An efficient cascading multi-stage adaptive threshold phishing detection method

Abstract

The application discloses a kind of high-efficiency cascade multi-stage adaptive threshold phishing detection methods, for the problem of insufficient anti-robustness in existing phishing detection technology, insufficient multi-modal cooperation, detection efficiency and precision imbalance, etc., cascade multi-stage adaptive threshold phishing detection framework is proposed.The first stage is realized by light single-mode detection model to achieve millisecond-level preliminary screening, and more than 80% low-level threats are intercepted;The second stage adopts a multi-modal fusion model with strong anti-interference capability, combines frequency domain feature enhancement and dynamic noise injection technology to improve anti-robustness, and excavates deep correlation features through cross-modal attention mechanism to realize accurate identification of complex phishing attacks.Online learning module is integrated at the same time, so that the system can continuously adapt to new attack patterns, and finally achieve high-precision, low-latency, strong anti-interference detection capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to an efficient cascading multi-stage adaptive threshold phishing detection method. BACKGROUND

[0002] With the accelerated advancement of digitalization, phishing attacks have become a major threat in the global network security field. According to the 2023 Global Network Security Assessment Report, phishing attacks continue to rise in the proportion of various network crimes, and have become one of the most destructive forms of attacks in the digital economy era.

[0003] For phishing attacks, attackers will carefully design a phishing website similar to the target website, or a website with false information. Once the victim accesses the website and trusts the content of the website, the attacker may obtain the victim's sensitive information such as account and password. Payment transactions, financial securities, etc. can directly cause property losses to network users, and the production of phishing websites does not require too much technical content, but uses human psychological weaknesses for fraud, so the number of phishing websites is growing. This type of attack not only exploits technical vulnerabilities, but also digs deeper into human weaknesses, creating a dual challenge of technology and network security awareness. Therefore, it is the responsibility of the Internet community to combat phishing websites.

[0004] In the early days, there were three main ways to detect phishing websites: (1) Based on black and white list mechanism: mainly relying on collecting relevant information of known phishing websites such as website address, etc. and listing them in the blacklist database. When the user accesses the website, it is matched with the website on the blacklist to identify potential phishing websites. (2) Based on heuristic detection method: through artificial rule construction and feature extraction including URL features and text content features, etc. and then constructing a feature vector according to some common features and behaviors of network phishing to train a classifier model. (3) Based on visual similarity detection model: comparing the images of phishing webpages and regular webpages. If the matching degree is higher than the threshold, it is considered that the webpage is a phishing webpage.

[0005] Most current research focuses on improving feature representation, model structure and algorithm to improve detection accuracy. Secondly, existing methods mostly rely on single modality or limited information of dual modality for detection, which can only capture some abnormal features of the website and do not have strong generalization ability. And the detection results use a one-size-fits-all mode, only inputting one model for detection, but using only a single modality cannot fully utilize the relevance and interaction between multiple modalities. While the multi-modal fusion method can make up for the shortcomings of single modality focusing on only one feature of the website, but the time cost of simultaneous detection also increases. SUMMARY

[0006] In view of the above deficiencies in the prior art, the present application provides a high-efficiency cascading multi-stage adaptive threshold phishing detection method.

[0007] In order to achieve the above-mentioned purposes, the technical scheme adopted by the present application is:

[0008] A high-efficiency cascading multi-stage adaptive threshold phishing detection method, comprising the following steps:

[0009] S1, collecting data of phishing websites and regular websites and labeling, constructing a multi-dimensional data set including URL features, visual elements and HTML source code;

[0010] S2, preprocessing the constructed multi-dimensional data set to obtain standardized features of multiple modalities;

[0011] S3, constructing a single-modality detection model for each standardized feature and performing adversarial defense training;

[0012] S4, integrating the detection models of each modality and optimizing to obtain the optimized multi-modality decision fusion result.

[0013] Further, the S1 specifically comprises the following steps:

[0014] S11, synchronously crawling URL features of phishing and regular websites, including protocol type, domain name composition, path level, file type and parameter field;

[0015] S12, automatically capturing key visual elements of the webpage through Selenium, identifying brand logos, payment-related icons and inducement pictures;

[0016] S13, parsing HTML source code, extracting hyperlink dynamic behavior, user privacy collection form and text content features, and constructing structured metadata in combination with source code length.

