the website to be detected is a phishing website, sending a data set of the website to be detected and a webpage screenshot of the website to be detected to a server; A second website prediction result is received from the server, where the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

2. The method according to claim 1, characterized in that The method further comprises: When the first website prediction result indicates that the website to be detected is a normal website, the website to be detected is accessed.

3. The method according to claim 1, characterized in that Determining a feature vector of the URL based on the URL includes: Convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical value sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values; A bidirectional long short-term memory network is used to determine a feature vector of the URL according to the first numerical sequence.

4. The method according to claim 1, characterized in that Determining a first feature vector corresponding to the HTML code based on the HTML code includes: Extracting at least one feature according to the HTML code, wherein the at least one feature includes: one or more of the length of the HTML code, the number of external resources, the number of internal resources, the number of internal links, the number of external links, the number of preset tags, the number of comments, the number of preset events, whether the page uses the hypertext transfer security protocol https protocol, the number of page redirections, and the time required for the page to be loaded; A first feature vector of the HTML code is determined using a fully connected neural network according to the at least one feature.

5. The method according to claim 1, characterized in that Before sending the data set of the website to be detected and the webpage screenshot of the website to be detected to the server, the process includes: A first instruction is received, where the first instruction is used to indicate consent to send the data set of the website to be detected and the webpage screenshot of the website to be detected to the server.

6. The method according to claim 5, characterized in that Also includes: When the first website prediction result indicates that the website to be detected is a phishing website, the user is prompted that the website to be detected may be a phishing website, and the user is asked whether to agree to send the data set of the website to be detected and the webpage screenshot of the website to be detected to the server.

7. The method according to claim 1, characterized in that The first model is obtained based on a first phishing website historical data set and a first normal website historical data set, wherein the first phishing website historical data set includes URLs of M1 phishing websites and HTML codes of the M1 phishing websites, and the first normal website historical data set includes URLs of N1 normal websites and HTML codes of the N1 normal websites, and M1 and N1 are positive integers.

8. A method for detecting phishing websites, characterized in that: The method is applied to the server, and the method comprises: Receiving a data set of a website to be detected and a webpage screenshot of the website to be detected from a client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected; Determine a feature vector of the URL based on the URL, determine a second feature vector corresponding to the HTML code based on the HTML code, and determine a feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected; Inputting the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into a second model to obtain a second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; The second website prediction result is sent to the client.

9. The method according to claim 8, characterized in that Determining a feature vector of the URL based on the URL includes: Convert each character in the URL into a corresponding numerical value according to a first mapping relationship to obtain a first numerical value sequence, wherein the first mapping relationship indicates a mapping relationship between different characters and corresponding numerical values; A bidirectional long short-term memory network is used to determine a feature vector of the URL according to the first numerical sequence.

10. The method according to claim 8, characterized in that Determining a first feature vector corresponding to the HTML code based on the HTML code includes: Determine a first text sequence according to the HTML code, wherein the first text sequence is arranged in sequence according to HTML tags, tag attributes, and tag text; Determine a plurality of subtexts according to the first text sequence; Converting the plurality of sub-texts into a plurality of sub-vectors; The plurality of sub-vectors are encoded by using a preset model to obtain a second feature vector corresponding to the HTML code, wherein the second feature vector corresponding to the HTML code is an average pooling result of the plurality of sub-vectors.

11. The method according to claim 8, characterized in that Determining a feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected includes: The webpage screenshot of the website to be detected is cropped according to preset parameters, and the cropped image is normalized, and the feature vector of the webpage screenshot is determined based on the normalized image.

12. The method according to claim 8, characterized in that The second model is obtained based on a second phishing website historical data set and a second normal website historical data set, wherein the second phishing website historical data set includes URLs of M2 phishing websites, HTML codes of the M2 phishing websites, and web page screenshots of the M2 phishing websites, and the second normal website historical data set includes URLs of N2 normal websites, HTML codes of the N2 normal websites, and web page screenshots of the N2 normal websites, and M2 and N2 are positive integers.

13. A phishing website detection device, characterized in that: The device comprises: a transceiver unit and a processing unit; The transceiver unit is used to obtain a data set of a website to be detected, wherein the data set of the website to be detected includes a uniform resource locator URL of the website to be detected and a hypertext markup language HTML code of the website to be detected; The processing unit is used to determine a feature vector of the URL based on the URL, and to determine a first feature vector corresponding to the HTML code based on the HTML code; and is also used to input the feature vector of the URL and the first feature vector corresponding to the HTML code into a first model to obtain a first website prediction result output by the first model, wherein the first website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; the first model is deployed in a browser plug-in of a client; The transceiver unit is also used to send a data set of the website to be detected and a screenshot of the web page of the website to be detected to the server when the first website prediction result indicates that the website to be detected is a phishing website; and to receive a second website prediction result from the server, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website.

14. A phishing website detection device, characterized in that: The device comprises: a transceiver unit and a processing unit; The transceiver unit is used to receive a data set of a website to be detected and a webpage screenshot of the website to be detected from a client, wherein the data set of the website to be detected includes the URL of the website to be detected and the HTML code of the website to be detected; The processing unit is used to determine the feature vector of the URL based on the URL, determine the second feature vector corresponding to the HTML code based on the HTML code, and determine the feature vector of the webpage screenshot based on the webpage screenshot of the website to be detected; and is also used to input the feature vector of the URL, the second feature vector corresponding to the HTML code, and the feature vector of the webpage screenshot into a second model to obtain a second website prediction result output by the second model, wherein the second website prediction result is used to determine whether the website to be detected is a normal website or a phishing website; The transceiver unit is further used to send the second website prediction result to the client.

15. A phishing website detection device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of claims 1-12 according to the obtained program instructions.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 12.

17. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 12.

Images