[0017] Further, the S2 specifically comprises the following steps:

[0018] S21, sequentially performing noise filtering, word segmentation and padding and truncation on the URL features and HTML text in the multi-dimensional data set, and using One-Hot encoding and word embedding to generate a semantic matrix, and using a text feature extraction algorithm to extract semantic features of the URL features and the HTML text;

[0019] S22, performing high-frequency filtering and wavelet energy analysis on the visual elements in the multi-dimensional data set, respectively extracting semantic features of the spatial dimensions of the original visual elements and frequency domain features of the high-frequency filtered visual elements, and using a channel attention mechanism to dynamically weight and fuse the obtained semantic features of the spatial dimensions and the frequency domain features.

[0020] Further, the specific manner of high-frequency filtering and wavelet energy analysis on the visual elements in the multi-dimensional data set in S22 is as follows:

[0021]

[0022]

[0023] wherein, is a Gaussian filter kernel, is the distance from the frequency point (u, v) to the center of the spectrum, is a cut-off frequency; is a wavelet energy feature, is the coefficient of the HH sub-band at position MN is the size of the HH sub-band after wavelet decomposition.

[0024] Further, the specific manner of dynamically weighting and fusing the semantic features and frequency domain features of the spatial latitude obtained in S23 by using the channel attention mechanism is as follows:

[0025]

[0026] wherein, is the semantic feature and frequency domain feature fused by the channel attention mechanism; is the semantic feature of the spatial latitude; is the frequency domain feature; is a weight.

[0027] Further, S3 specifically comprises the following steps:

[0028] S31, establishing a URL feature detection model, using a 64-channel convolution kernel with a height of 2 to extract the local sequence pattern of the URL feature, using a bidirectional LSTM to capture the temporal context information in both directions, and using a fully connected layer to perform batch normalization and output the final result through logistic regression;

[0029] S32, establishing an HTML content detection model, performing semantic encoding on the text in the HTML to convert it into a fixed-length token sequence, inputting the lightweight pre-trained model, extracting the semantic vector of the [CLS] label as the global feature, and inputting the vector into a logistic regression classifier to output the classification probability through linear transformation and the Sigmoid function;

[0030] S33, establishing a visual element detection model, using EfficientNet-B3 transfer learning to extract the features of normal samples on regular websites crawled using selenium, comparing the Logo region positioned by YOLOv5 in real time with the visual elements in the established normal sample library, and determining whether the webpage is legal by comparing the domain name of the webpage with the domain name of the brand associated with the logo.

[0031] Further, the specific manner of comparing the Logo region positioned by the real-time YOLOv5 in S33 with the normal sample library is to calculate the L2 distance between the new sample and the sample library in real time, and if the distance exceeds the dynamic threshold, the new sample is directly determined as abnormal.

[0032]

[0033] wherein, the i-th test vector of the region to be detected, the i-th feature vector of the region to be detected.

[0034] Further, S4 specifically comprises the following steps:

[0035] S41, constructing a feature matrix with the confidence scores of the multiple single-modal detection models established in S3 as features, and training the constructed feature matrix to obtain the contribution weight of each modality;

[0036] S42, using a sliding window to statistically calculate the confidence mean and standard deviation of the last K samples according to the confidence distribution of the historical samples, setting a threshold according to the confidence distribution of the samples, dynamically adjusting the weight according to the performance of each modality, and obtaining the final result of the confidence by weighted voting.

[0037] Further, the specific manner of training the constructed feature matrix to obtain the contribution weight of each modality in S41 is:

[0038]

[0039]

[0040] wherein, is the feature matrix, the confidence scores of the URL feature, HTML and visual element monitoring model in turn; is a Sigmoid function, is the modality label of the i-th modality, is the i-th feature matrix, is a regression parameter, T is a matrix transpose, is a constant.

[0041] The present application has the following beneficial effects:

[0042] 1. Cascade architecture realizes computing resource optimization, a first stage adopts a lightweight single-modal model to intercept high-confidence phishing samples in real time, and only low-confidence samples are subjected to a second stage multi-modal deep model, which can reduce computing overhead, reduce average inference delay, improve efficiency compared with a traditional multi-modal model, and solve the problems of traditional one-stage models that only focus on one feature and the time overhead of feature-level multi-modal fusion that focuses on multiple features.

[0043] 2. Dynamic weight fusion enhances model robustness, the second stage introduces an adaptive weight distribution mechanism based on real-time confidence, dynamically adjusts the contribution of URL, HTML and visual modalities, and dynamically adjusts the decision threshold to reduce false positive rate by calculating the mean value mu and standard deviation sigma of confidence based on a sliding window and adaptive threshold.

[0044] 3. Modular design improves flexibility, by decoupling single-modal detection model and fusion decision layer, new feature modalities (such as JS behavior analysis) can be quickly integrated, reducing engineering adaptation cost.

[0045] 4. In the website visual feature module, new attack features are added to effectively respond to local tampering, adversarial samples and other new attacks. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 The figure shows a high-efficiency cascade multi-stage adaptive threshold phishing detection method. DETAILED DESCRIPTION

[0047] The specific embodiments of the present application are described below to facilitate understanding of the present application by those skilled in the art, but it should be clear that the present application is not limited to the scope of the specific embodiments, and for those skilled in the art, it is obvious that various changes are within the spirit and scope of the present application as defined in the appended claims, and all applications utilizing the concept of the present application are within the scope of protection.

[0048] A high-efficiency cascade multi-stage adaptive threshold phishing detection method, as shown in Figure 1 includes the following steps:

[0049] S1, collect data of phishing websites and regular websites and label them, and construct a multi-dimensional data set including URL, visual elements and HTML source code;

[0050] In this embodiment, the steps include:

[0051] S11, synchronously crawl URL features of phishing and regular websites, including protocol type, domain name composition, path level, file type and parameter field;

[0052] S12. Use Selenium to automatically capture key visual elements on web pages, identifying brand logos, payment-related icons, and persuasive images;

[0053] S13. Parse the HTML source code, extract the dynamic behavior of hyperlinks, user privacy collection forms and text content features, and construct structured metadata based on the source code length, specifically including: the number of hyperlinks, the number of empty links, the ratio of external links, login forms that collect and submit personal data, the length of the HTML source code, and the HTML text content.

[0054] S2. Preprocess the constructed multi-dimensional dataset to obtain standardized features of the multimodal data.

[0055] This embodiment specifically includes the following steps:

[0056] S21. Perform noise filtering, word segmentation, and padding / truncation on the URLs and HTML texts in the multi-dimensional dataset in sequence, and generate a semantic matrix using One-Hot encoding and word embedding. Use text feature extraction algorithms to extract the semantic features of the URLs and HTML texts.

[0057] The collected text data is first processed by filtering for illegal characters, word segmentation, removal of stop words, and replacement of related words to remove irrelevant noise while retaining the core text content. Then, based on the URL dataset and sensitive vocabulary list, the total length L of characters and keywords in each URI is determined to be 300. If L exceeds 300, the extra characters are truncated at the end of the URL; if L is less than 300, the remaining characters are truncated at the end. <pad>The marker fills in as an additional word. If an unknown character appears in the URL, it is marked as unknown <unk>The text data is then digitized by using One-Hot encoding. According to the mapping table, a unique code is assigned to each character and sensitive word to construct the encoding matrix of the URL. Then, the matrix U' is converted into a 300x64 two-dimensional dense matrix X containing semantic information through a word embedding layer, which is used as the input of the convolution layer.

[0058]

[0059]

[0060] where: u' is the encoding of the characters or words in the URL, X i is a 64-dimensional column vector.

[0061] S22, high-frequency filtering and wavelet energy analysis are performed on the visual elements in the multi-dimensional data set to extract the spatial dimension semantic features of the original visual elements and the frequency domain features of the high-frequency filtered visual elements, respectively, and the channel attention mechanism is used to dynamically weight and fuse the obtained spatial latitude semantic features and frequency domain features.

[0062] Then comes the feature extraction stage, where the text feature extraction algorithm TF-IDF is used to convert the text data into a vector form that can be processed by a computer. TF-IDF is a commonly used weight in information retrieval and text mining, which can capture the relationship and semantic information between words and put them into the model for training.

[0063]

[0064]

[0065] where: represents the word in the article , represents the total number of words in the article ; represents the total number of articles in the corpus. represents the number of articles containing the word (i.e. ), which is zero if the word does not appear in any other article in the corpus.

[0066] For web page picture analysis of its anti-interference, this patent proposes a DSF-Net combined with frequency domain analysis and double-flow network anti-defense method, first calculates its Gaussian filter kernel and wavelet energy features:

[0067]

[0068] where the distance of the frequency point (u, v) to the center of the spectrum, the cut-off frequency (control the filtering range)

[0069]

[0070] wherein is the coefficient of the HH subband at position MN is the size of the HH subband after wavelet decomposition.

[0071] After calculating the Gaussian filter kernel and the wavelet energy feature, the original picture is input into a lightweight MobileNetV3 network to extract spatial dimension semantic features to obtain an output feature map , and the high-frequency filtered image is input into the MobileNetV3 network to capture high-frequency disturbance features and edge information to obtain a feature map , then the obtained , dynamic weighted fusion through channel attention mechanism:

[0072] .

[0073] S3, constructing a single-modal detection model for each normalized feature and performing adversarial defense training;

[0074] In this embodiment, the following steps are specifically included:

[0075] S31, establishing a URL feature detection model, using a 64-channel convolution kernel with a height of 2 to extract the local sequence pattern of the URL feature, using a bidirectional LSTM to capture the temporal context information in both directions, and using a fully connected layer to perform batch normalization and output the final result through logistic regression;

[0076] The CNN-BiLSTM model combines a convolutional neural network (CNN) and a bidirectional long short-term memory network (BiLSTM). The CNN extracts local spatial features (such as texture, temporal segments), the BiLSTM captures temporal context information in both directions, enhances long-distance dependency modeling, and introduces Dropout and regularization techniques to prevent overfitting for the final result output.

[0077] The URL vector matrix processed in S2 is input into a convolutional neural network, which automatically extracts local features from the feature matrix through a convolution kernel. The convolution kernel height h is set to 2, the width is consistent with the dimension of the character vector, which is 64, the number of convolution kernels is 200, and the convolution kernel sliding step is set to 1. The URL embedding matrix obtained by a certain convolution kernel f at the i-th sliding window is set as X;

[0078]

[0079] where: x i is the vector representation of the character or sensitive word.

[0080] The subsequent data is batch normalized through the full connection layer and then output through the logistic regression to obtain the final result.

[0081]

[0082]

[0083]

[0084] where is the Sigmoid function:

[0085] .

[0086] S32, an HTML content detection model is established, the text in the HTML is semantically encoded into a fixed-length token sequence, input into a lightweight pre-trained model, the semantic vector of the [CLS] label is extracted as a global feature, and the vector is input into a logistic regression classifier, and a classification probability is output through linear transformation and Sigmoid function;

[0087] The text in the HTML is segmented and semantically encoded into a fixed-length token sequence, input into a lightweight pre-trained DistilBERT model, and the semantic vector of the [CLS] label is extracted as a global feature; then the vector is input into a logistic regression (LR) classifier, and a classification probability is output through linear transformation and Sigmoid function.

[0088]

[0089]

[0090] The binary cross-entropy loss function is used for optimization:

[0091]

[0092] where: Y i is the true label, and P i is the predicted label.

[0093] S33, a visual element detection model is established, EfficientNet-B3 transfer learning is used to extract visual features, the Logo region positioned by YOLOv5 is compared with the normal sample library in real time, and the domain name of the webpage is compared with the domain name of the brand associated with the logo to determine whether the webpage is legal.

[0094] EfficientNet-B3 is used for transfer learning, and its compound scaling strategy balances network depth, width and resolution to achieve efficient feature extraction for anomaly detection. After extracting the target region feature vector, a normal sample feature library is established. When a user opens a webpage, the detection system first uses yolov5 to locate the key areas in the image (such as brand logo, input form) in real time, extracts the image in the located key area, and calculates the L2 distance between the new sample and the sample library in real time. If it exceeds the dynamic threshold, it is directly determined to be abnormal. If no abnormality is identified in the picture, the detector is used to determine the brand to which the logo belongs. Then the system compares the domain name of the webpage with the domain name of the brand associated with the logo to determine whether the webpage is legal.

[0095]

[0096] wherein: V test feature vector of the region to be detected, V ref feature vector of the region to be detected.

[0097] S4, integrate the detection models of each modality and optimize to obtain the optimized multi-modal decision fusion result.

[0098] In this embodiment, the following steps are specifically included:

[0099] Specifically, the following steps are included:

[0100] S41, construct a feature matrix with the confidence scores of the multiple single-modal detection models established in S3 as features, and train the constructed feature matrix to obtain the contribution weights of each modality;

[0101] The confidence scores of each modality are output as features to construct a feature matrix X, and a logistic regression model is trained as a meta-classifier to learn the contribution weights of each modality through maximum likelihood estimation. The prediction probabilities of each modality on the validation set are collected to construct a feature matrix and put it into the model to obtain the contribution weights of each modality.

[0102]

[0103]

[0104] wherein, is a feature matrix, the confidence scores of the URL feature, HTML and visual element monitoring models in turn; is a Sigmoid function, is the modality label of the i-th modality, is the i-th feature matrix, is a regression parameter, T is a matrix transpose, is a constant.

[0105] S42, using a sliding window to statistically maintain the mean and standard deviation of the confidence of the last K samples according to the confidence distribution of the historical samples, setting a threshold according to the confidence distribution of the samples, dynamically adjusting the weight according to the performance of each modality, and obtaining the final result of the confidence through weighted voting.

[0106] Considering the adjustment of the sample size and the dynamic change of the real-time confidence of each modality, the present patent application discloses a multi-modal model with adaptive and dynamic weight adjustment. First, the confidence of each modality is normalized using a Softmax function p m , and then the results are dynamically fused to obtain the final result p final . K p final , the mean and standard deviation of the last K samples are statistically maintained using a sliding window according to the confidence distribution of the historical samples

[0107]

[0108]

[0109]

[0110]

[0111]

[0112] wherein: α is a temperature coefficient that controls the steepness of the weight distribution. α -> 0, the weight tends to be uniformly distributed, α -> ∞, only the highest confidence modality dominates. is the weight, λ is a sensitivity coefficient (for example λ = 2 corresponds to a 95% confidence interval).

[0113] After obtaining the real-time confidence of each modality, the weight is dynamically adjusted according to the performance of each modality, and then weighted voting is performed to obtain the final result.

[0114] .

[0115] ​​​The real website is predicted and comprehensively evaluated by using the model, and through a large number of experimental designs of relevant anti-phishing detection schemes at home and abroad, the performance of the cascade multi-stage framework is judged according to the evaluation indexes, and the main performance index forms are summarized: the correct positive rate (TPR) and the false positive rate (FPR) are used as the decisive reference points for distinguishing the performance; the precision and the recall reflect the identification ability of the phishing webpage, and the F1 value simultaneously considers the precision and the accuracy, which is the weighted average of the two, and can comprehensively evaluate the performance of the detection model. The specific calculation method is as follows:

[0116]

[0117]

[0118]

[0119]

[0120]

[0121]

[0122] Wherein: TP represents the number of predicted phishing webpages that are actually phishing webpages; FP represents the number of predicted phishing webpages that are actually legal webpages; TN represents the number of predicted legal webpages that are actually legal webpages; and FN represents the number of predicted legal webpages that are actually phishing webpages.

[0123] The present application is described with reference to flowcharts and / or block diagrams that illustrate the method, device (system) and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks. Figure 1 The device that implements the function specified in one flow or multiple flows and / or blocks.

[0124] These computer program instructions can also be stored in a computer-readable memory that can guide the computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including instruction devices, which implement the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks. Figure 1 the function specified in the one or more blocks.

[0125] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, so that the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flows Figure 1 the flows or the plurality of flows and / or blocks Figure 1 the function specified in the one or more blocks.

[0126] The principles and implementation manners of the present application are described in the specific embodiments in the present application, and the above embodiment descriptions are only for helping to understand the method of the present application and its core idea; meanwhile, for the ordinary skilled in the art, according to the idea of the present application, the specific implementation manners and application scopes will have changes, and the above descriptions should not be understood as the limitation of the present application.

[0127] The person skilled in the art will understand that the embodiments described herein are for helping the reader to understand the principles of the present application, and should be understood as the protection scope of the present application not being limited to such specific descriptions and embodiments. The person skilled in the art can make various other specific modifications and combinations according to the technical inspirations disclosed in the present application without departing from the essence of the present application, and these modifications and combinations are still within the protection scope of the present application.< / unk> < / pad>

Claims

1. An efficient cascading multi-stage adaptive threshold phishing detection method, characterized in that, Comprise the following steps: S1, collect the data of phishing websites and regular websites and label, build a multi-dimensional data set including URL features, visual elements, HTML source code, specifically including the following steps: S11, synchronously crawl the URL features of phishing and regular websites, including protocol type, domain composition, path level, file type and parameter field; S12, capture key visual elements of the webpage automatically through Selenium, identify brand logos, payment-related icons and inducement pictures; S13, parse the HTML source code, extract hyperlink dynamic behavior, user privacy collection form and text content features, and construct structured metadata combined with source code length; S2, pre-process the constructed multi-dimensional data set to obtain standardized features of multiple modalities; S3, for each standardized feature, construct a single-modality detection model, specifically including the following steps: S31, establish a URL feature detection model, use a 64-channel convolution kernel with a height of 2 to extract the local sequence pattern of the URL feature, use a bidirectional LSTM to capture the context information in both directions, and perform batch normalization through a fully connected layer to output the final result through logistic regression; S32, establish an HTML content detection model, perform semantic encoding on the text in the HTML to convert it into a fixed-length token sequence, input the lightweight pre-trained model, extract the semantic vector of the [CLS] tag as the global feature, and input the vector into the logistic regression classifier, and output the classification probability through linear transformation and Sigmoid function; S33, establish a visual element detection model, use EfficientNet-B3 transfer learning to extract the normal sample features on the regular website crawled by Selenium, compare the Logo region located by YOLOv5 with the visual elements in the normal sample library in real time, and determine whether the webpage is legal by comparing the domain name of the webpage with the domain name of the brand associated with the logo; S4, integrate the detection models of each modality and optimize to obtain the optimized multi-modal decision fusion result, specifically including the following steps: S41, construct a feature matrix with the confidence scores of the single-modality detection models established in S3 as features, and train the constructed feature matrix to obtain the contribution weight of each modality, specifically as follows: wherein, is a feature matrix, is the confidence of the URL feature, HTML, and visual element monitoring model, respectively; is a Sigmoid function, is a modality label of the i-th modality, is the i-th feature matrix, is a regression parameter, and T is a matrix transpose, is a constant; S42, according to the confidence score distribution of the historical samples, use a sliding window to calculate the mean and standard deviation of the confidence scores of the latest K samples, set a threshold according to the confidence score distribution of the samples, dynamically adjust the weight according to the performance of each modality, and obtain the final confidence score through weighted voting, specifically as follows: Based on the dynamic change of the real-time confidence of each single modality in S3, the modal confidence is calculated by using the Softmax function p m Normalization is performed and dynamic fusion is performed to obtain a fusion result p final According to the confidence distribution of the historical samples, the last K p final Mean and standard deviation According to the confidence distribution of the samples, a threshold is dynamically set to obtain the real-time confidence of each modality, and according to the performance of each modality, high-confidence phishing samples are intercepted in real time by using single-modality models, low-confidence phishing samples are enabled for multi-modality deep detection, weights are dynamically adjusted, and a weighted vote is performed to obtain the final fusion result.​ 2. The efficient cascading multi-stage adaptive threshold phishing detection method of claim 1, wherein, The S2 specifically includes the following steps: S21, sequentially perform noise filtering, word segmentation and padding and truncation on the URL features and HTML text in the multi-dimensional data set, and use One-Hot encoding and word embedding to generate a semantic matrix, and use a text feature extraction algorithm to extract the semantic features of the URL features and HTML text; S22, high-frequency filtering and wavelet energy analysis are performed on the visual elements in the multi-dimensional data set, semantic features of spatial dimensions of the original visual elements and frequency domain features of the high-frequency filtered visual elements are extracted respectively, and the obtained semantic features of spatial dimensions and frequency domain features are dynamically weighted and fused by using a channel attention mechanism.

3. The efficient cascading multi-stage adaptive threshold phishing detection method of claim 2, wherein, The specific manner of high-frequency filtering and wavelet energy analysis on the visual elements in the multi-dimensional data set in the S22 is as follows: wherein is a Gaussian filter kernel, is the distance of the frequency point (u, v) to the center of the spectrum, is the cut-off frequency; is the wavelet energy feature, is the coefficient of the HH subband at position MN is the size of the HH subband after wavelet decomposition.

4. The efficient cascading multi-stage adaptive threshold phishing detection method of claim 2, wherein, The specific manner of dynamically weighting and fusing the obtained semantic features of spatial dimensions and frequency domain features by using the channel attention mechanism in the S23 is as follows: In the formula, is the semantic feature and the frequency domain feature fused by the channel attention mechanism; is the semantic feature of the spatial latitude; is the frequency domain feature; is the weight.

5. The efficient cascading multi-stage adaptive threshold phishing detection method of claim 1, wherein, The specific manner of real-time comparison of the Logo region positioned by the YOLOv5 with the normal sample library in the S33 is as follows: the L2 distance between the new sample and the sample library is calculated in real time, and if the L2 distance exceeds a dynamic threshold, the new sample is directly determined as abnormal. The specific calculation manner is as follows: In the formula, the i-th test vector of the region to be detected, the i-th feature vector of the region to be detected.

Images